This seems to be using tabs for some reason, probably best to replace with spaces.
There is no bind package on Debian and we already install dig in the base_config role: 7832978ff7/roles…
Again, same comment as in the kea role, I don't think it makes sense to have granular tags in the role itself.
Just a nit-pick, but having the indentation be consistent across the dhcp4 and dhcp6 config would be nice.
Core configuration looks good, tho I left some comments. Left some more comments on the roles as well.
We have a nice role for managing systemd-resolved already, so no need to duplicate functionality here.
Same comment as below: We already have a role for managing the resolv.conf, so rather include that.
The search domain would be z9.ccchh.net. Unless it got decided to drop that now.
I would rather just stick to only having tags at the playbook level. I don't think this kind granular control for the role is really needed as it the config files also shouldn't trigger a reload,…
If we configure ansible-pull variables above, the host should also be added to the relevant host group. (However an ansible-pull age private key is still missing.)
I would rather move the enable and start logic into the file itself, since that's not really the job of a handler. See the main unbound setup tasks for reference.
Most of the variables here are commented out, so we can just massively simplify this file.
It's fine, just feel like rt1 is one of those obscure names again, which gives more trouble than benefit.
Do we have a requirement for the more up-to-date version present in the upstream repository or is the one in the Debian repos sufficient?