diff options
Diffstat (limited to 'roles/network/coredns')
-rw-r--r-- | roles/network/coredns/defaults/main.yml | 5 | ||||
-rw-r--r-- | roles/network/coredns/handlers/main.yml | 5 | ||||
-rw-r--r-- | roles/network/coredns/tasks/main.yml | 40 | ||||
-rw-r--r-- | roles/network/coredns/templates/coredns.service.j2 | 32 |
4 files changed, 82 insertions, 0 deletions
diff --git a/roles/network/coredns/defaults/main.yml b/roles/network/coredns/defaults/main.yml new file mode 100644 index 00000000..b5294aa2 --- /dev/null +++ b/roles/network/coredns/defaults/main.yml @@ -0,0 +1,5 @@ +--- +# coredns_config: | +# . { +# whoami +# } diff --git a/roles/network/coredns/handlers/main.yml b/roles/network/coredns/handlers/main.yml new file mode 100644 index 00000000..13f60711 --- /dev/null +++ b/roles/network/coredns/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: reload coredns + service: + name: coredns + state: reloaded diff --git a/roles/network/coredns/tasks/main.yml b/roles/network/coredns/tasks/main.yml new file mode 100644 index 00000000..a0cfa6c5 --- /dev/null +++ b/roles/network/coredns/tasks/main.yml @@ -0,0 +1,40 @@ +--- +- name: install coredns + apt: + name: coredns + state: present + +- name: create coredns user + user: + name: coredns + home: /nonexistent + shell: /usr/sbin/nologin + create_home: no + system: yes + state: present + +- name: create coredns config directory + file: + path: /etc/coredns + state: directory + +- name: generate Corefile + copy: + content: | + # ansible managed + + {{ coredns_config }} + dest: /etc/coredns/Corefile + notify: reload coredns + +- name: install systemd service unit + template: + src: coredns.service.j2 + dest: /etc/systemd/system/coredns.service + +- name: make sure coredns is enabled started + systemd: + daemon_reload: yes + name: coredns.service + enabled: yes + state: started diff --git a/roles/network/coredns/templates/coredns.service.j2 b/roles/network/coredns/templates/coredns.service.j2 new file mode 100644 index 00000000..327f930b --- /dev/null +++ b/roles/network/coredns/templates/coredns.service.j2 @@ -0,0 +1,32 @@ +[Unit] +Description=Coredns +After=network-online.target +Wants=network-online.target + +[Service] +Restart=always +User=coredns +ExecStart=/usr/bin/coredns -conf /etc/coredns/Corefile +ExecReload=/bin/kill -USR1 $MAINPID + +# systemd hardening-options +AmbientCapabilities=CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +DeviceAllow=/dev/null rw +DevicePolicy=strict +LockPersonality=true +MemoryDenyWriteExecute=true +NoNewPrivileges=true +PrivateTmp=true +ProtectControlGroups=true +ProtectHome=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectSystem=strict +RemoveIPC=true +RestrictNamespaces=true +RestrictRealtime=true +SystemCallArchitectures=native + +[Install] +WantedBy=multi-user.target |