Use 'dns' role

Best practice for an authoritative name server is to leave recursion turned off. However, for some cases it may be necessary to have recursion turned on.

Minimal variables for a working zone

Even though only variable bind_zone_master_server_ip is required for the role to run without errors, this is not sufficient to get a working zone. In order to set up an authoritative name server that is available to clients, you should also at least define the following variables:

Domain definitions

toc_dns_zone_domains:
  - name: mydomain.com
    hosts:
      - name: pub01
        ip: 192.0.2.1
        ipv6: 2001:db8::1
        aliases:
          - ns
      - name: '@'
        ip:
          - 192.0.2.2
          - 192.0.2.3
        sshfp:
          - "3 1 1262006f9a45bb36b1aa14f45f354b694b77d7c3"
          - "3 2 e5921564252fe10d2dbafeb243733ed8b1d165b8fa6d5a0e29198e5793f0623b"
        ipv6:
          - 2001:db8::2
          - 2001:db8::3
        aliases:
          - www
      - name: priv01
        ip: 10.0.0.1
      - name: mydomain.net.
        aliases:
          - name: sub01
            type: DNAME
    networks:
      - '192.0.2'
      - '10'
      - '172.16'
    delegate:
      - zone: foo
        dns: 192.0.2.1
    services:
      - name: _ldap._tcp
        weight: 100
        port: 88
        target: dc001
    naptr:
      - name: "sip"
        order: 100
        pref: 10
        flags: "S"
        service: "SIP+D2T"
        regex: "!^.*$!sip:customer-service@example.com!"
        replacement: "_sip._tcp.example.com."

Minimal slave configuration

    toc_dns_listen_ipv4: ['any']
    toc_dns_allow_query: ['any']
    bind_zone_master_server_ip: 192.168.111.222
    toc_dns_zone_domains:
      - name: example.com

Hosts

Host names that this DNS server should resolve can be specified in hosts as a list of dicts with fields name, ip, aliases and sshfp. Aliases can be CNAME (default) or DNAME records.

To allow to surf to http://example.com/, set the host name of your web server to '@' (must be quoted!). In BIND syntax, @ indicates the domain name itself.

If you want to specify multiple IP addresses for a host, add entries to bind_zone_hosts with the same name (e.g. priv01 in the code snippet). This results in multiple A/AAAA records for that host and allows DNS round robin, a simple load balancing technique. The order in which the IP addresses are returned can be configured with role variable toc_dns_rrset_order.

Networks

As you can see, not all hosts are in the same network. This is perfectly acceptable, and supported by this role. All networks should be specified in networks (part of toc_dns_zone_domains.name dict), though, or the host will not get a PTR record for reverse lookup:

Remark that only the network part should be specified here! When specifying a class B IP address (e.g. "172.16") in a variable file, it must be quoted. Otherwise, the Yaml parser will interpret it as a float.

Based on the idea and examples detailed at https://linuxmonk.ch/wordpress/index.php/2016/managing-dns-zones-with-ansible/ for the gdnsd package, the zonefiles are fully idempotent, and thus only get updated if "real" content changes.

Zone delgation

To delegate a zone to a DNS, it is enough to create a NS record (under delegate) which is the equivalent of:

foo IN NS 192.0.2.1

Service records

Service (SRV) records can be added with the services. This should be a list of dicts with mandatory fields name (service name), target (host providing the service), port (TCP/UDP port of the service) and optional fields priority (default = 0) and weight (default = 0).

ACLs

ACLs can be defined like this:

toc_dns_acls:
  - name: acl1
    match_list:
      - 192.0.2.0/24
      - 10.0.0.0/8

The names of the ACLs will be added to the allow-transfer clause in global options.

Binding Keys

Binding keys can be defined like this:

toc_dns_keys:
  - name: master_key
    algorithm: hmac-sha256
    secret: "azertyAZERTY123456"
toc_dns_extra_include_files:
  - "{{ __toc_dns_auth_file }}"

This will be set in a file "{{ __toc_dns_auth_file }} (e.g. /etc/bind/auth_transfer.conf for debian) which have to be added in the list variable toc_dns_extra_include_files