cleanup resolvers
This commit is contained in:
parent
6488494d1b
commit
55451fe285
8 changed files with 8 additions and 1582 deletions
|
|
@ -1,71 +0,0 @@
|
|||
---
|
||||
# Netblocks permitted to use the resolvers (plain DNS access-control and DoH).
|
||||
# Single source of truth: consumed by unbound.conf.j2 and Caddyfile-resolver.j2.
|
||||
resolver_allowed_netblocks:
|
||||
- 127.0.0.0/8
|
||||
- 204.110.188.0/22
|
||||
- 10.0.0.0/8
|
||||
- 172.1.0.0/15
|
||||
- 100.64.0.0/10
|
||||
- 192.168.0.0/16
|
||||
- ::1
|
||||
- 2606:1c80::/32
|
||||
|
||||
# Firewalld trusted subnets (consumed by firewall role).
|
||||
# Must mirror resolver_allowed_netblocks to avoid IP-level drops before
|
||||
# unbound/Caddy ever see the traffic.
|
||||
firewall_trusted_subnets:
|
||||
- subnet: 100.64.0.0/10
|
||||
comment: Tailscale
|
||||
- subnet: 204.110.188.0/22
|
||||
comment: VNTX
|
||||
- subnet: 10.0.0.0/8
|
||||
comment: Internal
|
||||
- subnet: 192.168.0.0/16
|
||||
comment: Internal
|
||||
- subnet: 172.1.0.0/15
|
||||
comment: VNTX
|
||||
|
||||
# Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
|
||||
# Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
|
||||
resolver_blocked_domains:
|
||||
- proxyjs.brdtnet.com
|
||||
- proxyjs.luminatinet.com
|
||||
- proxyjs.bright-sdk.com
|
||||
- clientsdk.bright-sdk.com
|
||||
- clientsdk.brdtnet.com
|
||||
|
||||
firewall_allow_rules:
|
||||
- port: 53
|
||||
proto: udp
|
||||
comment: DNS
|
||||
- port: 53
|
||||
proto: tcp
|
||||
comment: DNS
|
||||
- port: 80
|
||||
proto: tcp
|
||||
comment: HTTP (Let's Encrypt HTTP-01 challenge)
|
||||
sources:
|
||||
- 100.64.0.0/10
|
||||
- 204.110.188.0/22
|
||||
- 10.0.0.0/8
|
||||
- 192.168.0.0/16
|
||||
- 172.1.0.0/15
|
||||
ipv6_sources:
|
||||
- "::1"
|
||||
- 2606:1c80::/32
|
||||
- port: 443
|
||||
proto: tcp
|
||||
comment: HTTPS (DNS-over-HTTPS)
|
||||
sources:
|
||||
- 100.64.0.0/10
|
||||
- 204.110.188.0/22
|
||||
- 10.0.0.0/8
|
||||
- 192.168.0.0/16
|
||||
- 172.1.0.0/15
|
||||
ipv6_sources:
|
||||
- "::1"
|
||||
- 2606:1c80::/32
|
||||
|
||||
# Use the shared resolver Caddyfile instead of the global default.
|
||||
caddy_template: Caddyfile-resolver.j2
|
||||
|
|
@ -12,10 +12,6 @@ uisp.vntx.net
|
|||
[librenms_servers]
|
||||
librenms.vntx.net
|
||||
|
||||
[resolvers]
|
||||
resolver1.vntx.net
|
||||
resolver2.vntx.net
|
||||
|
||||
[monitoring_servers]
|
||||
monitor.vntx.net
|
||||
|
||||
|
|
|
|||
|
|
@ -24,17 +24,6 @@
|
|||
roles:
|
||||
- firewall
|
||||
|
||||
- name: Apply resolver config
|
||||
hosts: resolvers
|
||||
become: true
|
||||
gather_facts: true
|
||||
tags:
|
||||
- resolvers
|
||||
roles:
|
||||
- resolvers
|
||||
- caddy
|
||||
- telegraf
|
||||
|
||||
- name: Install and configure NetBox
|
||||
hosts: netbox_servers
|
||||
become: true
|
||||
|
|
|
|||
|
|
@ -1,11 +0,0 @@
|
|||
---
|
||||
- name: Restart unbound
|
||||
ansible.builtin.service:
|
||||
name: unbound
|
||||
state: restarted
|
||||
|
||||
- name: Restart firewalld
|
||||
ansible.builtin.service:
|
||||
name: firewalld
|
||||
state: restarted
|
||||
|
||||
|
|
@ -1,101 +0,0 @@
|
|||
---
|
||||
- name: Install unbound
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- unbound
|
||||
state: present
|
||||
|
||||
- name: Create systemd override directory for unbound
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/unbound.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Fix unbound sd_notify failure (disable notify type)
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/unbound.service.d/override.conf
|
||||
content: |
|
||||
[Service]
|
||||
Type=simple
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
register: unbound_override
|
||||
|
||||
- name: Reload systemd after override change
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
