Vendor Galaxy Roles and Collections

ansible_collections/debops/debops/roles/resolved/COPYRIGHT

@@ -0,0 +1,19 @@
+debops.resolved - Manage Network Name Resolver using Ansible
+
+Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+Copyright (C) 2023 DebOps <http://debops.org/>
+SPDX-License-Identifier: GPL-3.0-only
+
+This Ansible role is part of DebOps.
+
+DebOps is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License version 3, as
+published by the Free Software Foundation.
+
+DebOps is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with DebOps. If not, see https://www.gnu.org/licenses/.

ansible_collections/debops/debops/roles/resolved/defaults/main.yml

@@ -0,0 +1,338 @@
+---
+# .. vim: foldmarker=[[[,]]]:foldmethod=marker
+
+# .. Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+# .. Copyright (C) 2023 DebOps <https://debops.org/>
+# .. SPDX-License-Identifier: GPL-3.0-only
+
+# .. _resolved__ref_defaults:
+
+# debops.resolved default variables
+# =================================
+
+# .. contents:: Sections
+#    :local:
+#
+# .. include:: ../../../../includes/global.rst
+
+
+# General options [[[
+# -------------------
+
+# .. envvar:: resolved__enabled [[[
+#
+# Enable or disable management of the :command:`systemd-resolved` service using
+# DebOps. If the parameter is set to ``False``, the role will not touch service
+# configuration.
+resolved__enabled: '{{ True
+                       if (ansible_service_mgr == "systemd" and
+                           resolved__fact_service_state == "present")
+                       else False }}'
+
+                                                                   # ]]]
+# .. envvar:: resolved__deploy_state [[[
+#
+# This variable controls if the :command:`systemd-resolved` main configuration
+# file is managed on the host (``present``) or not (``absent``, default). If
+# deployment state is disabled, :command:`systemd-resolved` will use the
+# configuration provided with the OS package.
+resolved__deploy_state: 'absent'
+
+                                                                   # ]]]
+# .. envvar:: resolved__resolv_conf [[[
+#
+# Specify the file which will be symlinked as the system-wide resolver
+# configuration file (see :man:`resolv.conf(5)` for details). The role will
+# symlink the specified file as :file:`/etc/resolv.conf` when both
+# :command:`systemd-networkd` and :command:`systemd-resolved` services are
+# enabled on a host.
+#
+# To not make any changes, set this variable to ``/etc/resolv.conf``.
+resolved__resolv_conf: '/run/systemd/resolve/stub-resolv.conf'
+
+                                                                   # ]]]
+# .. envvar:: resolved__fallback_conf [[[
+#
+# Name of the :command:`systemd-resolved` configuration file stored in the
+# :file:`/etc/systemd/resolved.conf.d/` directory which will contain nameserver
+# and search domain configuration saved from Ansible facts before the service
+# is installed. If the name is empty, the file will not be created by the role.
+resolved__fallback_conf: '00fallback-dns.conf'
+
+                                                                   # ]]]
+# .. envvar:: resolved__dnssd_enabled [[[
+#
+# Enable or disable support for publishing and resolving DNS-SD resource
+# records using the Multicast DNS protocol. See :man:`systemd.dnssd(5)` for
+# more details about the service configuration itself and
+# :ref:`resolved__ref_dnssd` documentation section about support of this
+# functionality in the Ansible role. For this variable to work, the
+# :envvar:`resolved__deploy_state` variable needs to be set to ``present``.
+resolved__dnssd_enabled: True
+                                                                   # ]]]
+                                                                   # ]]]
+# APT packages and installation [[[
+# ---------------------------------
+
+# .. envvar:: resolved__base_packages [[[
+#
+# List of base APT packages for :command:`systemd-resolved` support. The APT
+# package is separate from ``systemd`` APT package since Debian Bookworm to
+# allow for conflict resolution with other APT packages that provide the
+# ``resolvconf`` service.
+resolved__base_packages: '{{ ["libnss-resolve"]
+                              if (ansible_distribution_release in
