sophia/ansible-infra
0
0
Fork 0
forked from CCCHH/ansible-infra
Code Pull requests Activity

unbound(role): update readme and move task block to top level and remove unused

Browse source
This commit is contained in:
bitwhisker 2026-08-07 22:27:48 +02:00
commit 7eabd88e2c
Signed by: bitwhisker
SSH key fingerprint: SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE
4 changed files with 68 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

26
roles/unbound/README.md
View file

@ -1,6 +1,6 @@
# Unbound DNS resolver
Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/).
Role for a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/).
It is designed to be fast and lean and incorporates modern features based on open standards.
- [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/)
@ -9,12 +9,18 @@ It is designed to be fast and lean and incorporates modern features based on ope
The following variables can be used to customize this role:
| Variable | Type | Default | Description |
|------------------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| unbound_install_prometheus_exporter | Boolean | `true` | Whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. |
| unbound_bind_interfaces | List of Strings | `[0.0.0.0, ::]` | List of interface names or IP addresses on which unbound will listen for dns queries |
| unbound_enable_unbound_control | Boolean | `true` | Whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. |
| unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled |
| unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) |
| unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. |
| unbound_thread_count | Integer | Max vCPU Count | The number of threads unbound uses |
- `unbound_install_prometheus_exporter`: Boolean of whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format.
Defaults to `true`.
- `unbound_bind_interfaces`: List of interface names or IP addresseson which unbound will listen for dns queries.
Defaults to `[0.0.0.0, ::]`.
- `unbound_enable_unbound_control`: Boolean of whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured.
Defaults to `true`.
- `unbound_enable_dnssec`: Boolean of whether dnssec validation should be enabled.
Defaults to `true`.
- `unbound_access_control`: **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E).
Defaults to `[]`.
- `unbound_disable_systemd_networkd`: Boolean if true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver.
Defaults to `true`.
- `unbound_thread_count`: The number of threads unbound uses.
Defaults to max vCPU Count.

1
roles/unbound/files/no-resolved.resolv.conf
View file

@ -1 +0,0 @@
nameserver 127.0.0.1

6
roles/unbound/handlers/main.yml
View file

@ -4,12 +4,6 @@
name: unbound.service
state: restarted
- name: unbound.reloaded
become: true
ansible.builtin.systemd:
name: unbound.service
state: reloaded
- name: prometheus-unbound-exporter.restarted
become: true
ansible.builtin.systemd:

93
roles/unbound/tasks/main.yml
View file

@ -1,55 +1,52 @@
- name: unbound role main
block:
- name: install unbound dns resolver
become: true
ansible.builtin.package:
name: unbound
- name: install unbound dns resolver
become: true
ansible.builtin.package:
name: unbound
- name: install unbound-anchor
become: true
ansible.builtin.package:
name: unbound-anchor
- name: install unbound-anchor
become: true
ansible.builtin.package:
name: unbound-anchor
- name: ensure correct directory permissions
become: true
ansible.builtin.file:
path: /etc/unbound
state: directory
mode: u=rwX,g=rX,o=rX
recurse: true
owner: unbound
group: unbound
- name: ensure correct directory permissions
become: true
ansible.builtin.file:
path: /etc/unbound
state: directory
mode: u=rwX,g=rX,o=rX
recurse: true
owner: unbound
group: unbound
- name: configure unbound dns resolver
become: true
notify: unbound.restarted
ansible.builtin.template:
src: unbound.conf.j2
dest: /etc/unbound/unbound.conf
owner: unbound
group: unbound
mode: u=rw,g=r,o=r
- name: configure unbound dns resolver
become: true
notify: unbound.restarted
ansible.builtin.template:
src: unbound.conf.j2
dest: /etc/unbound/unbound.conf
owner: unbound
group: unbound
mode: u=rw,g=r,o=r
- name: disable systemd-resolved
when: unbound_disable_systemd_networkd
ansible.builtin.include_role:
name: deploy_systemd_resolved_config
vars:
deploy_systemd_resolved_config__enable: false
deploy_systemd_resolved_config__dns:
- 127.0.0.1
- name: disable systemd-resolved
when: unbound_disable_systemd_networkd
ansible.builtin.include_role:
name: deploy_systemd_resolved_config
vars:
deploy_systemd_resolved_config__enable: false
deploy_systemd_resolved_config__dns:
- 127.0.0.1
- name: flush handlers
ansible.builtin.meta: flush_handlers
- name: flush handlers
ansible.builtin.meta: flush_handlers
- name: ensure unbound is running and enabled
become: true
ansible.builtin.systemd:
name: unbound.service
state: started
enabled: true
- name: ensure unbound is running and enabled
become: true
ansible.builtin.systemd:
name: unbound.service
state: started
enabled: true
- name: install and configure prometheus-exporter for unbound
ansible.builtin.import_tasks: prometheus-exporter.yml
when: unbound_install_prometheus_exporter
- name: install and configure prometheus-exporter for unbound
ansible.builtin.import_tasks: prometheus-exporter.yml
when: unbound_install_prometheus_exporter