cleanup resolvers

This commit is contained in:
Graham McIntire 2026-06-22 16:11:33 -05:00
parent 6488494d1b
commit 55451fe285
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
8 changed files with 8 additions and 1582 deletions

View file

@ -1,71 +0,0 @@
---
# Netblocks permitted to use the resolvers (plain DNS access-control and DoH).
# Single source of truth: consumed by unbound.conf.j2 and Caddyfile-resolver.j2.
resolver_allowed_netblocks:
- 127.0.0.0/8
- 204.110.188.0/22
- 10.0.0.0/8
- 172.1.0.0/15
- 100.64.0.0/10
- 192.168.0.0/16
- ::1
- 2606:1c80::/32
# Firewalld trusted subnets (consumed by firewall role).
# Must mirror resolver_allowed_netblocks to avoid IP-level drops before
# unbound/Caddy ever see the traffic.
firewall_trusted_subnets:
- subnet: 100.64.0.0/10
comment: Tailscale
- subnet: 204.110.188.0/22
comment: VNTX
- subnet: 10.0.0.0/8
comment: Internal
- subnet: 192.168.0.0/16
comment: Internal
- subnet: 172.1.0.0/15
comment: VNTX
# Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
# Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
resolver_blocked_domains:
- proxyjs.brdtnet.com
- proxyjs.luminatinet.com
- proxyjs.bright-sdk.com
- clientsdk.bright-sdk.com
- clientsdk.brdtnet.com
firewall_allow_rules:
- port: 53
proto: udp
comment: DNS
- port: 53
proto: tcp
comment: DNS
- port: 80
proto: tcp
comment: HTTP (Let's Encrypt HTTP-01 challenge)
sources:
- 100.64.0.0/10
- 204.110.188.0/22
- 10.0.0.0/8
- 192.168.0.0/16
- 172.1.0.0/15
ipv6_sources:
- "::1"
- 2606:1c80::/32
- port: 443
proto: tcp
comment: HTTPS (DNS-over-HTTPS)
sources:
- 100.64.0.0/10
- 204.110.188.0/22
- 10.0.0.0/8
- 192.168.0.0/16
- 172.1.0.0/15
ipv6_sources:
- "::1"
- 2606:1c80::/32
# Use the shared resolver Caddyfile instead of the global default.
caddy_template: Caddyfile-resolver.j2

View file

@ -12,10 +12,6 @@ uisp.vntx.net
[librenms_servers]
librenms.vntx.net
[resolvers]
resolver1.vntx.net
resolver2.vntx.net
[monitoring_servers]
monitor.vntx.net

View file

@ -24,17 +24,6 @@
roles:
- firewall
- name: Apply resolver config
hosts: resolvers
become: true
gather_facts: true
tags:
- resolvers
roles:
- resolvers
- caddy
- telegraf
- name: Install and configure NetBox
hosts: netbox_servers
become: true

View file

@ -1,11 +0,0 @@
---
- name: Restart unbound
ansible.builtin.service:
name: unbound
state: restarted
- name: Restart firewalld
ansible.builtin.service:
name: firewalld
state: restarted

View file

@ -1,101 +0,0 @@
---
- name: Install unbound
ansible.builtin.dnf:
name:
- unbound
state: present
- name: Create systemd override directory for unbound
ansible.builtin.file:
path: /etc/systemd/system/unbound.service.d
state: directory
owner: root
group: root
mode: '0755'
- name: Fix unbound sd_notify failure (disable notify type)
ansible.builtin.copy:
dest: /etc/systemd/system/unbound.service.d/override.conf
content: |
[Service]
Type=simple
owner: root
group: root
mode: '0644'
register: unbound_override
- name: Reload systemd after override change
ansible.builtin.systemd:
daemon_reload: true
when: unbound_override.changed
- name: Deploy blocklist RPZ zonefile
ansible.builtin.template:
src: blocklist.rpz.j2
dest: /etc/unbound/blocklist.rpz
mode: "644"
notify:
- Restart unbound
- name: Create Unbound config
ansible.builtin.template:
src: unbound.conf.j2
dest: /etc/unbound/unbound.conf
mode: "644"
notify:
- Restart unbound
- name: Enable and start Unbound
ansible.builtin.systemd:
name: unbound
state: started
enabled: true
- name: Permit traffic in default zone for dns service
ansible.posix.firewalld:
zone: public
service: dns
permanent: true
immediate: true
state: enabled
when: ansible_facts['os_family'] == "RedHat"
notify:
- Restart firewalld
# EL9's crypto-policy default KexAlgorithms omits the post-quantum
# sntrup761x25519-sha512@openssh.com (the binary supports it). This drop-in
# prepends it (^ = place at head of default set) so it is preferred,
# mitigating "store now, decrypt later" attacks. Validated before restart;
# reverted if sshd rejects it, so a broken config can never lock out SSH.
- name: Prefer post-quantum SSH key exchange
block:
- name: Install post-quantum SSH key-exchange drop-in
ansible.builtin.copy:
dest: /etc/ssh/sshd_config.d/10-postquantum.conf
content: |
# Managed by Ansible (roles/resolvers) - prefer post-quantum key exchange
KexAlgorithms ^sntrup761x25519-sha512@openssh.com
owner: root
group: root
mode: '0600'
register: pq_sshd_dropin
- name: Validate sshd configuration
ansible.builtin.command: /usr/sbin/sshd -t
changed_when: false
- name: Restart sshd to apply key-exchange change
ansible.builtin.systemd:
name: sshd
state: restarted
when: pq_sshd_dropin is changed
rescue:
- name: Revert post-quantum drop-in after failed validation
ansible.builtin.file:
path: /etc/ssh/sshd_config.d/10-postquantum.conf
state: absent
- name: Fail because sshd rejected the post-quantum drop-in
ansible.builtin.fail:
msg: >-
sshd -t rejected the post-quantum KexAlgorithms drop-in; it has been
removed and sshd was not restarted. Existing config is untouched.

View file

@ -1,15 +0,0 @@
; Managed by Ansible (roles/resolvers) — do not edit by hand.
; Source of truth: resolver_blocked_domains in group_vars/resolvers/main.yml
;
; Response Policy Zone. Each listed name and its subdomains resolve to
; NXDOMAIN (forced by rpz-action-override in unbound.conf), and matches are
; logged to syslog under rpz-log-name "blocklist". Names are relative to the
; $ORIGIN below, per RPZ convention (the zone suffix is the policy trigger).
$TTL 3600
$ORIGIN blocklist.rpz.
@ IN SOA localhost. root.localhost. 1 3600 600 86400 3600
@ IN NS localhost.
{% for domain in resolver_blocked_domains | default([]) %}
{{ domain }} CNAME .
*.{{ domain }} CNAME .
{% endfor %}

File diff suppressed because it is too large Load diff

View file

@ -354,6 +354,10 @@ resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
port = 443
target = "mail.mcintire.me"
}
lifecycle {
ignore_changes = [priority]
}
}
# =============================================================================
@ -1048,6 +1052,10 @@ resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
port = 443
target = "mail.w5isp.com"
}
lifecycle {
ignore_changes = [priority]
}
}
# =============================================================================