+                                  (["stretch", "buster", "bullseye",
+                                    "bionic", "focal", "jammy"]))
+                              else ["systemd-resolved", "libnss-resolve"] }}'
+
+                                                                   # ]]]
+# .. envvar:: resolved__packages [[[
+#
+# List of additional APT packages to install for :command:`systemd-resolved`
+# support.
+resolved__packages: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__skip_packages [[[
+#
+# List of APT packages which provide the ``resolvconf`` service. When the role
+# detects that they are installed on the host, it will turn itself off to avoid
+# conflicts.
+resolved__skip_packages: [ 'resolvconf', 'openresolv' ]
+
+                                                                   # ]]]
+# .. envvar:: resolved__version [[[
+#
+# Specify the version of the :command:`systemd-resolved` daemon installed on
+# the host. By default this variable is defined using Ansible local facts and
+# can be used to alter configuration depending on the version of the service.
+resolved__version: '{{ ansible_local.resolved.version | d("0") }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# The :command:`systemd-resolved` service configuration [[[
+# ---------------------------------------------------------
+
+# These variables affect the behaviour of the
+# :command:`systemd-resolved.service` unit that can't be configured at the
+# daemon configuration level.
+
+# .. envvar:: resolved__synthesize_hostname [[[
+#
+# If enabled, the :command:`systemd-resolved` daemon will generate responses
+# for queries about local hostname without sending them to the upstream DNS
+# servers. This might result in undesired behaviour, for example not resolving
+# a host's FQDN by its hostname. If disabled, queries for local hostname are
+# sent to upstream DNS servers. Ref: https://github.com/systemd/systemd/issues/34897
+#
+# This option is enabled by default in systemd v256, but is disabled in DebOps
+# to preserve previous functionality.
+resolved__synthesize_hostname: False
+                                                                   # ]]]
+                                                                   # ]]]
+# The :command:`systemd-resolved` daemon configuration [[[
+# --------------------------------------------------------
+
+# These variables define the contents of the
+# :file:`/etc/systemd/resolved.conf` configuration file. Check the
+# :man:`resolved.conf(5)` manual page for more information about the
+# configuration options, and :ref:`resolved__ref_configuration` for details
+# about the configuration of the role itself.
+#
+# By default the configuration is not applied on the hosts, you need to set
+# :envvar:`resolved__deploy_state` variable to ``present`` to deploy the
+# configuration.
+
+# .. envvar:: resolved__default_configuration [[[
+#
+# List of the default configuration options defined by the role.
+resolved__default_configuration:
+
+  - name: 'DNS'
+    value: []
+    state: 'init'
+
+  - name: 'FallbackDNS'
+    value: []
+    state: 'init'
+
+  - name: 'Domains'
+    value: []
+    state: 'init'
+
+  - name: 'DNSSEC'
+    value: False
+    state: 'init'
+
+  - name: 'DNSOverTLS'
+    value: False
+    state: 'init'
+
+  - name: 'MulticastDNS'
+    value: '{{ resolved__dnssd_enabled | bool }}'
+    state: '{{ "init" if (resolved__dnssd_enabled | bool) else "present" }}'
+
+  - name: 'LLMNR'
+    value: True
+    state: 'init'
+
+  - name: 'Cache'
+    value: True
+    state: 'init'
+
+  - name: 'DNSStubListener'
+    value: True
+    state: 'init'
+
+  - name: 'DNSStubListenerExtra'
+    value: ''
+    state: 'init'
+
+  - name: 'ReadEtcHosts'
+    value: True
+    state: 'init'
+
+  - name: 'ResolveUnicastSingleLabel'
+    value: False
+    state: 'init'
+
+                                                                   # ]]]
+# .. envvar:: resolved__configuration [[[
+#
+# List of the configuration options which should be present on all hosts in the
+# Ansible inventory.
+resolved__configuration: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__group_configuration [[[
+#
+# List of the configuration options which should be present on hosts in
+# a specific Ansible inventory group.
+resolved__group_configuration: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__host_configuration [[[
