new files from source

Infrastrucutre as Code/Ansible/roles/secure_vault/technitium/tasks/main.yml

@@ -0,0 +1,125 @@
+---
+# ==========================================================
+# Install and configure Technitium DNS Server
+# ==========================================================
+
+- name: Ensure Technitium install directory exists
+  ansible.builtin.file:
+    path: "{{ technitium_install_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Technitium data directory exists
+  ansible.builtin.file:
+    path: "{{ technitium_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Technitium TLS directory exists
+  ansible.builtin.file:
+    path: "{{ technitium_certs_dir }}"
+    state: directory
+    owner: vault
+    group: vault
+    mode: "0700"
+
+# ==========================================================
+# Install Technitium if not already installed
+# ==========================================================
+- name: Install Technitium DNS Server
+  ansible.builtin.command: bash install.sh
+  args:
+    chdir: /tmp
+    creates: "{{ technitium_install_dir }}/start.sh"
+  environment:
+    INSTALL_URL: "https://download.technitium.com/dns/install.sh"
+  register: technitium_install_result
+  ignore_errors: true
+  changed_when: technitium_install_result.rc == 0
+
+# ==========================================================
+# SELinux setup (idempotent)
+# ==========================================================
+- name: Apply SELinux context for Technitium certs
+  ansible.builtin.command: semanage fcontext -a -t etc_t '{{ technitium_certs_dir }}(/.*)?'
+  register: selinux_ctx
+  changed_when: selinux_ctx.rc == 0
+  ignore_errors: true
+
+- name: Restore SELinux context for Technitium certs
+  ansible.builtin.command: restorecon -Rv "{{ technitium_certs_dir }}"
+  changed_when: false
+
+# ==========================================================
+# Firewalld setup
+# ==========================================================
+- name: Ensure firewalld is running
+  ansible.builtin.systemd:
+    name: firewalld
+    enabled: true
+    state: started
+
+- name: Open Technitium DNS and admin ports
+  ansible.posix.firewalld:
+    port: "{{ item.port }}/{{ item.proto }}"
+    permanent: true
+    state: enabled
+    immediate: true
+  loop:
+    - { port: 53, proto: "udp" }
+    - { port: 53, proto: "tcp" }
+    - { port: 853, proto: "tcp" }
+    - { port: 443, proto: "tcp" }
+    - { port: 5380, proto: "tcp" }
+
+# ==========================================================
+# Systemd service deployment
+# ==========================================================
+- name: Deploy Technitium systemd unit
+  ansible.builtin.template:
+    src: "technitium.service.j2"
+    dest: "/etc/systemd/system/technitium.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart technitium
+
+- name: Wait for Vault-Agent to render certificates
+  ansible.builtin.wait_for:
+    path: "{{ cert_path }}"
+    state: present
+    timeout: 60
+  loop:
+    - "{{ technitium_crt_path }}"
+    - "{{ technitium_key_path }}"
+    - "{{ technitium_ca_path }}"
+  loop_control:
+    loop_var: cert_path
+
+- name: Fix ownership and permissions for Technitium certs
+  ansible.builtin.file:
+    path: "{{ cert.path }}"
+    owner: vault
+    group: vault
+    mode: "{{ cert.mode }}"
+  loop:
+    - { path: "{{ technitium_crt_path }}", mode: "0644" }
+    - { path: "{{ technitium_key_path }}", mode: "0600" }
+    - { path: "{{ technitium_ca_path }}", mode: "0644" }
+  loop_control:
+    loop_var: cert
+
+# ==========================================================
+# Start and enable service
+# ==========================================================
+- name: Ensure Technitium DNS service is running
+  ansible.builtin.systemd:
+    name: technitium
+    enabled: true
+    state: started