From 0fb738411c78c4ba9bad668146418402a1fd0aa0 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:27:48 +0200 Subject: [PATCH] unbound(role): update readme and move task block to top level and remove unused --- roles/unbound/README.md | 26 +++--- roles/unbound/files/no-resolved.resolv.conf | 1 - roles/unbound/handlers/main.yml | 6 -- roles/unbound/tasks/main.yml | 93 ++++++++++----------- 4 files changed, 61 insertions(+), 65 deletions(-) delete mode 100644 roles/unbound/files/no-resolved.resolv.conf diff --git a/roles/unbound/README.md b/roles/unbound/README.md index c44805ba..6043e749 100644 --- a/roles/unbound/README.md +++ b/roles/unbound/README.md @@ -1,6 +1,6 @@ # Unbound DNS resolver -Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). +Role for a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). It is designed to be fast and lean and incorporates modern features based on open standards. - [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/) @@ -9,12 +9,18 @@ It is designed to be fast and lean and incorporates modern features based on ope The following variables can be used to customize this role: -| Variable | Type | Default | Description | -|------------------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| unbound_install_prometheus_exporter | Boolean | `true` | Whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. | -| unbound_bind_interfaces | List of Strings | `[0.0.0.0, ::]` | List of interface names or IP addresses on which unbound will listen for dns queries | -| unbound_enable_unbound_control | Boolean | `true` | Whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. | -| unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled | -| unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) | -| unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. | -| unbound_thread_count | Integer | Max vCPU Count | The number of threads unbound uses | +- `unbound_install_prometheus_exporter`: Boolean of whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. + Defaults to `true`. +- `unbound_bind_interfaces`: List of interface names or IP addresseson which unbound will listen for dns queries. + Defaults to `[0.0.0.0, ::]`. +- `unbound_enable_unbound_control`: Boolean of whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. + Defaults to `true`. +- `unbound_enable_dnssec`: Boolean of whether dnssec validation should be enabled. + Defaults to `true`. +- `unbound_access_control`: **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E). + Defaults to `[]`. +- `unbound_disable_systemd_networkd`: Boolean if true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. + Defaults to `true`. +- `unbound_thread_count`: The number of threads unbound uses. + Defaults to max vCPU Count. + diff --git a/roles/unbound/files/no-resolved.resolv.conf b/roles/unbound/files/no-resolved.resolv.conf deleted file mode 100644 index bbc8559c..00000000 --- a/roles/unbound/files/no-resolved.resolv.conf +++ /dev/null @@ -1 +0,0 @@ -nameserver 127.0.0.1 diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index 72d71734..8104b4a0 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -4,12 +4,6 @@ name: unbound.service state: restarted -- name: unbound.reloaded - become: true - ansible.builtin.systemd: - name: unbound.service - state: reloaded - - name: prometheus-unbound-exporter.restarted become: true ansible.builtin.systemd: diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index d83e95a3..8f9275cf 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -1,55 +1,52 @@ -- name: unbound role main - block: +- name: install unbound dns resolver + become: true + ansible.builtin.package: + name: unbound - - name: install unbound dns resolver - become: true - ansible.builtin.package: - name: unbound +- name: install unbound-anchor + become: true + ansible.builtin.package: + name: unbound-anchor - - name: install unbound-anchor - become: true - ansible.builtin.package: - name: unbound-anchor +- name: ensure correct directory permissions + become: true + ansible.builtin.file: + path: /etc/unbound + state: directory + mode: u=rwX,g=rX,o=rX + recurse: true + owner: unbound + group: unbound - - name: ensure correct directory permissions - become: true - ansible.builtin.file: - path: /etc/unbound - state: directory - mode: u=rwX,g=rX,o=rX - recurse: true - owner: unbound - group: unbound +- name: configure unbound dns resolver + become: true + notify: unbound.restarted + ansible.builtin.template: + src: unbound.conf.j2 + dest: /etc/unbound/unbound.conf + owner: unbound + group: unbound + mode: u=rw,g=r,o=r - - name: configure unbound dns resolver - become: true - notify: unbound.restarted - ansible.builtin.template: - src: unbound.conf.j2 - dest: /etc/unbound/unbound.conf - owner: unbound - group: unbound - mode: u=rw,g=r,o=r +- name: disable systemd-resolved + when: unbound_disable_systemd_networkd + ansible.builtin.include_role: + name: deploy_systemd_resolved_config + vars: + deploy_systemd_resolved_config__enable: false + deploy_systemd_resolved_config__dns: + - 127.0.0.1 - - name: disable systemd-resolved - when: unbound_disable_systemd_networkd - ansible.builtin.include_role: - name: deploy_systemd_resolved_config - vars: - deploy_systemd_resolved_config__enable: false - deploy_systemd_resolved_config__dns: - - 127.0.0.1 +- name: flush handlers + ansible.builtin.meta: flush_handlers - - name: flush handlers - ansible.builtin.meta: flush_handlers +- name: ensure unbound is running and enabled + become: true + ansible.builtin.systemd: + name: unbound.service + state: started + enabled: true - - name: ensure unbound is running and enabled - become: true - ansible.builtin.systemd: - name: unbound.service - state: started - enabled: true - - - name: install and configure prometheus-exporter for unbound - ansible.builtin.import_tasks: prometheus-exporter.yml - when: unbound_install_prometheus_exporter +- name: install and configure prometheus-exporter for unbound + ansible.builtin.import_tasks: prometheus-exporter.yml + when: unbound_install_prometheus_exporter