+#
+# List of the configuration options which should be present on specific hosts
+# in the Ansible inventory.
+resolved__host_configuration: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__combined_configuration [[[
+#
+# Variable which combines all configuration lists and is used in the role tasks
+# and templates.
+resolved__combined_configuration: '{{ resolved__default_configuration
+                                      + resolved__configuration
+                                      + resolved__group_configuration
+                                      + resolved__host_configuration }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# The DNS-SD configuration units [[[
+# ----------------------------------
+
+# These variables can be used to manage :command:`systemd-resolved`
+# :file:`*.dnssd` files located in the :file:`/etc/systemd/dnssd/` directory.
+# Check the :man:`systemd.dnssd(5)` manual page for more information about
+# files themselves, and :ref:`resolved__ref_units` for details about
+# configuring units using this role.
+
+# .. envvar:: resolved__default_units [[[
+#
+# List of the default :command:`systemd-resolved` units defined by the role.
+resolved__default_units:
+
+  - name: 'workstation.dnssd'
+    comment: 'Publish information about the host in mDNS'
+    raw: |
+      [Service]
+      Name=%H
+      Type=_workstation._tcp
+      Port=9
+    state: 'present'
+
+  - name: 'ssh.dnssd'
+    comment: 'Publish information about the SSH service'
+    raw: |
+      [Service]
+      Name=%H
+      Type=_ssh._tcp
+      Port=22
+    state: 'present'
+
+  - name: 'sftp-ssh.dnssd'
+    comment: 'Publish information about the SFTP service'
+    raw: |
+      [Service]
+      Name=%H
+      Type=_sftp-ssh._tcp
+      Port=22
+    state: 'present'
+
+                                                                   # ]]]
+# .. envvar:: resolved__units [[[
+#
+# List of :command:`systemd-resolved` units which should be present on all
+# hosts in the Ansible inventory.
+resolved__units: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__group_units [[[
+#
+# List of :command:`systemd-resolved` units which should be present on hosts in
+# a specific Ansible inventory group.
+resolved__group_units: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__host_units [[[
+#
+# List of :command:`systemd-resolved` units which should be present on specific
+# hosts in the Ansible inventory.
+resolved__host_units: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__dependent_units [[[
+#
+# List of :command:`systemd-resolved` units which are defined by other Ansible
+# roles using dependent role variables.
+resolved__dependent_units: []
+
+                                                                   # ]]]
+# .. envvar:: resolved__combined_units [[[
+#
+# Variable which combines all of the :command:`systemd-resolved` unit lists and
+# is used in role tasks and templates.
+resolved__combined_units: '{{ resolved__default_units
+                              + resolved__dependent_units
+                              + resolved__units
+                              + resolved__group_units
+                              + resolved__host_units }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# Configuration for other Ansible roles [[[
+# -----------------------------------------
+
+# .. envvar:: resolved__etc_services__dependent_list [[[
+#
+# Configuration for the :ref:`debops.etc_services` Ansible role.
+resolved__etc_services__dependent_list:
+
+  - name: 'llmnr'
+    port: '5355'
+    protocols: [ 'tcp', 'udp' ]
+
+                                                                   # ]]]
+# .. envvar:: resolved__dpkg_cleanup__dependent_packages [[[
+#
+# Configuration for the :ref:`debops.dpkg_cleanup` Ansible role.
+resolved__dpkg_cleanup__dependent_packages:
+
+  - name: 'systemd-resolved'
+    ansible_fact: 'resolved'
+    state: '{{ "absent"
+               if (ansible_distribution_release in
+                   (["stretch", "buster", "bullseye",
+                     "bionic", "focal", "jammy"]))
+               else "present" }}'
+                                                                   # ]]]
+                                                                   # ]]]

