76 lines
2.4 KiB
YAML
76 lines
2.4 KiB
YAML
|
---
|
||
|
|
- name: Exiger l'IP de l'autoritatif interne (PowerDNS)
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- client_unbound_dns_autoritatif | length > 0
|
||
|
|
fail_msg: "client_unbound_dns_autoritatif requis (aucun hôte serveur_powerdns actif ?)."
|
||
|
|
|
||
|
|
- name: Installer Unbound
|
||
|
|
ansible.builtin.apt:
|
||
|
|
name: "{{ client_unbound_paquets }}"
|
||
|
|
state: present
|
||
|
|
update_cache: true
|
||
|
|
cache_valid_time: 3600
|
||
|
|
|
||
|
|
- name: Déployer la configuration Unbound (stub-zone interne + récursion)
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: setops.conf.j2
|
||
|
|
dest: /etc/unbound/unbound.conf.d/setops.conf
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
notify: Redémarrer unbound
|
||
|
|
|
||
|
|
- name: Valider la configuration Unbound
|
||
|
|
ansible.builtin.command: unbound-checkconf
|
||
|
|
changed_when: false
|
||
|
|
when: not ansible_check_mode
|
||
|
|
|
||
|
|
- name: Activer et démarrer Unbound
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: "{{ client_unbound_service }}"
|
||
|
|
enabled: true
|
||
|
|
state: started
|
||
|
|
when: not ansible_check_mode
|
||
|
|
|
||
|
|
- name: Appliquer les redémarrages Unbound avant toute validation/bascule
|
||
|
|
ansible.builtin.meta: flush_handlers
|
||
|
|
|
||
|
|
# --- Bascule du resolver : PROTÉGÉE + validée (ne casse jamais un nœud) ---
|
||
|
|
- name: Refuser la bascule du resolver sans confirmation explicite
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- client_unbound_confirm | bool
|
||
|
|
fail_msg: "Bascule refusée : définir client_unbound_confirm=true (avec client_unbound_apply=true)."
|
||
|
|
when: client_unbound_apply | bool
|
||
|
|
|
||
|
|
- name: Valider qu'Unbound résout AVANT de basculer (interne + Internet)
|
||
|
|
ansible.builtin.command: "dig @127.0.0.1 {{ item.nom }} {{ item.type }} +short"
|
||
|
|
register: client_unbound_validation
|
||
|
|
changed_when: false
|
||
|
|
failed_when: client_unbound_validation.stdout | trim == ''
|
||
|
|
loop:
|
||
|
|
- { nom: "{{ client_unbound_zone_interne }}", type: "SOA" }
|
||
|
|
- { nom: "deb.debian.org", type: "A" }
|
||
|
|
loop_control:
|
||
|
|
label: "{{ item.nom }} {{ item.type }}"
|
||
|
|
when:
|
||
|
|
- client_unbound_apply | bool
|
||
|
|
- client_unbound_confirm | bool
|
||
|
|
- not ansible_check_mode
|
||
|
|
|
||
|
|
- name: Basculer /etc/resolv.conf vers Unbound local (127.0.0.1)
|
||
|
|
ansible.builtin.copy:
|
||
|
|
dest: "{{ client_unbound_resolv_conf }}"
|
||
|
|
content: |
|
||
|
|
# Généré par Set-OPS (rôle client_unbound). Résolveur local Unbound.
|
||
|
|
search {{ client_unbound_zone_interne }}
|
||
|
|
nameserver 127.0.0.1
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
when:
|
||
|
|
- client_unbound_apply | bool
|
||
|
|
- client_unbound_confirm | bool
|
||
|
|
- not ansible_check_mode
|