fix(templates): render allow-notify and correct allow-query-on statement

The zone option allow_notify was documented in defaults/main.yaml but never rendered by
named.conf.views.j2. Any allow_notify list configured for a zone was silently dropped, so
secondaries kept accepting NOTIFY messages only from the hosts listed in the masters statement.

In addition, the allow_query_on block emitted the statement name allow-query instead of
allow-query-on. This produced a second allow-query clause in the same zone and thereby
overrode the interface restriction that was actually intended.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/ansible-linters.yaml

@@ -12,9 +12,9 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Run ansible-lint
-      uses: ansible/ansible-lint@v25.7.0
+      uses: ansible/ansible-lint@665d9e07a1943254d2910faffc106adaf7ea7294 # v26.8.0
       with:
         args: "--config-file .ansible-lint"
         setup_python: "true"

.gitea/workflows/markdown-linters.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.2.2
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: DavidAnson/markdownlint-cli2-action@v20.0.0
+    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -0,0 +1,22 @@
+name: Release Ansible Role
+
+on:
+  push:
+    tags:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  release:
+    name: Release Ansible Role
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install Ansible Galaxy
+      run: |
+        apt update --yes
+        apt install --yes ansible
+    - env:
+        ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
+      name: Update Ansible Role in Ansible Galaxy
+      run: |
+        ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}

.vscode/settings.json

@@ -0,0 +1,14 @@
+{
+  "ansible.python.interpreterPath": "/bin/python",
+  "files.associations": {
+    "**/.gitea/**/*.yml": "yaml",
+    "**/.gitea/**/*.yaml": "yaml",
+    "docker-compose*.yml": "dockercompose",
+    "*.yml": "ansible",
+    "*.yaml": "ansible",
+    ".yamllint": "yaml",
+    ".yamllint.yml": "yaml",
+    ".yamllint.yaml": "yaml"
+  },
+  "rewrap.wrappingColumn": 120
+}

tasks/main.yaml

@@ -1,7 +1,17 @@
 ---
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+      - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['distribution'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}.yaml"
+      - main.yaml
+      paths:
+      - vars
 
 - name: Install bind and dependencies
   ansible.builtin.package:
@@ -76,14 +86,14 @@
     state: directory
 
 - name: Create DNSSEC files
-  ansible.builtin.include_tasks: create_dnssec_files.yml
+  ansible.builtin.include_tasks: create_dnssec_files.yaml
   with_items: "{{ bind9_dnssec_keys }}"
   no_log: true
   loop_control:
     loop_var: bind9_dnssec_key
 
 - name: Create DNS-Zone files
-  ansible.builtin.include_tasks: template_zone_files.yml
+  ansible.builtin.include_tasks: template_zone_files.yaml
   with_items:
   - "{{ bind9_views }}"
   loop_control:

tasks/template_zone_files.yaml

@@ -1,6 +1,6 @@
 ---
 
-- name: "Create config directory of DNS zone {{ zone.config.origin }}"
+- name: "Create config directory of DNS zones"
   ansible.builtin.file:
     path: "{{ bind_config_directory }}/{{ zone.file | dirname }}"
     owner: "{{ bind_unix_user }}"
@@ -29,7 +29,7 @@
   notify: Restart named
 
 - name: Check if last character in zone files is a newline
-  ansible.builtin.include_tasks: verify_zone_file.yml
+  ansible.builtin.include_tasks: verify_zone_file.yaml
   with_items:
   - "{{ view.zones }}"
   loop_control:
@@ -37,7 +37,7 @@
   when: zone.config.type == 'master'
 
 - name: Sign Zones
-  ansible.builtin.include_tasks: sign_zone_file.yml
+  ansible.builtin.include_tasks: sign_zone_file.yaml
   with_items:
   - "{{ view.zones }}"
   loop_control:

tasks/verify_zone_file.yaml

@@ -10,4 +10,4 @@
 - name: "Fail when the last character of DNS zone file is not a newline: {{ bind_config_directory + '/' + zone.file }}"
   ansible.builtin.fail:
     msg: "Last character of DNS zone file is not a newline: {{ bind_config_directory + '/' + zone.file }}"
-  failed_when: _bind9_zone_last_character.stdout | regex_search('.+') | default(false)
+  when: _bind9_zone_last_character.stdout != ''

templates/etc/named/named.conf.views.j2

@@ -15,6 +15,25 @@ view "{{ view.name }}" {
 {% for zone in view.zones %}
   zone "{{ zone.config.origin }}" {
 
+    # allow-notify applies to slave zones only and defines a match list,
+    # e.g. IP address(es), that are allowed to NOTIFY the slave in
+    # addition to those hosts defined in the masters statement. By
+    # default only the hosts of the masters statement may send NOTIFY
+    # messages.
+    #
+    # NOTE:
+    # - This statement may be used in a zone, view or a global options
+    #   clause.
+{% if zone.config.allow_notify is defined and zone.config.allow_notify | length > 0 %}
+    allow-notify {
+{% for entry in zone.config.allow_notify %}
+      {{ entry }};
+{% endfor %}
+    };
+{% else %}
+    # allow-notify {};
+{% endif %}
+
     # Hosts which are allowed to issue queries to the server. If not specified all
     # hosts are allowed to make queries (defaults to allow-query {any;};
     #
@@ -41,7 +60,7 @@ view "{{ view.name }}" {
     # - The statements may be used in a zone, view or a global options
     #   clause.
 {% if zone.config.allow_query_on is defined and zone.config.allow_query_on | length > 0 %}
-    allow-query {
+    allow-query-on {
 {% for entry in zone.config.allow_query_on %}
       {{ entry }};
 {% endfor %}