update..

roles/common/tasks/caching-nameserver.yml

@@ -50,7 +50,7 @@
     mode: '0755'
 
 
-- name: (caching-nameserver.yml) update named.conf.options configuration file
+- name: (caching-nameserver.yml) update named.conf.options configuration file (normal server)
   template:
     src: etc/bind/named.conf.options.j2
     dest: /etc/bind/named.conf.options
@@ -63,6 +63,36 @@
   tags:
     - apt-caching-nameserver
     - caching-nameserver
+  when: 
+    - inventory_hostname not in groups["gateway_server"]
+
+# --------------------
+
+# In case of gateway gateway servers ONLY if bind ption file NOT exists
+#
+- name: Check if file '/etc/bind/named.conf.options' exists
+  stat:
+    path: /etc/bind/named.conf.options
+  register: file_named_conf_options
+
+- name: (caching-nameserver.yml) update named.conf.options configuration file (gateway server)
+  template:
+    src: etc/bind/named.conf.options.gateway.j2
+    dest: /etc/bind/named.conf.options
+    backup: yes
+    owner: root
+    group: bind
+    mode: 0644
+    #validate: visudo -cf %s
+  notify: Reload bind9
+  tags:
+    - apt-caching-nameserver
+    - caching-nameserver
+  when: 
+    - inventory_hostname in groups["gateway_server"]
+    - not file_named_conf_options.stat.exists
+
+# --------------------
 
 
 - name: (caching-nameserver.yml) Add 127.0.0.1 as first nameserver entry to /etc/resolv.conf

roles/common/templates/etc/bind/named.conf.options.gateway.j2

@@ -0,0 +1,113 @@
+# {{ ansible_managed }}
+
+acl local-net {
+   127.0.0.0/8;
+   172.16.0.0/12;
+   192.168.0.0/16;
+   10.0.0.0/8;
+   fc00::/7;
+   fe80::/10;
+   ::1/128;
+};
+
+options {
+   directory "/var/cache/bind";
+
+   // If there is a firewall between you and nameservers you want
+   // to talk to, you may need to fix the firewall to allow multiple
+   // ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+   // If your ISP provided one or more IP addresses for stable
+   // nameservers, you probably want to use them as forwarders.
+   // Uncomment the following block, and insert the addresses replacing
+   // the all-0's placeholder.
+
+   // forwarders {
+   //    0.0.0.0;
+   // };
+
+   //========================================================================
+   // If BIND logs error messages about the root key being expired,
+   // you will need to update your keys.  See https://www.isc.org/bind-keys
+   //========================================================================
+   dnssec-validation auto;
+
+   auth-nxdomain no;    # conform to RFC1035
+
+   // version statement - inhibited for security
+   // (avoids hacking any known weaknesses)
+   version "not currently available";
+
+   // disables all zone transfer requests
+   allow-transfer{"none";};
+
+   listen-on-v6 { none; };
+   listen-on { any; };
+
+   allow-query {
+      local-net;
+   };
+   allow-query-cache {
+      local-net;
+   };
+
+   // caching name services
+   recursion yes;
+
+   allow-recursion {
+      local-net;
+   };
+
+};
+
+logging {
+   channel simple_log {
+      file "/var/log/named/bind.log" versions 3 size 5m;
+      severity warning;
+      print-time yes;
+      print-severity yes;
+      print-category yes;
+   };
+   channel queries_log {
+      file "/var/log/named/query.log" versions 5 size 2m;
+      severity info;
+      print-time yes;
+      print-severity yes;
+      print-category no;
+   };
+   channel log_zone_transfers {
+      file "/var/log/named/axfr.log" versions 5 size 2m;
+      severity info;
+      print-time yes;
+      print-severity yes;
+      print-category yes;
+   };
+   channel dnssec_log {
+      file "/var/log/named/dnssec.log" versions 5 size 2m;
+      severity debug 3;
+      print-time yes;
+      print-severity yes;
+      print-category yes;
+   };
+   category resolver {
+      queries_log;
+   };
+   category queries {
+      queries_log;
+   };
+    category xfer-in {
+      log_zone_transfers;
+   };
+   category xfer-out {
+      log_zone_transfers;
+   };
+   category notify {
+      log_zone_transfers;
+   };
+   category dnssec {
+      dnssec_log;
+   };
+   category default{
+      simple_log;
+   };
+};