Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
15 lines
670 B
Django/Jinja
15 lines
670 B
Django/Jinja
; Managed by Ansible (roles/resolvers) — do not edit by hand.
|
|
; Source of truth: resolver_blocked_domains in group_vars/resolvers/main.yml
|
|
;
|
|
; Response Policy Zone. Each listed name and its subdomains resolve to
|
|
; NXDOMAIN (forced by rpz-action-override in unbound.conf), and matches are
|
|
; logged to syslog under rpz-log-name "blocklist". Names are relative to the
|
|
; $ORIGIN below, per RPZ convention (the zone suffix is the policy trigger).
|
|
$TTL 3600
|
|
$ORIGIN blocklist.rpz.
|
|
@ IN SOA localhost. root.localhost. 1 3600 600 86400 3600
|
|
@ IN NS localhost.
|
|
{% for domain in resolver_blocked_domains | default([]) %}
|
|
{{ domain }} CNAME .
|
|
*.{{ domain }} CNAME .
|
|
{% endfor %}
|