ansible-role-unbound

Configures unbound.

Notes

The role does not cover all configuration options available in unbound.conf(5). The goal of the role is creating a role that reasonably works out-of-box with minimum efforts. If you need to configure every options supported in unbound.conf(5), This is not for you.

chroot support

When unbound_config_chroot is not empty, the role creates necessary files for unbound. Supported platform includes:

• OpenBSD
• FreeBSD

Requirements

None

Role Variables

Variable	Description	Default
unbound_user	user of unbound	{{ __unbound_user }}
unbound_group	group of unbound	{{ __unbound_group }}
unbound_service	service name	unbound
unbound_conf_dir	path to dir of config directory	{{ __unbound_conf_dir }}
unbound_conf_file	path to unbound.conf(5)	{{ __unbound_conf_dir }}/unbound.conf
unbound_flags	unused	""
unbound_script_dir	directory to install scripts in files	{{ __unbound_script_dir }}
unbound_directory	work directory	{{ __unbound_directory }}
unbound_config_chroot	path to chroot directory	""
unbound_freebsd_chroot_devfs_ruleset_number	devfs(8) rule set number. Change when unbound_config_chroot is not empty and you have other devfs(8) rule set with the same number.	100
unbound_script_dir	directory to keep support script. this must be included in PATH environment variable.	{{ __unbound_script_dir }}
unbound_config_interface	interface to listen on	[]
unbound_config_outgoing_interface	outgoing-interface	""
unbound_config_do_not_query_localhost	do-not-query-localhost	yes
unbound_config_do_ip4	do-ip4	yes
unbound_config_do_ip6	do-ip6	no
unbound_config_access_control	access-control	[]
unbound_config_hide_identity	hide-identity	yes
unbound_config_hide_version	hide-version	yes
unbound_config_use_syslog	use-syslog	yes
unbound_config_private_address	private-address	["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "192.254.0.0/16", "fd00::/8", "fe80::/10"]
unbound_config_private_domain	private-domain	[]
unbound_config_local_zone	local-zone	[]
unbound_config_remote_control_control_enable	control-enable	yes
unbound_config_remote_control_control_use_cert	control-use-cert	no
unbound_config_remote_control_control_interface	control-interface	""
unbound_config_server_key_file	server-key-file	{{ unbound_config_directory }}/unbound_server.key
unbound_config_server_cert_file	server-cert-file	{{ unbound_config_directory }}/unbound_server.pem
unbound_config_control_key_file	control-key-file	{{ unbound_config_directory }}/unbound_control.key
unbound_config_control_cert_file	control-cert-file	{{ unbound_config_directory }}/unbound_control.pem
unbound_forward_zone	forward-zone	[]

Debian

Variable	Default
__unbound_user	unbound
__unbound_group	unbound
__unbound_conf_dir	/etc/unbound
__unbound_script_dir	/usr/bin
__unbound_directory	/etc/unbound

FreeBSD

Variable	Default
__unbound_user	unbound
__unbound_group	unbound
__unbound_conf_dir	/usr/local/etc/unbound
__unbound_script_dir	/usr/local/bin
__unbound_directory	/usr/local/etc/unbound

OpenBSD

Variable	Default
__unbound_user	_unbound
__unbound_group	_unbound
__unbound_conf_dir	/var/unbound/etc
__unbound_script_dir	/usr/local/bin
__unbound_directory	/var/unbound

RedHat

Variable	Default
__unbound_user	unbound
__unbound_group	unbound
__unbound_conf_dir	/etc/unbound
__unbound_script_dir	/usr/bin
__unbound_directory	/etc/unbound

Created by yaml2readme.rb

Dependencies

None

Example Playbook

- hosts: localhost
  roles:
    - ansible-role-unbound
  vars:
    unbound_config_chroot: ""
    unbound_config_interface:
      - "{{ ansible_default_ipv4.address }}"
    unbound_config_outgoing_interface: "{{ ansible_default_ipv4.address }}"
    unbound_config_access_control:
      - 0.0.0.0/0 refuse
      - 127.0.0.0/8 allow
      - 10.100.1.0/24 allow
    unbound_config_private_domain:
      - example.com
    unbound_config_local_zone:
      - "10.in-addr.arpa nodefault"
      - "168.192.in-addr.arpa nodefault"
      - "17.172.in-addr.arpa nodefault"
      - "18.172.in-addr.arpa nodefault"
      - "19.172.in-addr.arpa nodefault"
      - "20.172.in-addr.arpa nodefault"
      - "21.172.in-addr.arpa nodefault"
      - "22.172.in-addr.arpa nodefault"
      - "23.172.in-addr.arpa nodefault"
      - "24.172.in-addr.arpa nodefault"
      - "25.172.in-addr.arpa nodefault"
      - "26.172.in-addr.arpa nodefault"
      - "27.172.in-addr.arpa nodefault"
      - "28.172.in-addr.arpa nodefault"
      - "29.172.in-addr.arpa nodefault"
      - "30.172.in-addr.arpa nodefault"
      - "31.172.in-addr.arpa nodefault"
      - "32.172.in-addr.arpa nodefault"
    # unbound in ubuntu 14.04 does not support unix socket
    unbound_config_remote_control_control_interface: "{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version | version_compare('14.04', '<=')) or (ansible_distribution == 'CentOS' and ansible_distribution_version | version_compare('7.3.1611', '<=')) %}127.0.0.1{% else %}/var/run/unbound.sock{% endif %}"
    unbound_forward_zone:
      -
        name: example.com
        forward_addr:
          - 8.8.8.8
      -
        name: example.org
        forward_addr:
          - 8.8.8.8
    unbound_stub_zone:
      - name: example.net
        stub_addr:
          - 8.8.8.8
      - name: foo.example
        stub_addr:
          - 8.8.8.8

License

Copyright (c) 2016 Tomoyuki Sakurai <[email protected]>

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Author Information

Tomoyuki Sakurai [email protected]

This README was created by ansible-role-init