home/max
Archived
2
1
Fork 0
Code Issues 9 Pull requests Projects Releases Packages Wiki Activity

remove authoritative DNS server

Browse source
This commit is contained in:
Pim Kunis 2023-03-19 11:44:16 +01:00
parent cc4704b2b9
commit 3865e57f9a
13 changed files with 0 additions and 187 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -9,7 +9,6 @@ The other roles are specifically for the various services we run.
All services below are running under Docker, except NSD and Borg.
- Authoritative DNS using [NSD](https://www.nlnetlabs.nl/projects/nsd/about/) (ns.pizzapim.nl)
- Reverse proxy using [Traefik](https://doc.traefik.io/traefik/)
- Git server using [Forgejo](https://forgejo.org/) ([git.pizzapim.nl](https://git.pizzapim.nl))
- Static website using [Jekyll](https://jekyllrb.com/) ([pizzapim.nl](https://pizzapim.nl))

1
playbooks/all.yml
View file

@ -4,7 +4,6 @@
- {role: 'ssh', tags: 'ssh'}
- {role: 'watchtower', tags: 'watchtower'}
- {role: 'borg', tags: 'borg'}
- {role: 'nsd', tags: 'nsd'}
- {role: 'forgejo', tags: 'forgejo'}
- {role: 'syncthing', tags: 'syncthing'}
- {role: 'kms', tags: 'kms'}

1
roles/nsd/files/keys/Kgeokunis2.nl.ksk.key
View file

@ -1 +0,0 @@
geokunis2.nl. IN DNSKEY 257 3 15 8DFshejNxv4d9ZkSRY53kEay06aOhHm77EOYNSZFp/w= ;{id = 64014 (ksk), size = 256b}

10
roles/nsd/files/keys/Kgeokunis2.nl.ksk.private
View file

@ -1,10 +0,0 @@
$ANSIBLE_VAULT;1.1;AES256
33306239336639653065343862633935396534373739613332356638343037646530333331343835
6464303336356534653431663938383732383863366238320a663430613133363134336264343734
31343731373239613330633935636137646133616334353565663061356566666465326261306362
3463633863626666330a383461656632346361646365383234653963333561366463373331346539
30633237346532633634636537663936353337353331393663363363363566663738643632363761
66323032383862306635656130366261303161636232633561313630316537626262356532313131
63616437633333346431303539306433613130373934393036356563316365373966346536353764
39343038373162303933653335393432636332613038366531353432346332333936656464626536
64633030353336616561656539313863306534633863633835333531306533313930

1
roles/nsd/files/keys/Kpizzapim.nl.ksk.key
View file

@ -1 +0,0 @@
pizzapim.nl. IN DNSKEY 257 3 15 PL2LJmmaooqVFVIrvdFzS+X0YiEgz+fLlr7jm54nX/E= ;{id = 47515 (ksk), size = 256b}

10
roles/nsd/files/keys/Kpizzapim.nl.ksk.private
View file

@ -1,10 +0,0 @@
$ANSIBLE_VAULT;1.1;AES256
36343534663736653462386238363734646238306365393233633530663039656335623961663131
6436373566336464336330326438656137646536656333370a386539613239343962373562653264
66616530343235333964343332386234666266643933393531323066666164623862633962376666
3230333539393335630a653532396665383536633164643534303461636135653737616137313034
33653838653538623934353631393636363937333831313036643334343261363836393235313235
36613966343431333364336437393430653366643263643130376437663164353361633735616332
35656666353037643739356133303064633166323535323265323134363963316566323165643165
36656264353962346530323830623432616238653966613433616235336539396461376162316564
61643465323165643961303639653466663961333531663133636666643437333233

24
roles/nsd/files/nsd.conf
View file

@ -1,24 +0,0 @@
server:
ip-address: enp3s0
server-count: 1
verbosity: 1
hide-version: yes
zonesdir: "/etc/nsd/zones"
ip-transparent: yes
ip-freebind: yes
zone:
name: pizzapim.nl
zonefile: pizzapim.nl.signed
provide-xfr: 87.253.155.96/27 NOKEY
provide-xfr: 157.97.168.160/27 NOKEY
zone:
name: geokunis2.nl
zonefile: geokunis2.nl.signed
provide-xfr: 87.253.155.96/27 NOKEY
provide-xfr: 157.97.168.160/27 NOKEY
zone:
name: pim.kunis.nl
zonefile: pim.kunis.nl

