90 lines
2.3 KiB
YAML
90 lines
2.3 KiB
YAML
# Alliance Boréale - Rôle PowerDNS Authoritative
|
|
# Couche: C2 (Réseau & DNS)
|
|
# Objectif: Déployer PowerDNS autoritaire (MASTER ou SLAVE)
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
- name: "🔍 Determine PowerDNS role (master/slave)"
|
|
ansible.builtin.set_fact:
|
|
pdns_is_master: "{{ inventory_hostname in groups['dns_masters'] }}"
|
|
pdns_is_slave: "{{ inventory_hostname in groups['dns_slaves'] }}"
|
|
tags: always
|
|
|
|
- name: "📦 Add PowerDNS repository"
|
|
ansible.builtin.import_tasks: repo.yml
|
|
tags: powerdns
|
|
|
|
- name: "📦 Install PowerDNS packages"
|
|
ansible.builtin.apt:
|
|
name:
|
|
- pdns-server
|
|
- pdns-backend-pgsql
|
|
- pdns-tools
|
|
state: present
|
|
update_cache: true
|
|
tags: powerdns
|
|
|
|
- name: "⚙️ Configure PowerDNS"
|
|
ansible.builtin.template:
|
|
src: pdns.conf.j2
|
|
dest: /etc/powerdns/pdns.conf
|
|
owner: root
|
|
group: pdns
|
|
mode: '0640'
|
|
notify: restart powerdns
|
|
tags: powerdns
|
|
|
|
- name: "⚙️ Configure PowerDNS PostgreSQL backend"
|
|
ansible.builtin.template:
|
|
src: pdns.d/pdns.local.gpgsql.conf.j2
|
|
dest: /etc/powerdns/pdns.d/pdns.local.gpgsql.conf
|
|
owner: root
|
|
group: pdns
|
|
mode: '0640'
|
|
notify: restart powerdns
|
|
tags: powerdns
|
|
|
|
- name: "🗄️ Import PowerDNS PostgreSQL schema"
|
|
ansible.builtin.import_tasks: schema.yml
|
|
when: pdns_is_master
|
|
tags: powerdns
|
|
|
|
- name: "🌐 Configure DNS zones (MASTER only)"
|
|
ansible.builtin.import_tasks: zones.yml
|
|
when: pdns_is_master
|
|
tags: powerdns
|
|
|
|
- name: "🔁 Configure AXFR (SLAVE only)"
|
|
ansible.builtin.import_tasks: slave.yml
|
|
when: pdns_is_slave
|
|
tags: powerdns
|
|
|
|
- name: "🔐 Configure DNSSEC"
|
|
ansible.builtin.import_tasks: dnssec.yml
|
|
when:
|
|
- pdns_is_master
|
|
- powerdns.dnssec.enabled | default(true)
|
|
tags: powerdns
|
|
|
|
- name: "🔥 Configure firewall for DNS"
|
|
ansible.builtin.import_tasks: firewall.yml
|
|
tags: powerdns
|
|
|
|
- name: "✅ Start and enable PowerDNS"
|
|
ansible.builtin.systemd:
|
|
name: pdns
|
|
state: started
|
|
enabled: true
|
|
tags: powerdns
|
|
|
|
- name: "🧪 Validate PowerDNS configuration"
|
|
ansible.builtin.import_tasks: validate.yml
|
|
tags: powerdns
|
|
|
|
- name: "✅ PowerDNS role completed"
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
✅ PowerDNS configured on {{ inventory_hostname }}
|
|
Role: {{ 'MASTER' if pdns_is_master else 'SLAVE' }}
|
|
Zones: {{ dns_zones | map(attribute='name') | list if pdns_is_master else 'N/A' }}
|
|
tags: powerdns
|