{"id":16994787,"url":"https://github.com/znerol/ansible-role-authns","last_synced_at":"2026-05-19T15:10:14.407Z","repository":{"id":136255044,"uuid":"187063789","full_name":"znerol/ansible-role-authns","owner":"znerol","description":"BIND Authoritative Name Server","archived":false,"fork":false,"pushed_at":"2020-01-17T08:21:11.000Z","size":36,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-27T06:28:24.785Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/znerol.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-05-16T16:25:33.000Z","updated_at":"2020-01-17T08:21:13.000Z","dependencies_parsed_at":null,"dependency_job_id":"d722fe95-0b87-497c-9f50-fdb60ce25188","html_url":"https://github.com/znerol/ansible-role-authns","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/znerol%2Fansible-role-authns","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/znerol%2Fansible-role-authns/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/znerol%2Fansible-role-authns/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/znerol%2Fansible-role-authns/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/znerol","download_url":"https://codeload.github.com/znerol/ansible-role-authns/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244913005,"owners_count":20530769,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-14T03:46:37.644Z","updated_at":"2026-05-19T15:10:04.395Z","avatar_url":"https://github.com/znerol.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"Role Name\n=========\n\n[![Build Status](https://travis-ci.org/znerol/ansible-role-authns.svg?branch=master)](https://travis-ci.org/znerol/ansible-role-authns)\n\nBIND Authoritative Name Server\n\nRequirements\n------------\n\nNone.\n\nRole Variables\n--------------\n\nThis role contains multiple `task` files. The `main` task file only imports\nsome of them:\n\n1. [bind-install.yml](#variables-for-bind-installyml): Installs required\n   packages on the system.\n1. [bind-config.yml](#variables-for-bind-configyml): Prepares a minimal\n   configuration for a non-recursive authoritative-only DNS server.\n1. [bind-service.yml](#variables-for-bind-serviceyml): Sets up the bind\n   service.\n\nThe following task files contain steps used to setup zones / resource records\nand ddns update keys.\n\n1. [zone.yml](#variables-for-zoneyml): Setup DNS zones with SOA and NS records\n   and an initial set of resource records (rr).\n1. [key.yml](#variables-for-keyyml): Setup a key for dynamic DNS updates.\n\n\n### Variables for bind-install.yml\n\nNone.\n\n### Variables for bind-config.yml\n\nVariables in this section should be left to their defaults in most cases.\n\n```\nauthns_main_config_owner: root\nauthns_main_config_group: root\nauthns_main_config_mode: 0644\nauthns_main_config_selevel: # omitted by default\nauthns_main_config_serole: # omitted by default\nauthns_main_config_setype: # omitted by default\nauthns_main_config_seuser: # omitted by default\n\nauthns_local_config_file: \"{{ authns_bind_etc_path }}/named.conf.local\"\nauthns_local_config_owner: root\nauthns_local_config_group: root\nauthns_local_config_mode: 0644\nauthns_local_config_selevel: # omitted by default\nauthns_local_config_serole: # omitted by default\nauthns_local_config_setype: # omitted by default\nauthns_local_config_seuser: # omitted by default\n\nauthns_options_config_file: \"{{ authns_bind_etc_path }}/named.conf.options\"\nauthns_options_config_owner: root\nauthns_options_config_group: root\nauthns_options_config_mode: 0644\nauthns_options_config_selevel: # omitted by default\nauthns_options_config_serole: # omitted by default\nauthns_options_config_setype: # omitted by default\nauthns_options_config_seuser: # omitted by default\n```\n\n### Variables for bind-service.yml\n\nNone.