26
roles/nsd/files/zones/geokunis2.nl
View file

@ -1,26 +0,0 @@
$ORIGIN geokunis2.nl.
$TTL 60
geokunis2.nl. IN SOA ns.geokunis2.nl. niels.kunis.nl. 2023030500 1800 3600 1209600 3600
NS ns.geokunis2.nl.
NS ns0.transip.net.
NS ns1.transip.nl.
NS ns2.transip.eu.
A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
; MX 0 .
; TXT "v=spf1 -all"
CAA 0 issue "letsencrypt.org"
mail IN A 84.245.14.149
MX 10 mail.geokunis2.nl
jenl IN A 217.123.41.225
wg IN A 84.245.14.149
wg IN AAAA 2a02:58:1:e::1afb
wg4 IN A 84.245.14.149
wg6 IN AAAA 2a02:58:1:e::1afb
kms IN A 84.245.14.149
files IN A 84.245.14.149
files IN AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
_dmarc IN TXT "v=DMARC1; p=reject; fo=0; adkim=s; aspf=s; pct=100; rf=afrf; sp=reject"
ns A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda

19
roles/nsd/files/zones/pim.kunis.nl
View file

@ -1,19 +0,0 @@
$ORIGIN pim.kunis.nl.
$TTL 60
pim.kunis.nl. IN SOA ns.pim.kunis.nl. pim.kunis.nl. 2023020800 1800 3600 1209600 3600
NS ns.pim.kunis.nl.
A 84.245.14.149
TXT "v=spf1 ~all"
_dmarc IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;"
www IN A 84.245.14.149
ns IN A 84.245.14.149
social IN CNAME www.pim.kunis.nl.
dav IN CNAME www.pim.kunis.nl.
git IN CNAME www.pim.kunis.nl.
meet IN CNAME www.pim.kunis.nl.
rss IN CNAME www.pim.kunis.nl.

19
roles/nsd/files/zones/pizzapim.nl
View file

@ -1,19 +0,0 @@
$ORIGIN pizzapim.nl.
$TTL 60
pizzapim.nl. IN SOA ns.pizzapim.nl. pim.kunis.nl. 2023020900 1800 3600 1209600 3600
NS ns.pizzapim.nl.
NS ns0.transip.net.
NS ns1.transip.nl.
NS ns2.transip.eu.
A 84.245.14.149
TXT "v=spf1 ~all"
CAA 0 issue "letsencrypt.org"
_dmarc IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;"
social IN A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
ns IN A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda

2
roles/nsd/meta/main.yml
View file

@ -1,2 +0,0 @@
dependencies:
- role: common

70
roles/nsd/tasks/main.yml
View file

@ -1,70 +0,0 @@
- name: Install nsd
apt:
pkg:
- nsd
- ldnsutils
- name: Copy nsd.conf
copy:
src: "{{ role_path }}/files/nsd.conf"
dest: /etc/nsd/nsd.conf
- name: Create zones directory
file:
path: /etc/nsd/zones
state: directory
- name: Copy zone files
copy:
src: "{{ role_path }}/files/zones/"
dest: /etc/nsd/zones
- name: Create keys directory
file:
path: /etc/nsd/keys
state: directory
- name: Copy KSK private keys
template:
src: "{{ item }}"
dest: "/etc/nsd/keys/{{ item | basename }}"
with_fileglob:
- "{{ role_path }}/files/keys/*.ksk.private"
- name: Copy KSK keys
copy:
src: "{{ item }}"
dest: "/etc/nsd/keys/{{ item | basename }}"
with_fileglob:
- "{{ role_path }}/files/keys/*.ksk.key"
- name: Check if ZSKs exist
stat:
path: "/etc/nsd/keys/K{{ item | basename }}.zsk.key"
register: zsks_exists
with_fileglob:
- "{{ role_path }}/files/zones/*"
- name: Create ZSK
command:
cmd: "ldns-keygen -a ED25519 {{ item.item | basename }}"
chdir: /etc/nsd/keys
register: create_zsk
when: not item.stat.exists and (item.item | basename) in sign_zones
with_items: "{{ zsks_exists.results }}"
- name: Rename ZSK key
command:
cmd: "mv {{ item.stdout }}.key K{{ item.item.item | basename }}.zsk.key"
chdir: /etc/nsd/keys
when: item.changed and (item.item | basename) in sign_zones
with_items: "{{ create_zsk.results }}"
- name: Rename ZSK private key
command:
cmd: "mv {{ item.stdout }}.private K{{ item.item.item | basename }}.zsk.private"
chdir: /etc/nsd/keys
when: item.changed and (item.item | basename) in sign_zones
with_items: "{{ create_zsk.results }}"
- name: Sign zones
command:
cmd: "ldns-signzone {{ item | basename }} /etc/nsd/keys/K{{ item | basename }}.zsk /etc/nsd/keys/K{{ item | basename }}.ksk"
chdir: /etc/nsd/zones
when: (item | basename) in sign_zones
with_fileglob:
- "{{ role_path }}/files/zones/*"
- name: Restart NSD
systemd:
name: nsd
enabled: true
state: reloaded

3
roles/nsd/vars/main.yml
View file

@ -1,3 +0,0 @@
sign_zones:
- geokunis2.nl
- pizzapim.nl