docs(readme): fix Ansible Galaxy badge

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/ansible-linters.yaml

@@ -12,9 +12,9 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Run ansible-lint
-      uses: ansible/ansible-lint@665d9e07a1943254d2910faffc106adaf7ea7294 # v26.8.0
+      uses: ansible/ansible-lint@9bce2bfb8f4a984e6b13767bc0d6bf0a49492164 # v26.10.1
       with:
-        args: "--config-file .ansible-lint"
+        args: "--config-file .ansible-lint.yml"
         setup_python: "true"

.gitea/workflows/markdown-linters.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/molecule.yaml

@@ -0,0 +1,28 @@
+name: Molecule
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+
+permissions:
+  contents: read
+
+jobs:
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest-amd64
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        path: bind9
+    - name: Install molecule
+      run: |
+        apt update --yes
+        apt install --yes python3-pip
+        pip3 install --break-system-packages ansible-core molecule docker
+    - name: Run molecule
+      run: molecule test
+      working-directory: bind9

.yamllint.yml

@@ -1,3 +1,5 @@
+---
+
 #
 # Documentation:
 # https://yamllint.readthedocs.io/en/stable/

README.md

@@ -1,6 +1,6 @@
 # bind9-role
 
-[![Ansible Role](https://img.shields.io/ansible/role/d/58170)](https://galaxy.ansible.com/volker_raschek/bind9)
+[![Ansible Role](https://img.shields.io/ansible/role/d/volker-raschek/bind9)](https://galaxy.ansible.com/ui/standalone/roles/volker-raschek/bind9/)
 
 With following role can be bind installed and configured.
 

defaults/main.yaml

@@ -21,7 +21,7 @@ bind9_logging:
   channels:
   - name: "security_file"
     file:
-      path: "/var/log/named/security.log"
+      path: "{{ bind9_log_directory }}/security.log"
       options: "versions 3 size 30m"
     severity: "dynamic"
     print_times: "yes"
@@ -110,6 +110,10 @@ bind9_statics:
     acls:
     - "localhost"
 
+bind9_systemd_dropin: ~
+# [Service]
+# ExecStart=
+# ExecStart={{ bind9_binary }} -f -u {{ bind9_unix_user }} -4
 
 bind9_tsigkeys: []
 # - name: "name"

handlers/main.yaml

@@ -2,6 +2,6 @@
 
 - name: Restart named
   ansible.builtin.systemd:
-    name: "{{ bind_service_name }}"
+    name: "{{ bind9_service_name }}"
     state: restarted
     daemon_reload: true

molecule/default/Dockerfile

@@ -0,0 +1,17 @@
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+
+ENV container=docker
+
+RUN if command -v pacman > /dev/null; then \
+      pacman --sync --refresh --noconfirm systemd systemd-sysvcompat python; \
+    elif command -v apt-get > /dev/null; then \
+      apt-get update && \
+      DEBIAN_FRONTEND=noninteractive apt-get install --yes systemd systemd-sysv python3 python3-apt; \
+    else \
+      dnf install --assumeyes systemd python3 python3-libdnf5 && \
+      dnf clean all; \
+    fi
+
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]

molecule/default/collections.yml

@@ -0,0 +1,4 @@
+---
+
+collections:
+- name: community.docker

molecule/default/converge.yml

@@ -0,0 +1,12 @@
+---
+
+- name: Converge
+  hosts: all
+  vars:
+    bind9_systemd_dropin: |
+      [Service]
+      Environment=MOLECULE_BIND9_DROPIN=present
+  tasks:
+  - name: Include the role bind9
+    ansible.builtin.include_role:
+      name: bind9

molecule/default/create.yml

@@ -0,0 +1,44 @@
+---
+
+- name: Create
+  hosts: localhost
+  gather_facts: false
+  tasks:
+  - name: Build systemd-enabled test images
+    community.docker.docker_image:
+      name: "bind9-molecule-{{ item.name }}:latest"
+      source: build
+      build:
+        path: "{{ molecule_scenario_directory }}"
+        args:
+          BASE_IMAGE: "{{ item.image }}"
+    loop: "{{ molecule_yml.platforms }}"
+    loop_control:
+      label: "{{ item.name }}"
+
+  - name: Start a systemd container per platform
+    community.docker.docker_container:
+      name: "{{ item.name }}"
+      image: "bind9-molecule-{{ item.name }}:latest"
+      command: /sbin/init
+      state: started
+      privileged: true
+      cgroupns_mode: host
+      tmpfs:
+      - /run
+      - /run/lock
+      volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    loop: "{{ molecule_yml.platforms }}"
+    loop_control:
+      label: "{{ item.name }}"
+
+  - name: Write the instance config
+    ansible.builtin.copy:
+      content: |
+        {% for platform in molecule_yml.platforms %}
+        - instance: {{ platform.name }}
+          connection: community.docker.docker
+        {% endfor %}
+      dest: "{{ molecule_instance_config }}"
+      mode: "0600"

molecule/default/destroy.yml

@@ -0,0 +1,27 @@
+---
+
+- name: Destroy
+  hosts: localhost
+  gather_facts: false
+  tasks:
+  - name: Remove the container of every platform
+    community.docker.docker_container:
+      name: "{{ item.name }}"
+      state: absent
+    loop: "{{ molecule_yml.platforms }}"
+    loop_control:
+      label: "{{ item.name }}"
+
+  - name: Remove the test image of every platform
+    community.docker.docker_image:
+      name: "bind9-molecule-{{ item.name }}:latest"
+      state: absent
+    loop: "{{ molecule_yml.platforms }}"
+    loop_control:
+      label: "{{ item.name }}"
+
+  - name: Empty the instance config
+    ansible.builtin.copy:
+      content: "[]"
+      dest: "{{ molecule_instance_config }}"
+      mode: "0600"

molecule/default/molecule.yml

@@ -0,0 +1,36 @@
+---
+
+driver:
+  name: default
+  options:
+    managed: true
+    login_cmd_template: "docker exec --interactive --tty {instance} bash"
+
+platforms:
+- name: bind9-archlinux
+  image: docker.io/library/archlinux:base
+- name: bind9-debian
+  image: docker.io/library/debian:13
+- name: bind9-fedora
+  image: registry.fedoraproject.org/fedora:43
+
+provisioner:
+  name: ansible
+  env:
+    ANSIBLE_ROLES_PATH: "${MOLECULE_PROJECT_DIRECTORY}/.."
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+
+scenario:
+  test_sequence:
+  - dependency
+  - cleanup
+  - destroy
+  - syntax
+  - create
+  - prepare
+  - converge
+  - verify
+  - cleanup
+  - destroy

molecule/default/prepare.yml

@@ -0,0 +1,12 @@
+---
+
+- name: Prepare
+  hosts: all
+  tasks:
+  - name: Create the parent directory for DNSSEC keys
+    ansible.builtin.file:
+      path: /var/named
+      owner: root
+      group: root
+      mode: "0755"
+      state: directory

molecule/default/requirements.yml

@@ -0,0 +1,4 @@
+---
+
+# The role has no role dependencies, but molecule warns about the missing file.
+roles: []

molecule/default/verify.yml

@@ -0,0 +1,29 @@
+---
+
+- name: Verify
+  hosts: all
+  tasks:
+  - name: Validate the generated BIND configuration
+    ansible.builtin.command:
+      argv:
+      - named-checkconf
+      - "{{ '/etc/bind/named.conf' if ansible_facts['os_family'] == 'Debian' else '/etc/named.conf' }}"
+    changed_when: false
+
+  - name: Gather service states
+    ansible.builtin.service_facts:
+
+  - name: Assert that named is active
+    ansible.builtin.assert:
+      that:
+      - ansible_facts.services['named.service'].state == 'running'
+
+  - name: Read the systemd drop-in
+    ansible.builtin.slurp:
+      src: /etc/systemd/system/named.service.d/override.conf
+    register: _bind9_systemd_dropin
+
+  - name: Assert that the configured systemd drop-in was installed
+    ansible.builtin.assert:
+      that:
+      - "'Environment=MOLECULE_BIND9_DROPIN=present' in (_bind9_systemd_dropin.content | b64decode)"

tasks/create_dnssec_files.yaml

@@ -4,8 +4,8 @@
   ansible.builtin.copy:
     dest: "{{ item.private.filename }}"
     content: "{{ item.private.content }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0600"
   no_log: true
   with_items:
@@ -16,8 +16,8 @@
   ansible.builtin.copy:
     dest: "{{ item.public.filename }}"
     content: "{{ item.public.content }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0644"
   no_log: true
   with_items:

tasks/main.yaml

@@ -17,22 +17,22 @@
   ansible.builtin.package:
     name: "{{ item }}"
     state: present
-  with_items: "{{ bind_package_names }}"
+  with_items: "{{ bind9_package_names }}"
 
 - name: Create logging directory
   ansible.builtin.file:
-    path: "{{ bind_log_directory }}"
+    path: "{{ bind9_log_directory }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0755"
     state: directory
     recurse: true
 
 - name: Create config directory
   ansible.builtin.file:
-    path: "{{ bind_config_directory }}"
+    path: "{{ bind9_config_directory }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0755"
     state: directory
     recurse: true
@@ -41,7 +41,7 @@
   block:
   - name: Find existing journal files
     ansible.builtin.find:
-      path: "{{ bind_config_directory }}"
+      path: "{{ bind9_config_directory }}"
       recurse: true
       patterns: "*.jnl"
     register: files_to_delete
@@ -55,7 +55,7 @@
   block:
   - name: Find existing signed zone files
     ansible.builtin.find:
-      path: "{{ bind_config_directory }}"
+      path: "{{ bind9_config_directory }}"
       recurse: true
       patterns: "*.signed"
     register: files_to_delete
@@ -80,8 +80,8 @@
 - name: Create DNSSEC key directory
   ansible.builtin.file:
     path: "{{ bind9_options.key_directory }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0700"
     state: directory
 
@@ -102,18 +102,18 @@
 - name: Create main configuration file
   ansible.builtin.template:
     src: "etc/named.conf.j2"
-    dest: "{{ bind_main_config }}"
+    dest: "{{ bind9_main_config }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0644"
   notify: Restart named
 
 - name: Create excluded configuration files
   ansible.builtin.template:
     src: "{{ item }}.j2"
-    dest: "{{ item | replace('etc/named', bind_config_directory) }}"
+    dest: "{{ item | replace('etc/named', bind9_config_directory) }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0644"
   with_items:
   - etc/named.conf
@@ -124,9 +124,45 @@
   - etc/named/named.conf.views
   notify: Restart named
 
+- name: Create systemd drop-in
+  when: bind9_systemd_dropin | default('', true) | length > 0
+  block:
+  - name: Create systemd drop-in directory
+    ansible.builtin.file:
+      path: "{{ bind9_systemd_dropin_dir }}"
+      owner: "root"
+      group: "root"
+      mode: "0755"
+      state: "directory"
+  - name: Template systemd drop-in
+    ansible.builtin.template:
+      src: etc/systemd/system/named.service.d/override.conf.j2
+      dest: "{{ bind9_systemd_dropin_dir }}/override.conf"
+      owner: "root"
+      group: "root"
+      mode: "0644"
+    register: _bind9_systemd_drop_in
+  - name: Systemd reload  # noqa: no-handler
+    ansible.builtin.systemd:
+      daemon_reload: true
+    when: _bind9_systemd_drop_in.changed
+
+- name: Remove systemd drop-in
+  when: bind9_systemd_dropin | default('', true) | length == 0
+  block:
+  - name: Remove systemd drop-in file
+    ansible.builtin.file:
+      path: "{{ bind9_systemd_dropin_dir }}/override.conf"
+      state: "absent"
+    register: _bind9_systemd_drop_in
+  - name: Systemd reload  # noqa: no-handler
+    ansible.builtin.systemd:
+      daemon_reload: true
+    when: _bind9_systemd_drop_in.changed
+
 - name: Start and enabled named
   ansible.builtin.systemd:
-    name: named
+    name: "{{ bind9_service_name }}"
     state: started
     enabled: true
 
@@ -134,8 +170,8 @@
   ansible.builtin.template:
     src: etc/rndc.key.j2
     dest: /etc/rndc.key
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0600"
   when: bind9_rndc_key.name | length > 0 and
         bind9_rndc_key.algorithm | length > 0 and

tasks/sign_zone_file.yaml

@@ -15,14 +15,14 @@
       _dnssec_cmd: "{{ dnssec_cmd + ['-o', zone.config.origin] }}"
   - name: "Extend dnssec command of zone file"
     ansible.builtin.set_fact:
-      _dnssec_cmd: "{{ _dnssec_cmd + [bind_config_directory + '/' + zone.file] }}"
+      _dnssec_cmd: "{{ _dnssec_cmd + [bind9_config_directory + '/' + zone.file] }}"
   - name: "Sign zone {{ zone.config.origin }}"
     ansible.builtin.command:
       argv: "{{ _dnssec_cmd }}"
-      creates: "{{ bind_config_directory + '/' + zone.file }}.signed"
+      creates: "{{ bind9_config_directory + '/' + zone.file }}.signed"
   - name: Adapt signed zone file permissions
     ansible.builtin.file:
-      path: "{{ bind_config_directory + '/' + zone.file }}.signed"
+      path: "{{ bind9_config_directory + '/' + zone.file }}.signed"
-      owner: "{{ bind_unix_user }}"
+      owner: "{{ bind9_unix_user }}"
-      group: "{{ bind_unix_group }}"
+      group: "{{ bind9_unix_group }}"
       mode: "0644"

tasks/template_zone_files.yaml

@@ -2,9 +2,9 @@
 
 - name: "Create config directory of DNS zones"
   ansible.builtin.file:
-    path: "{{ bind_config_directory }}/{{ zone.file | dirname }}"
+    path: "{{ bind9_config_directory }}/{{ zone.file | dirname }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0755"
     state: directory
   with_items:
@@ -17,9 +17,9 @@
 - name: "Template view {{ view.name }}"
   ansible.builtin.template:
     src: "{{ inventory_hostname }}/etc/named/{{ zone.file }}.j2"
-    dest: "{{ bind_config_directory + '/' + zone.file }}"
+    dest: "{{ bind9_config_directory + '/' + zone.file }}"
-    owner: "{{ bind_unix_user }}"
+    owner: "{{ bind9_unix_user }}"
-    group: "{{ bind_unix_group }}"
+    group: "{{ bind9_unix_group }}"
     mode: "0644"
   with_items:
   - "{{ view.zones }}"

tasks/verify_zone_file.yaml

@@ -2,12 +2,12 @@
 
 - name: "Read the last character of DNS zone: {{ zone.config.origin }}"
   ansible.builtin.command:
-    cmd: "tail --bytes 1 {{ bind_config_directory + '/' + zone.file }}"
+    cmd: "tail --bytes 1 {{ bind9_config_directory + '/' + zone.file }}"
   register: _bind9_zone_last_character
   changed_when: _bind9_zone_last_character.rc == 0
   failed_when: _bind9_zone_last_character.rc > 0
 
-- name: "Fail when the last character of DNS zone file is not a newline: {{ bind_config_directory + '/' + zone.file }}"
+- name: "Fail when the last character of DNS zone file is not a newline: {{ bind9_config_directory + '/' + zone.file }}"
   ansible.builtin.fail:
-    msg: "Last character of DNS zone file is not a newline: {{ bind_config_directory + '/' + zone.file }}"
+    msg: "Last character of DNS zone file is not a newline: {{ bind9_config_directory + '/' + zone.file }}"
   when: _bind9_zone_last_character.stdout != ''

templates/etc/named.conf.j2

@@ -7,8 +7,8 @@
 #   file "named.ca";
 # };
 