ansible_collections/debops/debops/roles/resolved/meta/main.yml

@@ -0,0 +1,33 @@
+---
+# Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2023 DebOps <http://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Ensure that custom Ansible plugins and modules included in the main DebOps
+# collection are available to roles in other collections.
+collections: [ 'debops.debops' ]
+
+dependencies: []
+
+galaxy_info:
+
+  author: 'Maciej Delmanowski'
+  description: 'Manage Network Name Resolver systemd-resolved'
+  company: 'DebOps'
+  license: 'GPL-3.0-only'
+  min_ansible_version: '2.9.0'
+
+  platforms:
+
+    - name: 'Ubuntu'
+      versions: [ 'all' ]
+
+    - name: 'Debian'
+      versions: [ 'all' ]
+
+  galaxy_tags:
+    - system
+    - systemd
+    - dns
+    - nss
+    - resolved

ansible_collections/debops/debops/roles/resolved/tasks/main.yml

@@ -0,0 +1,201 @@
+---
+# Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2023 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+- name: Import DebOps global handlers
+  ansible.builtin.import_role:
+    name: 'global_handlers'
+
+- name: Check if other resolvers are installed
+  environment:
+    LC_MESSAGES: 'C'
+  ansible.builtin.shell: |
+    set -o nounset -o pipefail -o errexit &&
+    dpkg --get-selections | grep -w -E '({{ resolved__skip_packages | join("|") }})'
+                          | awk '{print $1}' || true
+  args:
+    executable: '/bin/bash'
+  register: resolved__register_resolvers
+  changed_when: False
+  failed_when: False
+  check_mode: False
+
+- name: Set resolved deployment state
+  ansible.builtin.set_fact:
+    resolved__fact_service_state: '{{ "present"
+                                       if (not resolved__register_resolvers.stdout | d())
+                                       else "absent" }}'
+
+- name: Create systemd-resolved configuration directory for fallback
+  ansible.builtin.file:
+    path: '/etc/systemd/resolved.conf.d'
+    state: 'directory'
+    mode: '0755'
+  when:
+    - resolved__enabled | bool
+    - resolved__fallback_conf != ''
+    - resolved__resolv_conf != '/etc/resolv.conf'
+    - not (ansible_local.resolved.installed | d()) | bool
+
+- name: Save existing nameservers as fallback to ensure connectivity
+  ansible.builtin.template:
+    src: 'etc/systemd/resolved.conf.d/fallback-dns.conf.j2'
+    dest: '{{ "/etc/systemd/resolved.conf.d/" + resolved__fallback_conf }}'
+    mode: '0644'
+  when:
+    - resolved__enabled | bool
+    - resolved__fallback_conf != ''
+    - resolved__resolv_conf != '/etc/resolv.conf'
+    - not (ansible_local.resolved.installed | d()) | bool
+
+- name: Create systemd-resolved.service configuration directory
+  ansible.builtin.file:
+    path: '/etc/systemd/system/systemd-resolved.service.d'
+    state: 'directory'
+    mode: '0755'
+  when:
+    - resolved__enabled | bool
+
+- name: Configure synthesis of local hostname by systemd-resolved
+  ansible.builtin.template:
+    src: 'etc/systemd/system/systemd-resolved.service.d/synthesize-hostname.conf.j2'
+    dest: '/etc/systemd/system/systemd-resolved.service.d/synthesize-hostname.conf'
+    mode: '0644'
+  when:
+    - resolved__enabled | bool
+  notify: [ 'Reload systemd daemon', 'Restart systemd-resolved service' ]
+
+- name: Install required resolved packages
+  ansible.builtin.package:
+    name: '{{ resolved__base_packages + resolved__packages }}'
+    state: 'present'
+  register: resolved__register_packages
+  until: resolved__register_packages is succeeded
+  when: resolved__enabled | bool
+
+- name: Enable and start systemd-resolved service
+  ansible.builtin.systemd:
+    name: 'systemd-resolved.service'
+    state: 'started'
+    enabled: True
+  when: resolved__enabled | bool
+
+- name: Make sure that Ansible local facts directory exists
+  ansible.builtin.file:
+    path: '/etc/ansible/facts.d'
+    state: 'directory'
+    mode: '0755'
+  when: resolved__enabled | bool
+
+- name: Save resolved local facts
+  ansible.builtin.template:
+    src: 'etc/ansible/facts.d/resolved.fact.j2'
+    dest: '/etc/ansible/facts.d/resolved.fact'
+    mode: '0755'
+  notify: [ 'Refresh host facts' ]
+  when: resolved__enabled | bool
