Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
44 lines
No EOL
1.1 KiB
YAML
44 lines
No EOL
1.1 KiB
YAML
---
|
|
- name: Install misc Debian packages
|
|
ansible.builtin.import_tasks: debian/misc.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- misc
|
|
|
|
- name: Configure MOTD
|
|
ansible.builtin.import_tasks: debian/motd.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- motd
|
|
|
|
- name: Configure networking
|
|
ansible.builtin.import_tasks: debian/network.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- network
|
|
|
|
- name: Apply UDP GRO fix for Tailscale
|
|
ansible.builtin.import_tasks: udp-gro-fix.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- network
|
|
- tailscale
|
|
|
|
- name: Install K3s packages
|
|
ansible.builtin.import_tasks: debian/k3s.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- k3s
|
|
|
|
- name: Uninstall Icinga2 on non-monitor hosts
|
|
ansible.builtin.import_tasks: debian/icinga2.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- icinga2
|
|
- monitoring
|
|
|
|
- name: Configure NFS mounts
|
|
ansible.builtin.import_tasks: debian/nfs.yml
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags:
|
|
- nfs |