CCCHH/ansible-infra
CCCHH/ansible-infra
2
2
Fork 1
Code Issues 10 Pull requests 9 Wiki Activity Actions

WIP: new z9 ccchh router #98

Draft
bitwhisker wants to merge 23 commits from new_ccchh_router into main
pull from: new_ccchh_router
merge into: CCCHH:main
Conversation 2 Commits 23 Files changed 52 +18 -12
2 changed files with 18 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit aec4ea4090 - Show all commits

unbound(role): fix unbound config template

Prev Next 
- fix some indentation problems
- fix access control
- fix remote control unix socket and thrust anchor file (because debain
appamour ist annoying)
  - add unbound-anchor package
bitwhisker 2026-06-21 20:06:32 +02:00
commit aec4ea4090
Signed by: bitwhisker
SSH key fingerprint: SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE

5
roles/unbound/tasks/main.yml
View file

@ -6,6 +6,11 @@
ansible.builtin.package: ansible.builtin.package:
name: unbound name: unbound
- name: install unbound-anchor
become: true
ansible.builtin.package:
name: unbound-anchor
bitwhisker marked this conversation as resolved Outdated
june commented 2026-05-24 18:41:04 +02:00
Outdated
Copy link

There is no bind package on Debian and we already install dig in the base_config role:

Line 30 in 7832978
- dnsutils

There is no `bind` package on Debian and we already install `dig` in the `base_config` role: https://git.hamburg.ccc.de/CCCHH/ansible-infra/src/commit/7832978ff732208f2f29f04ef446c7c51076c6d1/roles/base_config/tasks/main.yaml#L30
- name: ensure correct directory permissions - name: ensure correct directory permissions
become: true become: true
ansible.builtin.file: ansible.builtin.file:

7
roles/unbound/templates/unbound.conf.j2
View file

@ -4,7 +4,7 @@ server:
{% if unbound_enable_dnssec -%} {% if unbound_enable_dnssec -%}
# location of the trust anchor file that enables DNSSEC # location of the trust anchor file that enables DNSSEC
# this file is generated by the `unbound-anchor` command # this file is generated by the `unbound-anchor` command
bitwhisker marked this conversation as resolved Outdated
june commented 2026-05-24 18:44:00 +02:00
Outdated
Copy link

Is this still relevant on Debian? Again, we don't use Arch Linux in our infra.

Is this still relevant on Debian? Again, we don't use Arch Linux in our infra.
auto-trust-anchor-file: "/etc/unbound/trusted-key.key" trust-anchor-file: "/usr/share/dns/root.key"
{% endif -%} {% endif -%}
# num of threads # num of threads
@ -36,7 +36,7 @@ server:
# addresses from the IP range that are allowed to connect to the resolver # addresses from the IP range that are allowed to connect to the resolver
{% for i in unbound_access_control -%} {% for i in unbound_access_control -%}
access-control: {{ i }} access-control: {{ i }} allow
{% endfor -%} {% endfor -%}
{% for i in unbound_private_domain -%} {% for i in unbound_private_domain -%}
@ -51,7 +51,8 @@ server:
remote-control: remote-control:
control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }}
control-interface: /run/unbound-control.sock control-interface: "/run/unbound.ctl" # debian appamour does not allow any other path!!!
control-use-cert: no
# configure some zones for which this resolver will act authoritatively # configure some zones for which this resolver will act authoritatively