update knot role to support more operational variety

Now secondary zones, dynamic zones, interpeted catalog zones, etc.
are supported by our knot role

roles/knot/templates/knot.conf.j2

@@ -9,15 +9,17 @@ server:
 
 log:
   - target: syslog
-    any: info
+    any: {{ knot__log_level }}
 
 database:
     storage: "/var/lib/knot"
 
 key:
-  - id: {{ knot__dnssec_key_id }}
-    algorithm: hmac-sha512
-    secret: "{{ knot__dnssec_key_secret }}"
+  {% for i_key in knot__keys -%}
+  - id: "{{ i_key.id }}"
+    algorithm: "{{ i_key.algorithm | default("hmac-sha256") }}"
+    secret: "{{ i_key.secret }}"
+  {% endfor %}
 
 remote:
   # static, external and public remote used for DNSSEC KSK checking
@@ -28,6 +30,13 @@ remote:
   {% for i_remote in knot__remotes -%}
   - id: "{{ i_remote.id }}"
     address: [ {% for i_addr in i_remote.address %}"{{ i_addr}}"{% if not loop.last %},{% endif %} {% endfor %} ]
+    {% if i_remote.via | default(None) -%}
+    via: [ {% for i_via in i_remote.via %}"{{ i_via }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% endif -%}
+    {% if i_remote.key | default(None) -%}
+    key: "{{ i_remote.key }}"
+    {% endif %}
+
   {% endfor %}
   {% endif %}
 
@@ -46,10 +55,33 @@ policy:
     nsec3: true
     nsec3-salt-length: 0
 
+# explicit acl configurations
+# we mostly rely on automatic ACLs but for some dynamic zones, explicit allow stanzas are required
+acl:
+  {% for i_acl in knot__acls -%}
+  - id: "{{ i_acl.id }}"
+    {% if i_acl.address | default(None) -%}
+    address: [ {% for i_addr in i_acl.address %}"{{ i_addr}}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% endif -%}
+    {% if i_acl.key | default(None) -%}
+    key: "{{ i_acl.key }}"
+    {% endif -%}
+    {% if i_acl.remote | default(None) -%}
+    remote: "{{ i_acl.remote }}"
+    {% endif -%}
+    {% if i_acl.action | default(None) -%}
+    action: "{{ i_acl.action }}"
+    {% endif -%}
+    {% if i_acl.update_type | default(None) -%}
+    update-type: [ {% for i_addr in i_acl.update_type %}"{{ i_addr}}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% endif %}
+
+  {% endfor %}
+
 # define default settings that apply to all zones
 template:
-  # template for general-purpose user zones
-  - id: default
+  # template for general-purpose primary zones
+  - id: primary
     storage: "/etc/knot/zones"
     file: "%s.zone"
     semantic-checks: on
@@ -57,17 +89,45 @@ template:
     zonefile-load: difference-no-serial
     serial-policy: dateserial
     journal-content: all
-    default-ttl: 7200
     dnssec-signing: on
     dnssec-policy: default
 
-    {# catalog-role: member #}
-    {# catalog-zone: hamburg.ccc.de.catalog. #}
+  # template for generic secondary zones
+  - id: secondary
+    storage: "/var/lib/knot/secondary_zones/"
+    dnssec-signing: off
+
+  # template for zones that support dynamic updates
+  - id: dynamic-primary
+    storage: "/var/lib/knot/dynamic_zones/"
+    zonefile-load: whole
+    journal-content: changes
+    dnssec-signing: on
+    dnssec-policy: default
 
   # template for automatically created special zones
   - id: catalog
     catalog-role: generate
     dnssec-signing: off
+    storage: "/var/lib/knot/catalog_zones/"
+
+  # template for secondary catalog zones (they are interpreted and generate secondary zones based on their content)
+  - id: catalog-secondary
+    catalog-role: interpret
+    dnssec-signing: off
+    storage: "/var/lib/knot/secondary_zones/"
+
+  # templates for secondary catalog member zones
+  # these templates are for zones which get spawned by catalog zones
+  # unfortunately we need one template per interpreted catalog zone because it must include all information required for that zone to work as secondary
+  # it reuses master and notify values from the catalog zones
+  {% for i_zone in knot__catalog_secondary_zones -%}
+  - id: catalog-secondary-member-{{ i_zone.domain }}
+    storage: "/var/lib/knot/secondary_zones/"
+    dnssec-signing: off
+    master: {{ i_zone.primary }}
+
+  {% endfor %}
 
 
 # define zones on this server
@@ -80,10 +140,10 @@ zone:
     notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
   {% endfor %}
 
-  # normal zones
-  {% for i_zone in knot__zones -%}
+  # primary zones
+  {% for i_zone in knot__primary_zones -%}
   - domain: "{{ i_zone.domain }}"
-    template: default
+    template: primary
     notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
     {% if i_zone.catalog_member | default(False) -%}
     catalog-role: member
@@ -92,3 +152,39 @@ zone:
 
   {% endfor %}
 
+  # dynamic primary zones
+  {% for i_zone in knot__dynamic_zones -%}
+  - domain: "{{ i_zone.domain }}"
+    template: "dynamic-primary"
+    notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    acl: [ {% for i_acl in i_zone.acl %}"{{ i_acl }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% if i_zone.catalog_member | default(False) -%}
+    catalog-role: member
+    catalog-zone: "{{ i_zone.catalog_member }}"
+    {% endif %}
+
+  {% endfor %}
+
+  # secondary zones
+  {% for i_zone in knot__secondary_zones -%}
+  - domain: "{{ i_zone.domain }}"
+    template: secondary
+    master: {{ i_zone.primary }}
+    notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% if i_zone.catalog_member | default(False) -%}
+    catalog-role: member
+    catalog-zone: "{{ i_zone.catalog_member }}"
+    {% endif %}
+
+  {% endfor %}
+
+  # secondary catalog zones
+  {% for i_zone in knot__catalog_secondary_zones -%}
+  - domain: "{{ i_zone.domain }}"
+    template: catalog-secondary
+    catalog-template: catalog-secondary-member-{{ i_zone.domain }}
+    master: {{ i_zone.primary }}
+    notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+
+  {% endfor %}
+

roles/knot/templates/netplan-disable-ra.yaml

@@ -1,13 +0,0 @@
-# {{ ansible_managed }}
-network:
-  ethernets:
-    {%- for i_iface_name in ansible_facts["interfaces"] -%}
-    {%- if i_iface_name != "lo" -%}
-    {%- set i_iface = ansible_facts[i_iface_name] %}
-
-    {{ i_iface_name }}:
-      match:
-        macaddress: "{{ i_iface.macaddress }}"
-      accept-ra: false
-    {% endif %}
-    {% endfor %}