+  tags: [ 'meta::facts' ]
+
+- name: Update Ansible facts if they were modified
+  ansible.builtin.meta: 'flush_handlers'
+
+- name: Remove systemd-resolved configuuration if requested
+  ansible.builtin.file:
+    path: '/etc/systemd/resolved.conf.d/ansible.conf'
+    state: 'absent'
+  notify: [ 'Restart systemd-resolved service' ]
+  when: resolved__enabled | bool and resolved__deploy_state == 'absent'
+
+- name: Create systemd-resolved configuration directory
+  ansible.builtin.file:
+    path: '/etc/systemd/resolved.conf.d'
+    state: 'directory'
+    mode: '0755'
+  when: resolved__enabled | bool and resolved__deploy_state != 'absent'
+
+- name: Generate systemd-resolved configuration
+  ansible.builtin.template:
+    src: 'etc/systemd/resolved.conf.d/ansible.conf.j2'
+    dest: '/etc/systemd/resolved.conf.d/ansible.conf'
+    mode: '0644'
+  notify: [ 'Restart systemd-resolved service' ]
+  when: resolved__enabled | bool and resolved__deploy_state != 'absent'
+
+- name: Ensure that /etc/systemd/dnssd/ directory exists
+  ansible.builtin.file:
+    path: '/etc/systemd/dnssd'
+    state: 'directory'
+    mode: '0755'
+  when: resolved__enabled | bool and resolved__dnssd_enabled | bool
+
+- name: Remove dnssd units if requested
+  ansible.builtin.file:
+    path: '{{ "/etc/systemd/dnssd/" + item.name }}'
+    state: 'absent'
+  loop: '{{ resolved__combined_units | flatten | debops.debops.parse_kv_items }}'
+  loop_control:
+    label: '{{ {"name": item.name, "state": item.state | d("present")} }}'
+  notify: [ 'Restart systemd-resolved service' ]
+  when: resolved__enabled | bool and resolved__dnssd_enabled | bool and
+        item.state | d("present") == 'absent'
+
+- name: Remove dnssd unit overrides if requested
+  ansible.builtin.file:
+    path: '{{ "/etc/systemd/dnssd/" + item.name + ".d" }}'
+    state: 'absent'
+  loop: '{{ resolved__combined_units | flatten | debops.debops.parse_kv_items }}'
+  loop_control:
+    label: '{{ {"name": item.name, "state": item.state | d("present")} }}'
+  notify: [ 'Restart systemd-resolved service' ]
+  when: resolved__enabled | bool and resolved__dnssd_enabled | bool and
+        item.state | d("present") == 'absent'
+
+- name: Create directories for dnssd units
+  ansible.builtin.file:
+    path: '{{ "/etc/systemd/dnssd/" + (item.name | dirname) }}'
+    state: 'directory'
+    mode: '0755'
+  loop: '{{ resolved__combined_units | flatten | debops.debops.parse_kv_items }}'
+  loop_control:
+    label: '{{ {"name": item.name, "state": item.state | d("present")} }}'
+  when: resolved__enabled | bool and resolved__dnssd_enabled | bool and
+        item.raw | d() and item.state | d("present") not in ['absent', 'ignore', 'init'] and
+        (item.name | dirname).endswith('.d')
+
+- name: Generate dnssd units
+  ansible.builtin.template:
+    src: 'etc/systemd/dnssd/template.j2'
+    dest: '{{ "/etc/systemd/dnssd/" + item.name }}'
+    mode: '0644'
+  loop: '{{ resolved__combined_units | flatten | debops.debops.parse_kv_items }}'
+  loop_control:
+    label: '{{ {"name": item.name, "state": item.state | d("present")} }}'
+  notify: [ 'Restart systemd-resolved service' ]
+  when: resolved__enabled | bool and resolved__dnssd_enabled | bool and
+        item.raw | d() and item.state | d("present") not in ['absent', 'ignore', 'init']
+
+- name: Flush handlers when needed
+  ansible.builtin.meta: 'flush_handlers'
+
+- name: Manage /etc/resolv.conf configuration file
+  ansible.builtin.file:
+    path: '/etc/resolv.conf'
+    src: '{{ resolved__resolv_conf }}'
+    state: 'link'
+    force: True
+  when:
+    - resolved__enabled | bool
+    - resolved__resolv_conf != '/etc/resolv.conf'
+    - (ansible_local.networkd.state | d('disabled')) == 'enabled'
+    - (ansible_local.resolved.state | d('disabled')) == 'enabled'
+
+- name: Prepare cleanup during package removal
+  ansible.builtin.import_role:
+    name: 'dpkg_cleanup'
+  vars:
+    dpkg_cleanup__dependent_packages:
+      - '{{ resolved__dpkg_cleanup__dependent_packages }}'
+  when: resolved__enabled | bool
+  tags: [ 'role::dpkg_cleanup', 'skip::dpkg_cleanup',
+          'role::resolved:dpkg_cleanup' ]

