149 lines
4.7 KiB
YAML
149 lines
4.7 KiB
YAML
# Alliance Boréale - PowerDNS Schema Import
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
# Ce fichier contient: schema.yml, zones.yml, slave.yml, dnssec.yml
|
|
|
|
# ==========================================
|
|
# SCHEMA.YML - Import PostgreSQL schema
|
|
# ==========================================
|
|
- name: "🗄️ Check if PowerDNS schema exists"
|
|
community.postgresql.postgresql_query:
|
|
db: powerdns
|
|
query: "SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'domains');"
|
|
become: true
|
|
become_user: postgres
|
|
register: pdns_schema_check
|
|
changed_when: false
|
|
|
|
- name: "🗄️ Download PowerDNS schema"
|
|
ansible.builtin.get_url:
|
|
url: https://raw.githubusercontent.com/PowerDNS/pdns/rel/auth-4.8.x/modules/gpgsqlbackend/schema.pgsql.sql
|
|
dest: /tmp/pdns-schema.sql
|
|
mode: '0644'
|
|
when: not pdns_schema_check.query_result[0].exists
|
|
|
|
- name: "🗄️ Import PowerDNS schema"
|
|
community.postgresql.postgresql_db:
|
|
db: powerdns
|
|
state: restore
|
|
target: /tmp/pdns-schema.sql
|
|
become: true
|
|
become_user: postgres
|
|
when: not pdns_schema_check.query_result[0].exists
|
|
|
|
# ==========================================
|
|
# ZONES.YML - Create DNS zones (MASTER)
|
|
# ==========================================
|
|
- name: "🌐 Create DNS zones"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil create-zone {{ item.name }}"
|
|
loop: "{{ dns_zones }}"
|
|
register: zone_create
|
|
changed_when: "'created' in zone_create.stdout"
|
|
failed_when:
|
|
- zone_create.rc != 0
|
|
- "'already exists' not in zone_create.stderr"
|
|
|
|
- name: "🌐 Set zone kind to NATIVE"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil set-kind {{ item.name }} NATIVE"
|
|
loop: "{{ dns_zones }}"
|
|
changed_when: false
|
|
|
|
- name: "🌐 Configure SOA records"
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
pdnsutil replace-rrset {{ item.name }} @ SOA
|
|
"{{ item.soa.nameserver }} {{ item.soa.email }}
|
|
{{ item.soa.serial }} {{ item.soa.refresh }} {{ item.soa.retry }}
|
|
{{ item.soa.expire }} {{ item.soa.minimum }}"
|
|
loop: "{{ dns_zones }}"
|
|
changed_when: false
|
|
|
|
- name: "🌐 Add NS records"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil add-record {{ item.0.name }} @ NS {{ item.1 }}"
|
|
loop: "{{ dns_zones | subelements('ns_records') }}"
|
|
register: ns_add
|
|
changed_when: false
|
|
failed_when:
|
|
- ns_add.rc != 0
|
|
- "'already exists' not in ns_add.stderr"
|
|
|
|
- name: "🌐 Add A/AAAA records"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil add-record {{ item.0.name }} {{ item.1.name }} {{ item.1.type }} {{ item.1.content }} {{ item.1.ttl | default(3600) }}"
|
|
loop: "{{ dns_zones | subelements('records', skip_missing=True) }}"
|
|
register: record_add
|
|
changed_when: false
|
|
failed_when:
|
|
- record_add.rc != 0
|
|
- "'already exists' not in record_add.stderr"
|
|
|
|
- name: "🌐 Rectify zones"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil rectify-zone {{ item.name }}"
|
|
loop: "{{ dns_zones }}"
|
|
changed_when: false
|
|
|
|
# ==========================================
|
|
# SLAVE.YML - Configure AXFR for slaves
|
|
# ==========================================
|
|
- name: "🔁 Configure supermaster for AXFR"
|
|
community.postgresql.postgresql_query:
|
|
db: powerdns
|
|
query: >
|
|
INSERT INTO supermasters (ip, nameserver, account)
|
|
VALUES ('{{ hostvars[groups['dns_masters'][0]]['ansible_host'] }}',
|
|
'{{ inventory_hostname }}',
|
|
'default')
|
|
ON CONFLICT DO NOTHING;
|
|
become: true
|
|
become_user: postgres
|
|
|
|
- name: "🔁 Enable slave mode in PowerDNS"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/powerdns/pdns.conf
|
|
regexp: '^slave='
|
|
line: 'slave=yes'
|
|
notify: restart powerdns
|
|
|
|
# ==========================================
|
|
# DNSSEC.YML - Configure DNSSEC
|
|
# ==========================================
|
|
- name: "🔐 Enable DNSSEC for zones"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil secure-zone {{ item.name }}"
|
|
loop: "{{ dns_zones }}"
|
|
register: dnssec_secure
|
|
changed_when: "'secured' in dnssec_secure.stdout"
|
|
failed_when:
|
|
- dnssec_secure.rc != 0
|
|
- "'already' not in dnssec_secure.stderr"
|
|
|
|
- name: "🔐 Configure NSEC3"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil set-nsec3 {{ item.name }} '1 0 10 ab' narrow"
|
|
loop: "{{ dns_zones }}"
|
|
changed_when: false
|
|
|
|
- name: "🔐 Rectify zones after DNSSEC"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil rectify-zone {{ item.name }}"
|
|
loop: "{{ dns_zones }}"
|
|
changed_when: false
|
|
|
|
- name: "🔐 Export DS records"
|
|
ansible.builtin.command:
|
|
cmd: "pdnsutil show-zone {{ item.name }}"
|
|
loop: "{{ dns_zones }}"
|
|
register: ds_records
|
|
changed_when: false
|
|
|
|
- name: "🔐 Display DS records for parent zone"
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
⚠️ IMPORTANT: Add these DS records to your domain registrar:
|
|
{{ ds_records.results | map(attribute='stdout') | join('\n') }}
|
|
when: ds_records.results | length > 0
|