new files from source

2026-06-09 10:20:07 +03:00
commit 973546647d
@@ -0,0 +1,28 @@
+# Networking
+technitium_port: 53
+technitium_tls_port: 853
+technitium_admin_port: TECHNITIUM_PORT
+technitium_bind_address: "0.0.0.0"
+
+# ==========================================================
+# Directory paths
+# ==========================================================
+technitium_certs_dir: "/etc/technitium/certs"
+technitium_crt_path: "{{ technitium_certs_dir }}/technitium.crt"
+technitium_key_path: "{{ technitium_certs_dir }}/technitium.key"
+technitium_ca_path: "{{ technitium_certs_dir }}/technitium_ca.crt"
+
+# Install paths
+technitium_install_dir: "/opt/technitium/dns"
+technitium_data_dir: "{{ technitium_install_dir }}/data"
+
+vault_agent_templates:
+  - src: "technitium_cert.ctmpl"
+    dest: "{{ technitium_crt_path }}"
+    service: "technitium"
+  - src: "technitium_key.ctmpl"
+    dest: "{{ technitium_key_path }}"
+    service: "technitium"
+  - src: "technitium_ca.ctmpl"
+    dest: "{{ technitium_ca_path }}"
+    service: "technitium"
@@ -0,0 +1,8 @@
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: yes
+
+- name: Restart technitium
+  ansible.builtin.systemd:
+    name: technitium
+    state: restarted
@@ -0,0 +1,125 @@
+---
+# ==========================================================
+# Install and configure Technitium DNS Server
+# ==========================================================
+
+- name: Ensure Technitium install directory exists
+  ansible.builtin.file:
+    path: "{{ technitium_install_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Technitium data directory exists
+  ansible.builtin.file:
+    path: "{{ technitium_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Technitium TLS directory exists
+  ansible.builtin.file:
+    path: "{{ technitium_certs_dir }}"
+    state: directory
+    owner: vault
+    group: vault
+    mode: "0700"
+
+# ==========================================================
+# Install Technitium if not already installed
+# ==========================================================
+- name: Install Technitium DNS Server
+  ansible.builtin.command: bash install.sh
+  args:
+    chdir: /tmp
+    creates: "{{ technitium_install_dir }}/start.sh"
+  environment:
+    INSTALL_URL: "https://download.technitium.com/dns/install.sh"
+  register: technitium_install_result
+  ignore_errors: true
+  changed_when: technitium_install_result.rc == 0
+
+# ==========================================================
+# SELinux setup (idempotent)
+# ==========================================================
+- name: Apply SELinux context for Technitium certs
+  ansible.builtin.command: semanage fcontext -a -t etc_t '{{ technitium_certs_dir }}(/.*)?'
+  register: selinux_ctx
+  changed_when: selinux_ctx.rc == 0
+  ignore_errors: true
+
+- name: Restore SELinux context for Technitium certs
+  ansible.builtin.command: restorecon -Rv "{{ technitium_certs_dir }}"
+  changed_when: false
+
+# ==========================================================
+# Firewalld setup
+# ==========================================================
+- name: Ensure firewalld is running
+  ansible.builtin.systemd:
+    name: firewalld
+    enabled: true
+    state: started
+
+- name: Open Technitium DNS and admin ports
+  ansible.posix.firewalld:
+    port: "{{ item.port }}/{{ item.proto }}"
+    permanent: true
+    state: enabled
+    immediate: true
+  loop:
+    - { port: 53, proto: "udp" }
+    - { port: 53, proto: "tcp" }
+    - { port: 853, proto: "tcp" }
+    - { port: 443, proto: "tcp" }
+    - { port: 5380, proto: "tcp" }
+
+# ==========================================================
+# Systemd service deployment
+# ==========================================================
+- name: Deploy Technitium systemd unit
+  ansible.builtin.template:
+    src: "technitium.service.j2"
+    dest: "/etc/systemd/system/technitium.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart technitium
+
+- name: Wait for Vault-Agent to render certificates
+  ansible.builtin.wait_for:
+    path: "{{ cert_path }}"
+    state: present
+    timeout: 60
+  loop:
+    - "{{ technitium_crt_path }}"
+    - "{{ technitium_key_path }}"
+    - "{{ technitium_ca_path }}"
+  loop_control:
+    loop_var: cert_path
+
+- name: Fix ownership and permissions for Technitium certs
+  ansible.builtin.file:
+    path: "{{ cert.path }}"
+    owner: vault
+    group: vault
+    mode: "{{ cert.mode }}"
+  loop:
+    - { path: "{{ technitium_crt_path }}", mode: "0644" }
+    - { path: "{{ technitium_key_path }}", mode: "0600" }
+    - { path: "{{ technitium_ca_path }}", mode: "0644" }
+  loop_control:
+    loop_var: cert
+
+# ==========================================================
+# Start and enable service
+# ==========================================================
+- name: Ensure Technitium DNS service is running
+  ansible.builtin.systemd:
+    name: technitium
+    enabled: true
+    state: started
@@ -0,0 +1,16 @@
+[Unit]
+Description=Technitium DNS Server
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory={{ technitium_install_dir }}
+#ExecStart={{ technitium_install_dir }}/start.sh
+ExecStart={{ technitium_install_dir }}/start.sh --tls-cert /etc/technitium/certs/technitium.crt --tls-key  /etc/technitium/certs/technitium.key
+Restart=always
+RestartSec=5
+User=root
+Group=root
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,4 @@
+technitium_service_name: "technitium"
+technitium_binary_url: "https://download.technitium.com/dns/DnsServerPortable.tar.gz"
+technitium_data_dir: "{{ technitium_install_dir }}/data"
+technitium_conf_file: "{{ technitium_install_dir }}/Technitium.Dns.Server.json"