add named.conf.options

diff --git a/roles/bind/handlers/main.yml b/roles/bind/handlers/main.yml
new file mode 100644 (file)
index 0000000..ed762d1
--- /dev/null
+++ b/roles/bind/handlers/main.yml
@@ -0,0 +1,2 @@
+- name: bind9
+  service: name=bind9 state=restarted enabled=yes

diff --git a/roles/bind/tasks/main.yml b/roles/bind/tasks/main.yml
index beb8ea0aa3633fb489acee194bbcb726b135abca..8fbbc6b3968640a9cc4dde76284bd66f3cb5ae7c 100644 (file)
--- a/roles/bind/tasks/main.yml
+++ b/roles/bind/tasks/main.yml
@@ -9,6 +9,11 @@
   copy:
     dest: /var/lib/bind/Makefile
     src: files/Makefile
+- name: install bind config
+  template:
+    dest: /etc/bind/named.conf.options
+    src: templates/named.conf.options
+  notify: bind9
 # dyn-nsupdate
 - name: install dyn-nsupdate build-deps
   apt: name=libboost-regex-dev,libboost-program-options-dev,cmake state=latest

diff --git a/roles/bind/templates/named.conf.options b/roles/bind/templates/named.conf.options
new file mode 100644 (file)
index 0000000..7ed35ed
--- /dev/null
+++ b/roles/bind/templates/named.conf.options
@@ -0,0 +1,27 @@
+//========================================================================
+// If BIND logs error messages about the root key being expired,
+// you will need to update your keys.  See https://www.isc.org/bind-keys
+//========================================================================
+
+options {
+       directory "/var/cache/bind";
+       key-directory "/var/lib/bind/keys";
+
+       recursion no;
+       dnssec-enable yes;
+       sig-validity-interval 14;
+
+       auth-nxdomain no;    # conform to RFC1035
+       listen-on { {{ bind.listen }}; 127.0.0.1; };
+{% if bind.listen_v6 is defined %}
+       listen-on-v6 { {{ bind.listen_v6 }}; ::1; };
+{% endif %}
+
+       // hide BIND version
+       version "unknown";
+
+       // do rate-limiting
+       rate-limit {
+               responses-per-second 15;
+       };
+};