\n\n### Variables for zone.yml\n\nThe following variables are *required* when importing the `zone` task file:\n\n* Either one of `authns_zone_rr_content` or `authns_zone_rr_src` must be\n  defined. Use the former to supply the content of a zone file directly and the\n  later to specify a file containing the records. Those variables are\n  referenced from a call to [copy][Ansible-Copy] module, hence docs apply here\n  as well. Note: It is completely valid to set `authns_zone_rr_content` to the\n  empty string.\n\nWhen setting up a new zone, the following variables are optional:\n\n* `authns_zone_name`: The zone domain name. Defaults to the domain of inventory\n  hostname.\n* `authns_zone_allow_update`: A list of ACL rules defining which IP/key\n  combination is allowed to update the zone dynamically. Use the predefined\n  variable `{{ authns_acl_require_localnets_and_update_key }}` for the slightly\n  confusing ACL which allows dynamic updates to succeed only if the UPDATE\n  request comes from an address in localnets, and if it is signed using the key\n  from the `authns_update_key_name` variable. See [TSIG-Based Access\n  Control][ARM-TSIG] in the Bind9 Administrator Reference Manual.\n* `authns_zone_db_ns`: Used for the `NS` record in the zone, defaults to the\n  inventory hostname.\n* `authns_zone_db_ns_ip4` and `authns_zone_db_ns_ip6`: Used for `A` and `AAAA`\n  records for the zones nameserver. Default to the ip of inventory hostname if\n  its domain matches `authns_zone_name`.\n* If `authns_zone_dnssec` is set to `true`, a directory is created with the\n  correct access mode and DNSSEC configuration is added to the zone config.\n  Note that this does *not* generate any DNSSEC keys.\n\nThe remaining variables in this section should be left to their defaults in\nmost cases.\n\n```\nauthns_zone_name: \"{{ inventory_hostname.split('.')[1:]|join('.') }}\"\nauthns_zone_allow_update: []\n\nauthns_zone_dnssec: false\nauthns_zone_dnssec_key_dir: \"{{ authns_bind_etc_path }}/dnssec.{{ authns_zone_name }}\"\nauthns_zone_dnssec_key_owner: root\nauthns_zone_dnssec_key_group: \"{{ authns_os_bind_group }}\"\nauthns_zone_dnssec_key_mode: 0750\nauthns_zone_dnssec_key_selevel: # omitted by default\nauthns_zone_dnssec_key_serole: # omitted by default\nauthns_zone_dnssec_key_setype: # omitted by default\nauthns_zone_dnssec_key_seuser: # omitted by default\n\nauthns_zone_config_file: \"{{ authns_bind_etc_path }}/zones.{{ authns_zone_name }}\"\nauthns_zone_config_owner: root\nauthns_zone_config_group: root\nauthns_zone_config_mode: 0644\nauthns_zone_config_selevel: # omitted by default\nauthns_zone_config_serole: # omitted by default\nauthns_zone_config_setype: # omitted by default\nauthns_zone_config_seuser: # omitted by default\n```\n\n```\nauthns_zone_db_file: \"{{ authns_bind_db_path }}/db.{{ authns_zone_name }}\"\nauthns_zone_db_owner: root\nauthns_zone_db_group: root\nauthns_zone_db_mode: 0644\nauthns_zone_db_selevel: # omitted by default\nauthns_zone_db_serole: # omitted by default\nauthns_zone_db_setype: # omitted by default\nauthns_zone_db_seuser: # omitted by default\n\nauthns_zone_db_ns: \"{{ inventory_hostname }}\"\nauthns_zone_db_hostmaster: \"hostmaster.{{ authns_zone_name }}\"\nauthns_zone_db_serial: 1\nauthns_zone_db_ttl: 21600\nauthns_zone_db_refresh: 1800\nauthns_zone_db_retry: 900\nauthns_zone_db_expire: 604800\nauthns_zone_db_minimum: 1200\n\nauthns_zone_db_ns_in_zone: \"{{ authns_zone_db_ns == authns_zone_name or authns_zone_db_ns.endswith('.