Initial commit

roles/common/templates/etc/bind/named.conf.options.j2

@@ -0,0 +1,106 @@
+# {{ ansible_managed }}
+
+{% if acl_caching_nameserver is defined and acl_caching_nameserver|length > 0 %}
+{% for acl in acl_caching_nameserver %}
+
+acl {{ acl.name }} {
+{%    for entry in acl.entries %}
+   {{ entry }}
+{%    endfor %}
+};
+{% endfor %}
+{% endif %}
+
+options {
+   directory "/var/cache/bind";
+
+   // If there is a firewall between you and nameservers you want
+   // to talk to, you may need to fix the firewall to allow multiple
+   // ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+   // If your ISP provided one or more IP addresses for stable
+   // nameservers, you probably want to use them as forwarders.
+   // Uncomment the following block, and insert the addresses replacing
+   // the all-0's placeholder.
+
+   // forwarders {
+   //    0.0.0.0;
+   // };
+
+   //========================================================================
+   // If BIND logs error messages about the root key being expired,
+   // you will need to update your keys.  See https://www.isc.org/bind-keys
+   //========================================================================
+   dnssec-validation auto;
+
+   // caching name services
+   recursion yes;
+
+{% if acl_caching_nameserver is defined and acl_caching_nameserver|length > 0 %}
+   listen-on port 53 {
+      any ;
+   };
+
+   listen-on-v6 port 53 {
+      any;
+   };
+
+   allow-recursion {
+      127.0.0.1;
+      ::1 ;
+{% for acl in acl_caching_nameserver %}
+      {{ acl.name }};
+{% endfor %}
+   };
+
+{% else %}
+   listen-on port 53 {
+      127.0.0.1;
+   };
+
+   listen-on-v6 port 53 {
+      ::1;
+   };
+
+   allow-recursion {
+      127.0.0.1;
+      ::1;
+   };
+{% endif %}
+};
+
+logging {
+   channel simple_log {
+      file "/var/log/named/bind.log" versions 3 size 5m;
+      severity warning;
+      print-time yes;
+      print-severity yes;
+      print-category yes;
+   };
+   channel queries_log {
+      file "/var/log/named/query.log" versions 5 size 2m;
+      severity info;
+      print-time yes;
+      print-severity yes;
+      print-category no;
+   };
+   channel dnssec_log {
+      file "/var/log/named/dnssec.log" versions 5 size 2m;
+      severity debug 3;
+      print-time yes;
+      print-severity yes;
+      print-category yes;
+   };
+   category resolver {
+      queries_log;
+   };
+   category queries {
+      queries_log;
+   };
+   category dnssec {
+      dnssec_log;
+   };
+   category default{
+      simple_log;
+   };
+};