Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
41 lines
972 B
YAML
41 lines
972 B
YAML
---
|
|
- name: Add aprsc APT repository
|
|
ansible.builtin.deb822_repository:
|
|
name: aprsc
|
|
types: [deb]
|
|
uris: http://aprsc-dist.he.fi/aprsc/apt
|
|
suites: "{{ ansible_facts['distribution_release'] }}"
|
|
components: [main]
|
|
state: present
|
|
|
|
- name: Remove legacy aprsc .list repo (superseded by deb822 .sources)
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/aprsc.list
|
|
state: absent
|
|
|
|
- name: Install aprsc
|
|
ansible.builtin.apt:
|
|
name: aprsc
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Deploy aprsc configuration
|
|
ansible.builtin.template:
|
|
src: aprsc.conf.j2
|
|
dest: "{{ aprsc_path }}/etc/aprsc.conf"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: restart aprsc
|
|
|
|
- name: Enable and start aprsc-chroot service
|
|
ansible.builtin.systemd:
|
|
name: aprsc-chroot
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Enable and start aprsc service
|
|
ansible.builtin.systemd:
|
|
name: aprsc
|
|
state: started
|
|
enabled: true
|