Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
38 lines
998 B
YAML
38 lines
998 B
YAML
---
|
|
# Netblocks permitted to use the resolvers (plain DNS access-control and DoH).
|
|
# Single source of truth: consumed by unbound.conf.j2 and Caddyfile-resolver.j2.
|
|
resolver_allowed_netblocks:
|
|
- 127.0.0.0/8
|
|
- 204.110.188.0/22
|
|
- 10.0.0.0/8
|
|
- 172.1.0.0/15
|
|
- 100.64.0.0/10
|
|
- 216.180.128.0/20
|
|
- ::1
|
|
- 2606:1c80::/32
|
|
|
|
# Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
|
|
# Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
|
|
resolver_blocked_domains:
|
|
- proxyjs.brdtnet.com
|
|
- proxyjs.luminatinet.com
|
|
- proxyjs.bright-sdk.com
|
|
- clientsdk.bright-sdk.com
|
|
- clientsdk.brdtnet.com
|
|
|
|
firewall_allow_rules:
|
|
- port: 53
|
|
proto: udp
|
|
comment: DNS
|
|
- port: 53
|
|
proto: tcp
|
|
comment: DNS
|
|
- port: 80
|
|
proto: tcp
|
|
comment: HTTP (Let's Encrypt HTTP-01 challenge)
|
|
- port: 443
|
|
proto: tcp
|
|
comment: HTTPS (DNS-over-HTTPS)
|
|
|
|
# Use the shared resolver Caddyfile instead of the global default.
|
|
caddy_template: Caddyfile-resolver.j2
|