when: unbound_override.changed
|
||||
|
||||
- name: Deploy blocklist RPZ zonefile
|
||||
ansible.builtin.template:
|
||||
src: blocklist.rpz.j2
|
||||
dest: /etc/unbound/blocklist.rpz
|
||||
mode: "644"
|
||||
notify:
|
||||
- Restart unbound
|
||||
|
||||
- name: Create Unbound config
|
||||
ansible.builtin.template:
|
||||
src: unbound.conf.j2
|
||||
dest: /etc/unbound/unbound.conf
|
||||
mode: "644"
|
||||
notify:
|
||||
- Restart unbound
|
||||
|
||||
- name: Enable and start Unbound
|
||||
ansible.builtin.systemd:
|
||||
name: unbound
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Permit traffic in default zone for dns service
|
||||
ansible.posix.firewalld:
|
||||
zone: public
|
||||
service: dns
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
when: ansible_facts['os_family'] == "RedHat"
|
||||
notify:
|
||||
- Restart firewalld
|
||||
|
||||
# EL9's crypto-policy default KexAlgorithms omits the post-quantum
|
||||
# sntrup761x25519-sha512@openssh.com (the binary supports it). This drop-in
|
||||
# prepends it (^ = place at head of default set) so it is preferred,
|
||||
# mitigating "store now, decrypt later" attacks. Validated before restart;
|
||||
# reverted if sshd rejects it, so a broken config can never lock out SSH.
|
||||
- name: Prefer post-quantum SSH key exchange
|
||||
block:
|
||||
- name: Install post-quantum SSH key-exchange drop-in
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/ssh/sshd_config.d/10-postquantum.conf
|
||||
content: |
|
||||
# Managed by Ansible (roles/resolvers) - prefer post-quantum key exchange
|
||||
KexAlgorithms ^sntrup761x25519-sha512@openssh.com
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
register: pq_sshd_dropin
|
||||
|
||||
- name: Validate sshd configuration
|
||||
ansible.builtin.command: /usr/sbin/sshd -t
|
||||
changed_when: false
|
||||
|
||||
- name: Restart sshd to apply key-exchange change
|
||||
ansible.builtin.systemd:
|
||||
name: sshd
|
||||
state: restarted
|
||||
when: pq_sshd_dropin is changed
|
||||
rescue:
|
||||
- name: Revert post-quantum drop-in after failed validation
|
||||
ansible.builtin.file:
|
||||
path: /etc/ssh/sshd_config.d/10-postquantum.conf
|
||||
state: absent
|
||||
- name: Fail because sshd rejected the post-quantum drop-in
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
sshd -t rejected the post-quantum KexAlgorithms drop-in; it has been
|
||||
removed and sshd was not restarted. Existing config is untouched.
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
; Managed by Ansible (roles/resolvers) — do not edit by hand.
|
||||
; Source of truth: resolver_blocked_domains in group_vars/resolvers/main.yml
|
||||
;
|
||||
; Response Policy Zone. Each listed name and its subdomains resolve to
|
||||
; NXDOMAIN (forced by rpz-action-override in unbound.conf), and matches are
|
||||
; logged to syslog under rpz-log-name "blocklist". Names are relative to the
|
||||
; $ORIGIN below, per RPZ convention (the zone suffix is the policy trigger).
|
||||
$TTL 3600
|
||||
$ORIGIN blocklist.rpz.
|
||||
@ IN SOA localhost. root.localhost. 1 3600 600 86400 3600
|
||||
@ IN NS localhost.
|
||||
{% for domain in resolver_blocked_domains | default([]) %}
|
||||
{{ domain }} CNAME .
|
||||
*.{{ domain }} CNAME .
|
||||
{% endfor %}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -354,6 +354,10 @@ resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
|
|||
port = 443
|
||||
target = "mail.mcintire.me"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [priority]
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -1048,6 +1052,10 @@ resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
|
|||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [priority]
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue