126 lines
3.7 KiB
YAML
126 lines
3.7 KiB
YAML
---
|
|
# ==========================================================
|
|
# Install and configure Technitium DNS Server
|
|
# ==========================================================
|
|
|
|
- name: Ensure Technitium install directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ technitium_install_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Ensure Technitium data directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ technitium_data_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Ensure Technitium TLS directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ technitium_certs_dir }}"
|
|
state: directory
|
|
owner: vault
|
|
group: vault
|
|
mode: "0700"
|
|
|
|
# ==========================================================
|
|
# Install Technitium if not already installed
|
|
# ==========================================================
|
|
- name: Install Technitium DNS Server
|
|
ansible.builtin.command: bash install.sh
|
|
args:
|
|
chdir: /tmp
|
|
creates: "{{ technitium_install_dir }}/start.sh"
|
|
environment:
|
|
INSTALL_URL: "https://download.technitium.com/dns/install.sh"
|
|
register: technitium_install_result
|
|
ignore_errors: true
|
|
changed_when: technitium_install_result.rc == 0
|
|
|
|
# ==========================================================
|
|
# SELinux setup (idempotent)
|
|
# ==========================================================
|
|
- name: Apply SELinux context for Technitium certs
|
|
ansible.builtin.command: semanage fcontext -a -t etc_t '{{ technitium_certs_dir }}(/.*)?'
|
|
register: selinux_ctx
|
|
changed_when: selinux_ctx.rc == 0
|
|
ignore_errors: true
|
|
|
|
- name: Restore SELinux context for Technitium certs
|
|
ansible.builtin.command: restorecon -Rv "{{ technitium_certs_dir }}"
|
|
changed_when: false
|
|
|
|
# ==========================================================
|
|
# Firewalld setup
|
|
# ==========================================================
|
|
- name: Ensure firewalld is running
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Open Technitium DNS and admin ports
|
|
ansible.posix.firewalld:
|
|
port: "{{ item.port }}/{{ item.proto }}"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
loop:
|
|
- { port: 53, proto: "udp" }
|
|
- { port: 53, proto: "tcp" }
|
|
- { port: 853, proto: "tcp" }
|
|
- { port: 443, proto: "tcp" }
|
|
- { port: 5380, proto: "tcp" }
|
|
|
|
# ==========================================================
|
|
# Systemd service deployment
|
|
# ==========================================================
|
|
- name: Deploy Technitium systemd unit
|
|
ansible.builtin.template:
|
|
src: "technitium.service.j2"
|
|
dest: "/etc/systemd/system/technitium.service"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd
|
|
- Restart technitium
|
|
|
|
- name: Wait for Vault-Agent to render certificates
|
|
ansible.builtin.wait_for:
|
|
path: "{{ cert_path }}"
|
|
state: present
|
|
timeout: 60
|
|
loop:
|
|
- "{{ technitium_crt_path }}"
|
|
- "{{ technitium_key_path }}"
|
|
- "{{ technitium_ca_path }}"
|
|
loop_control:
|
|
loop_var: cert_path
|
|
|
|
- name: Fix ownership and permissions for Technitium certs
|
|
ansible.builtin.file:
|
|
path: "{{ cert.path }}"
|
|
owner: vault
|
|
group: vault
|
|
mode: "{{ cert.mode }}"
|
|
loop:
|
|
- { path: "{{ technitium_crt_path }}", mode: "0644" }
|
|
- { path: "{{ technitium_key_path }}", mode: "0600" }
|
|
- { path: "{{ technitium_ca_path }}", mode: "0644" }
|
|
loop_control:
|
|
loop_var: cert
|
|
|
|
# ==========================================================
|
|
# Start and enable service
|
|
# ==========================================================
|
|
- name: Ensure Technitium DNS service is running
|
|
ansible.builtin.systemd:
|
|
name: technitium
|
|
enabled: true
|
|
state: started
|