{:s}'.format(authns_zone_name)) | bool }}\"\nauthns_zone_db_ns_ip4: \"{{ ansible_default_ipv4['address'] | default('') }}\"\nauthns_zone_db_ns_ip6: \"{{ ansible_default_ipv6['address'] | default('') }}\"\n```\n\n```\nauthns_zone_rr_file: \"{{ authns_zone_db_file }}.rr\"\nauthns_zone_rr_owner: root\nauthns_zone_rr_group: root\nauthns_zone_rr_mode: 0644\n\nauthns_zone_rr_selevel: # omitted by default\nauthns_zone_rr_serole: # omitted by default\nauthns_zone_rr_setype: # omitted by default\nauthns_zone_rr_seuser: # omitted by default\n\nauthns_zone_rr_checksum: # omitted by default\nauthns_zone_rr_content: # omitted by default\nauthns_zone_rr_decrypt: # omitted by default\nauthns_zone_rr_follow: # omitted by default\nauthns_zone_rr_force: # omitted by default\nauthns_zone_rr_local_follow: # omitted by default\nauthns_zone_rr_remote_src: # omitted by default\nauthns_zone_rr_src: # omitted by default\n```\n\n### Variables for key.yml\n\nThe following variables are *required* when importing the `key` task file:\n\n* Either one of `authns_update_key_content` or `authns_update_key_src` must be\n  defined. Use the former to supply a ddns update key directly and the later to\n  specify a file containing the it. Those variables are referenced from a call\n  to [copy][Ansible-Copy] module, hence docs apply here as well. Use\n  `ddns-confgen -q -k {{ authns_update_key_name }}` to generate a ddns key.\n\nWhen setting up a new zone, the following variables are optional:\n\n* `authns_update_key_name`: The zone domain name. Defaults to the inventory\n  hostname.\n\nThe remaining variables in this section should be left to their defaults in\nmost cases.\n\n```\nauthns_update_key_name: \"{{ inventory_hostname }}\"\n\nauthns_update_key_file: \"{{ authns_bind_etc_path }}/key.{{ authns_update_key_name }}\"\nauthns_update_key_owner: root\nauthns_update_key_group: \"{{ authns_os_bind_group }}\"\nauthns_update_key_mode: 0640\n\nauthns_update_key_selevel: # omitted by default\nauthns_update_key_serole: # omitted by default\nauthns_update_key_setype: # omitted by default\nauthns_update_key_seuser: # omitted by default\n\nauthns_update_key_checksum: # omitted by default\nauthns_update_key_content: # omitted by default\nauthns_update_key_decrypt: # omitted by default\nauthns_update_key_follow: # omitted by default\nauthns_update_key_force: # omitted by default\nauthns_update_key_local_follow: # omitted by default\nauthns_update_key_remote_src: # omitted by default\nauthns_update_key_src: # omitted by default\n```\n\n\n\n\nDependencies\n------------\n\nNone.\n\nExample Playbook\n----------------\n\n    - hosts: all\n      vars:\n        authns_zone_rr_content: |\n          _test 1D IN TXT \"test rr\"\n        authns_update_key_content: |\n          key \"{{ inventory_hostname }}\" {\n              algorithm hmac-sha256;\n              secret \"{{ my_secret_update_key_variable }}\";\n          };\n      tasks:\n        - import_role:\n            name: znerol.authns\n\n        - import_role:\n            name: znerol.authns\n            tasks_from: zone\n\n        - import_role:\n            name: znerol.authns\n            tasks_from: key\n\n        - import_role:\n            name: znerol.authns\n            tasks_from: utilities\n\nLicense\n-------\n\nBSD\n\n\n[ARM-TSIG]: https://ftp.isc.org/isc/bind9/cur/9.11/doc/arm/Bv9ARM.ch04.html#id-1.5.6.8\n[Ansible-Copy]: https://docs.ansible.com/ansible/latest/modules/copy_module.html\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fznerol%2Fansible-role-authns","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fznerol%2Fansible-role-authns","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fznerol%2Fansible-role-authns/lists"}