nsd

NSD Authoritative DNS Server

By default NSD will listen on 127.0.0.1 and assumes that unbound or a similar recursive resolver or a proxy like dnscurve is on the same host sending it requests.

Both forward and reverse zones can be specified.

Note: Previous revisions of this role allowed for a single forward definition and inferred the reverse zone, but this does not work well with multiple RFC1918 subnets defined.

Requirements

Minimum ansible version: 2.9.5

Defaults

See the dns_forward_zones and dns_reverse_zones structures:

dns_forward_zones:
  example.com:
    ip_range: 192.168.1.1/24
    ns:
      - gw.example.com.
    a:
      gw: 192.168.1.1
      host1: 192.168.1.2
      host2: 192.168.1.3
      printer: 192.168.1.4
    cname:
      lpr: printer.example.com.
    srv: {}
    txt: {}

dns_reverse_zones:
  192.168.0.0/16:
    ns:
      - gw.example.com.
    ptr:
      192.168.1.1: gw.example.com.
      192.168.1.2: host1.example.com.
      192.168.1.3: host2.example.com.
      192.168.1.4: printer1.example.com.

Note: In the molecule tests, <zone>.serial is used for the zonefile serial, and is set to a static value to guarantee idempotency. In production, this must be changed every time the zonefile changes, or can be omitted and the current timestamp is used to generate the serial. Other DNS roles tried complicated solutions <https://github.com/bertvv/ansible-role-bind/blob/master/templates/bind_zone.j2>_ to guarantee the serial changes, but that seems like a lot of trouble, and is only useful for facilitating zone transfers which are silly/antiquated/security-problematic.

Example Playbook

- hosts: all
  roles:
    - nsd

License and Author

License: Apache-2.0