diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2018-12-03 03:45:59 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2018-12-03 03:46:28 +0100 |
| commit | 07c1734d2c00ce0a52830533b19a02faed678364 (patch) | |
| tree | 917dca1d878e96c1ef28fced837a9059ed7dd765 /roles/common/tasks | |
| parent | 5ad9fc5e963b9a461f60799d7f185a9e2e13522f (diff) | |
Install unbound on metal hosts.
(A validating, recursive, caching DNS resolver.)
Diffstat (limited to 'roles/common/tasks')
| -rw-r--r-- | roles/common/tasks/main.yml | 5 | ||||
| -rw-r--r-- | roles/common/tasks/unbound.yml | 32 |
2 files changed, 37 insertions, 0 deletions
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 7795da8..33a2c39 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -18,6 +18,11 @@ when: "'webmail' in group_names and 'LDAP-provider' not in group_names" - import_tasks: auditd.yml tags: auditd +- import_tasks: unbound.yml + tags: + - unbound + - dns + when: "ansible_processor[1] is search('^(Genuine)?Intel.*') and not ansible_virtualization_role == 'guest'" - import_tasks: rkhunter.yml tags: rkhunter - import_tasks: clamav.yml diff --git a/roles/common/tasks/unbound.yml b/roles/common/tasks/unbound.yml new file mode 100644 index 0000000..b4554ac --- /dev/null +++ b/roles/common/tasks/unbound.yml @@ -0,0 +1,32 @@ +- name: Install unbound + apt: pkg={{ packages }} + vars: + packages: + - unbound + - dns-root-data + +- name: Copy unbound configuration + template: src=templates/etc/unbound/unbound.conf.j2 + dest=/etc/unbound/unbound.conf + owner=root group=root + mode=0644 + register: r + notify: + - Restart unbound + +- name: Start unbound + service: name=unbound state=started + when: not r.changed + +#- meta: flush_handlers + +- name: Use the local DNS server + lineinfile: dest=/etc/resolv.conf create=yes + regexp='^nameserver\s+127\.0\.0\.1\s*$' + line='nameserver 127.0.0.1' + insertbefore='^\s*#*?nameserver\s' + firstmatch=yes + tags: + - resolver + notify: + - Restart Postfix |