feat: support DNSSEC

tasks/create_dnssec_files.yml

@@ -0,0 +1,25 @@
+---
+
+- name: "Create private DNSSEC: {{ bind9_dnssec_key.origin }}"
+  ansible.builtin.copy:
+    dest: "{{ item.private.filename }}"
+    content: "{{ item.private.content }}"
+    owner: "{{ bind_unix_user }}"
+    group: "{{ bind_unix_group }}"
+    mode: "0600"
+  no_log: true
+  with_items:
+  - "{{ bind9_dnssec_key.key_signing_key }}"
+  - "{{ bind9_dnssec_key.zone_signing_key }}"
+
+- name: "Create public DNSSEC: {{ bind9_dnssec_key.origin }}"
+  ansible.builtin.copy:
+    dest: "{{ item.public.filename }}"
+    content: "{{ item.public.content }}"
+    owner: "{{ bind_unix_user }}"
+    group: "{{ bind_unix_group }}"
+    mode: "0644"
+  no_log: true
+  with_items:
+  - "{{ bind9_dnssec_key.key_signing_key }}"
+  - "{{ bind9_dnssec_key.zone_signing_key }}"

tasks/main.yml

@@ -41,6 +41,47 @@
       state: absent
     with_items: "{{ files_to_delete.files }}"
 
+- name: Remove existing signed zone files
+  block:
+  - name: Find existing signed zone files
+    ansible.builtin.find:
+      path: "{{ bind_config_directory }}"
+      recurse: true
+      patterns: "*.signed"
+    register: files_to_delete
+  - name: Delete existing signed zone files
+    ansible.builtin.file:
+      path: "{{ item.path }}"
+      state: absent
+    with_items: "{{ files_to_delete.files }}"
+
+- name: Remove existing DNSSEC key directory
+  block:
+  - name: Check if DNSSEC key directory exists
+    ansible.builtin.stat:
+      path: "{{ bind9_options.key_directory }}"
+    register: _stat_bind9_options_key_directory
+  - name: Remove DNSSEC key directory
+    ansible.builtin.file:
+      path: "{{ bind9_options.key_directory }}"
+      state: "absent"
+    when: _stat_bind9_options_key_directory.stat.exists
+
+- name: Create DNSSEC key directory
+  ansible.builtin.file:
+    path: "{{ bind9_options.key_directory }}"
+    owner: "{{ bind_unix_user }}"
+    group: "{{ bind_unix_group }}"
+    mode: "0700"
+    state: directory
+
+- name: Create DNSSEC files
+  ansible.builtin.include_tasks: create_dnssec_files.yml
+  with_items: "{{ bind9_dnssec_keys }}"
+  no_log: true
+  loop_control:
+    loop_var: bind9_dnssec_key
+
 - name: Create DNS-Zone files
   ansible.builtin.include_tasks: template_zone_files.yml
   with_items:

tasks/sign_zone_file.yml

@@ -0,0 +1,28 @@
+---
+
+- name: "Sign DNS Zone {{ zone.config.origin }}"
+  vars:
+    dnssec_cmd:
+    - dnssec-signzone
+    - -N
+    - INCREMENT
+    - -S
+    - -K
+    - "{{ bind9_options.key_directory }}"
+  block:
+  - name: "Extend dnssec command of ORIGIN"
+    ansible.builtin.set_fact:
+      _dnssec_cmd: "{{ dnssec_cmd + ['-o', zone.config.origin] }}"
+  - name: "Extend dnssec command of zone file"
+    ansible.builtin.set_fact:
+      _dnssec_cmd: "{{ _dnssec_cmd + [bind_config_directory + '/' + zone.file] }}"
+  - name: "Sign zone {{ zone.config.origin }}"
+    ansible.builtin.command:
+      argv: "{{ _dnssec_cmd }}"
+      creates: "{{ bind_config_directory + '/' + zone.file }}.signed"
+  - name: Adapt signed zone file permissions
+    ansible.builtin.file:
+      path: "{{ bind_config_directory + '/' + zone.file }}.signed"
+      owner: "{{ bind_unix_user }}"
+      group: "{{ bind_unix_group }}"
+      mode: "0644"

tasks/template_zone_files.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: "Create directory for zone {{ zone.file | dirname }}"
+- name: "Create config directory of DNS zone {{ zone.config.origin }}"
   ansible.builtin.file:
     path: "{{ bind_config_directory }}/{{ zone.file | dirname }}"
     owner: "{{ bind_unix_user }}"
@@ -11,7 +11,8 @@
   - "{{ view.zones }}"
   loop_control:
     loop_var: zone
-  when: zone.file is defined and zone.file | length > 0
+  when: zone.file is defined and
+        zone.file | length > 0
 
 - name: "Template view {{ view.name }}"
   ansible.builtin.template:
@@ -24,7 +25,7 @@
   - "{{ view.zones }}"
   loop_control:
     loop_var: zone
-  when: zone.type == 'master'
+  when: zone.config.type == 'master'
   notify: Restart named
 
 - name: Check if last character in zone files is a newline
@@ -33,4 +34,15 @@
   - "{{ view.zones }}"
   loop_control:
     loop_var: zone
-  when: zone.type == 'master'
+  when: zone.config.type == 'master'
+
+- name: Sign Zones
+  ansible.builtin.include_tasks: sign_zone_file.yml
+  with_items:
+  - "{{ view.zones }}"
+  loop_control:
+    loop_var: zone
+  when: zone.config.type == 'master' and
+        bind9_dnssec_keys | selectattr('origin', 'in', zone.config.origin) | map(attribute='zone_signing_key') | length > 0 and
+        (bind9_dnssec_keys | selectattr('origin', 'in', zone.config.origin) | map(attribute='zone_signing_key'))[0].private | length > 0 and
+        (bind9_dnssec_keys | selectattr('origin', 'in', zone.config.origin) | map(attribute='zone_signing_key'))[0].public  | length > 0

tasks/verify_zone_file.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: "Read the last character of DNS Zonefile: {{ bind_config_directory + '/' + zone.file }}"
+- name: "Read the last character of DNS zone: {{ zone.config.origin }}"
   ansible.builtin.command:
     cmd: "tail --bytes 1 {{ bind_config_directory + '/' + zone.file }}"
   register: _bind9_zone_last_character