ansible_collections/debops/debops/roles/resolved/templates/etc/ansible/facts.d/resolved.fact.j2

@@ -0,0 +1,45 @@
+#!{{ ansible_python['executable'] }}
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2023 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# {{ ansible_managed }}
+
+from __future__ import print_function
+from json import loads, dumps
+import subprocess
+import os
+
+
+def binary_exists(binary):
+    if os.path.exists(binary) and os.path.isfile(binary):
+        return True
+    else:
+        return False
+
+
+output = {'installed': binary_exists('/lib/systemd/systemd-resolved')}
+
+try:
+    is_enabled = subprocess.check_output(
+            ["systemctl", "is-enabled",
+                "systemd-resolved.service"]).decode('utf-8')
+    output['state'] = is_enabled.strip()
+except subprocess.CalledProcessError:
+    output['state'] = 'disabled'
+
+try:
+    resolved_version_stdout = subprocess.check_output(
+            ["resolvectl", "--version"]
+            ).decode('utf-8').strip()
+
+    for line in resolved_version_stdout.split('\n'):
+        if line.lower().startswith('systemd '):
+            output['version'] = line.split()[1]
+
+except Exception:
+    pass
+
+print(dumps(output, sort_keys=True, indent=4))

ansible_collections/debops/debops/roles/resolved/templates/etc/systemd/dnssd/template.j2

@@ -0,0 +1,10 @@
+{# Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+ # Copyright (C) 2023 DebOps <https://debops.org/>
+ # SPDX-License-Identifier: GPL-3.0-only
+ #}
+# {{ ansible_managed }}
+
+{% if item.comment | d() %}
+{{   item.comment | regex_replace('\n$', '') | comment(prefix='', postfix='') -}}
+{% endif %}
+{{ item.raw | regex_replace('\n$', '') }}

ansible_collections/debops/debops/roles/resolved/templates/etc/systemd/resolved.conf.d/ansible.conf.j2

