61 lines
1.6 KiB
Django/Jinja
61 lines
1.6 KiB
Django/Jinja
include "/etc/bind/acme.key";
|
|
|
|
options {
|
|
directory "/var/cache/bind";
|
|
|
|
listen-on port 53 { {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}; };
|
|
listen-on-v6 port 53 { {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}; };
|
|
|
|
// Authoritative DNS setting
|
|
allow-recursion { none; };
|
|
allow-transfer { none; };
|
|
allow-update { none; };
|
|
|
|
dnssec-validation no;
|
|
|
|
check-names master warn;
|
|
};
|
|
|
|
zone "{{ domain['internal'] }}." {
|
|
type primary;
|
|
file "/var/lib/bind/db.{{ domain['internal'] }}";
|
|
notify yes;
|
|
// ACME-01 challenge policy. It allows only TXT record of subdomain update.
|
|
update-policy {
|
|
grant acme-key subdomain {{ domain['internal'] }}. TXT;
|
|
};
|
|
};
|
|
|
|
zone "{{ domain['public'] }}." {
|
|
//split horizon dns
|
|
type primary;
|
|
file "/var/lib/bind/db.{{ domain['public'] }}";
|
|
notify yes;
|
|
};
|
|
|
|
{% for net, zone in network['reverse_zone']['ipv4'].items() %}
|
|
zone "{{ zone }}" {
|
|
type primary;
|
|
file "/var/lib/bind/db.{{ net }}.ipv4.rev";
|
|
notify yes;
|
|
};
|
|
{% endfor %}
|
|
|
|
{% for net, zone in network['reverse_zone']['ipv6'].items() %}
|
|
zone "{{ zone }}" {
|
|
type primary;
|
|
file "/var/lib/bind/db.{{ net }}.ipv6.rev";
|
|
notify yes;
|
|
};
|
|
{% endfor %}
|
|
|
|
logging {
|
|
channel default_log {
|
|
stderr;
|
|
severity info;
|
|
};
|
|
category default { default_log; };
|
|
category config { default_log; };
|
|
category queries { default_log; };
|
|
};
|