57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
# Alliance Boréale - PowerDNS Firewall & Validation
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
# ==========================================
|
|
# FIREWALL.YML
|
|
# ==========================================
|
|
- name: "🔥 Ensure nftables rules include DNS"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/nftables.conf
|
|
marker: "# {mark} ANSIBLE MANAGED - PowerDNS"
|
|
insertbefore: "# Log dropped packets"
|
|
block: |
|
|
# PowerDNS - DNS queries
|
|
udp dport 53 accept comment "DNS queries (UDP)"
|
|
tcp dport 53 accept comment "DNS queries (TCP)"
|
|
|
|
# PowerDNS - API (internal only)
|
|
ip saddr {{ network.internal_subnet | default('10.0.0.0/8') }} tcp dport 8081 accept comment "PowerDNS API"
|
|
notify: reload nftables
|
|
|
|
# ==========================================
|
|
# VALIDATE.YML
|
|
# ==========================================
|
|
- name: "🧪 Wait for PowerDNS to be ready"
|
|
ansible.builtin.wait_for:
|
|
port: 53
|
|
host: "{{ ansible_host }}"
|
|
timeout: 30
|
|
|
|
- name: "🧪 Test DNS resolution (localhost)"
|
|
ansible.builtin.command:
|
|
cmd: "dig @127.0.0.1 {{ dns_zones[0].name }} SOA +short"
|
|
register: dns_test_local
|
|
changed_when: false
|
|
failed_when: dns_test_local.rc != 0
|
|
|
|
- name: "🧪 Display DNS test result"
|
|
ansible.builtin.debug:
|
|
msg: "✅ DNS resolution working: {{ dns_test_local.stdout }}"
|
|
|
|
- name: "🧪 Check PowerDNS API (if enabled)"
|
|
ansible.builtin.uri:
|
|
url: "http://127.0.0.1:8081/api/v1/servers/localhost"
|
|
headers:
|
|
X-API-Key: "{{ powerdns.api.key }}"
|
|
return_content: true
|
|
register: api_test
|
|
when: powerdns.api.enabled | default(true)
|
|
failed_when: false
|
|
|
|
- name: "🧪 Display PowerDNS version"
|
|
ansible.builtin.debug:
|
|
msg: "✅ PowerDNS API responding: {{ api_test.json.version | default('N/A') }}"
|
|
when:
|
|
- powerdns.api.enabled | default(true)
|
|
- api_test.status == 200
|