@@ -0,0 +1,52 @@
+{# Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+ # Copyright (C) 2023 DebOps <https://debops.org/>
+ # SPDX-License-Identifier: GPL-3.0-only
+ #}
+# {{ ansible_managed }}
+
+# See resolved.conf(5) for details.
+
+[Resolve]
+# Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
+# Cloudflare: 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
+# Google:     8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
+# Quad9:      9.9.9.9 2620:fe::fe
+{% for element in resolved__combined_configuration | debops.debops.parse_kv_config %}
+{%   if element.name | d() and element.state | d('present') not in [ 'absent', 'ignore' ] %}
+{%     set element_comment = ('#' if (element.state | d('present') in [ 'init', 'comment' ]) else '') %}
+{%     if element.value is undefined %}
+{%       set element_value = '' %}
+{%     elif element.value is string and not element.value | bool %}
+{%       set element_value = element.value %}
+{%     elif element.value | bool and element.value is not iterable %}
+{%       if element.value | string == '1' %}
+{%         set element_value = element.value %}
+{%       else %}
+{%         set element_value = 'yes' %}
+{%       endif %}
+{%     elif not element.value | bool and element.value is not iterable %}
+{%       if element.value is not none %}
+{%         if element.value | int %}
+{%           set element_value = element.value %}
+{%         else %}
+{%           if element.value | string == '0' %}
+{%             set element_value = element.value %}
+{%           else %}
+{%             set element_value = 'no' %}
+{%           endif %}
+{%         endif %}
+{%       endif %}
+{%     else %}
+{%       set element_value = element.value | selectattr('state', 'equalto', 'present') | map(attribute='name') | list | join(' ') %}
+{%     endif %}
+{%     if element.raw | d() %}
+{%       if element.state | d('present') in [ 'init', 'comment' ] %}
+{{         '{}'.format(element.raw | regex_replace('\n$', '') | comment(decoration='#', prefix='', postfix='')) -}}
+{%       else %}
+{{         '{}'.format(element.raw | regex_replace('\n$', '')) }}
+{%       endif %}
+{%     else %}
+{{       '{}{}={}'.format(element_comment, element.name, element_value) }}
+{%     endif %}
+{%   endif %}
+{% endfor %}

ansible_collections/debops/debops/roles/resolved/templates/etc/systemd/resolved.conf.d/fallback-dns.conf.j2

@@ -0,0 +1,27 @@
+{# Copyright (C) 2023 Maciej Delmanowski <drybjed@gmail.com>
+ # Copyright (C) 2023 DebOps <https://debops.org/>
+ # SPDX-License-Identifier: GPL-3.0-only
+ #}
+# {{ ansible_managed }}
+
+# See resolved.conf(5) for details.
+
+# This file can be safely removed once nameserver configuration is defined in
+# systemd-resolved options.
+
+{% set fallback_dns = [] %}
+{% for element in ansible_facts['dns']['nameservers'] | d([]) %}
+{%   if element != '127.0.0.53' %}
+{%     set _ = fallback_dns.append(element) %}
+{%   endif %}
+{% endfor %}
+{% set domains = [] %}
+{% if ansible_facts['dns']['domain'] | d([]) %}
+{%   set _ = domains.append(ansible_facts['dns']['domain']) %}
+{% endif %}
+{% for element in ansible_facts['dns']['search'] | d([]) %}
+{%   set _ = domains.append(element) %}
+{% endfor %}
+[Resolve]
+{{ 'FallbackDNS={}'.format(fallback_dns | join(' ')) }}
+{{ 'Domains={}'.format(domains | join(' ')) }}

ansible_collections/debops/debops/roles/resolved/templates/etc/systemd/system/systemd-resolved.service.d/synthesize-hostname.conf.j2

@@ -0,0 +1,16 @@
+{# Copyright (C) 2025 Maciej Delmanowski <drybjed@gmail.com>
+ # Copyright (C) 2025 DebOps <https://debops.org/>
+ # SPDX-License-Identifier: GPL-3.0-only
+ #}
+# {{ ansible_managed }}
+
+[Service]
+
+# Enable or disable synthesis of local hostname by systemd-resolved service.
+# If enabled, local hostname queries won't be sent to upstream DNS servers.
+# Ref: https://github.com/systemd/systemd/issues/34897
+{% if resolved__synthesize_hostname | bool %}
+Environment=SYSTEMD_RESOLVED_SYNTHESIZE_HOSTNAME=1
+{% else %}
+Environment=SYSTEMD_RESOLVED_SYNTHESIZE_HOSTNAME=0
+{% endif %}