-include "{{ bind_config_directory }}/named.conf.acl";
+include "{{ bind9_config_directory }}/named.conf.acl";
-include "{{ bind_config_directory }}/named.conf.logging";
+include "{{ bind9_config_directory }}/named.conf.logging";
-include "{{ bind_config_directory }}/named.conf.options";
+include "{{ bind9_config_directory }}/named.conf.options";
-include "{{ bind_config_directory }}/named.conf.tsigkeys";
+include "{{ bind9_config_directory }}/named.conf.tsigkeys";
-include "{{ bind_config_directory }}/named.conf.views";
+include "{{ bind9_config_directory }}/named.conf.views";

templates/etc/named/named.conf.options.j2

@@ -184,7 +184,7 @@ options {
   # allow-update-forwarding {};
 {% endif %}
 
-  directory "{{ bind_config_directory }}";
+  directory "{{ bind9_config_directory }}";
 
   # This accepts expired signatures when verifying DNSSEC signatures. The default is no. Setting this option to yes
   # leaves named vulnerable to replay attacks.

templates/etc/named/named.conf.views.j2

@@ -148,11 +148,11 @@ view "{{ view.name }}" {
     #   contact the Master, ffor whatever reason, the zone may be left with
     #   no effective Authoritative Name Servers.
 {% if zone.file is defined and zone.file | length > 0 and not zone.file.startswith('/') %}
-    file "{{ bind_config_directory }}/{{ zone.config.file }}";
+    file "{{ bind9_config_directory }}/{{ zone.config.file }}";
 {% elif zone.file is defined and zone.file | length > 0 and zone.file.startswith('/')%}
     file "{{ zone.config.file }}";
 {% else %}
-    # file "{{ bind_config_directory }}/...";
+    # file "{{ bind9_config_directory }}/...";
 {% endif %}
 
     # This option is only meaningful if the forwarders list is not empty. A

templates/etc/systemd/system/named.service.d/override.conf.j2

@@ -0,0 +1,4 @@
+#
+# {{ ansible_managed }}
+#
+{{ bind9_systemd_dropin }}

vars/Archlinux.yaml

@@ -1,13 +1,16 @@
 ---
 
-bind_main_config: /etc/named.conf
+bind9_binary: /usr/bin/named
-bind_config_directory: /etc/named
-bind_log_directory: /var/log/named
 
-bind_package_names:
+bind9_main_config: /etc/named.conf
+bind9_config_directory: /etc/named
+bind9_log_directory: /var/log/named
+
+bind9_package_names:
 - bind
 
-bind_service_name: named
+bind9_service_name: named
+bind9_systemd_dropin_dir: "/etc/systemd/system/{{ bind9_service_name }}.service.d"
 
-bind_unix_user: named
+bind9_unix_user: named
-bind_unix_group: named
+bind9_unix_group: named

vars/Debian.yaml

@@ -1,13 +1,16 @@
 ---
 
-bind_main_config: /etc/bind/named.conf
+bind9_binary: /usr/sbin/named
-bind_config_directory: /etc/bind
-bind_log_directory: /var/log/bind
 
-bind_package_names:
+bind9_main_config: /etc/bind/named.conf
+bind9_config_directory: /etc/bind
+bind9_log_directory: /var/log/bind
+
+bind9_package_names:
 - bind9
 
-bind_service_name: named
+bind9_service_name: named
+bind9_systemd_dropin_dir: "/etc/systemd/system/{{ bind9_service_name }}.service.d"
 
-bind_unix_user: bind
+bind9_unix_user: bind
-bind_unix_group: bind
+bind9_unix_group: bind

vars/RedHat.yaml

@@ -1,14 +1,17 @@
 ---
 
-bind_main_config: /etc/named.conf
+bind9_binary: /usr/sbin/named
-bind_config_directory: /etc/named
-bind_log_directory: /var/log/named
 
-bind_package_names:
+bind9_main_config: /etc/named.conf
+bind9_config_directory: /etc/named
+bind9_log_directory: /var/log/named
+
+bind9_package_names:
 - bind
 - bind-utils # for dig and tsig-keygen and so on
 
-bind_service_name: named
+bind9_service_name: named
+bind9_systemd_dropin_dir: "/etc/systemd/system/{{ bind9_service_name }}.service.d"
 
-bind_unix_user: named
+bind9_unix_user: named
-bind_unix_group: named
+bind9_unix_group: named