Main configuration
Some of the debops.bind
default variables have more extensive configuration
than simple strings or lists, here you can find documentation and examples for
them.
Features
The bind__features
variable control which BIND features should be
enabled. Valid values are (case-sensitive):
dns
- Regular DNS service (not including this feature is likely to lead to a broken configuration).dnssec
- DNSSEC signed zones.dot
- DNS over TLS.doh_https
- DNS over HTTPS.doh_http
- DNS over HTTP.doh_proxy
- DNS using a web server as a proxy frontend.status_proxy
- Provide server statistics over a proxy frontend.
The various features (except dns
) are explained in the
DNSSEC and DNS over TLS/HTTP(S) sections.
These features are used to provide reasonable defaults in the various configuration templates.
Variables
The bind__*_configuration
variables are used to create the main
configuration file /etc/bind/named.conf
. In the default configuration,
the zones, keys, etc defined in the separate bind__*_zones
(see
Zones and Views) and bind__*_keys
(see Keys)
variables will be inserted into the generated configuration at the appropriate
places using autovalue
parameters (described below in the
Syntax section).
Examples
For a detailed example which makes use of all of the features offered by
the syntax, see the bind__default_configuration
.
Enable the use of forwarders
(default nameservers which queries are
forwarded to in case the local installation of BIND doesn't know the answer,
such as an upstream ISP nameserver or one of the public nameservers operated
by companies such as Cloudflare, Google, etc):
bind__configuration:
- name: 'options'
options:
- name: 'forwarders'
state: 'present'
options:
- name: 'forwarder-1'
raw: '8.8.8.8'
This will result in a configuration file along the lines of:
options {
...
forwarders {
1.1.1.1;
}
...
}
Change the lifetime of the KSK in the "kskzsk-rollover" policy:
bind_configuration:
- name 'dnssec-policy-kskzsk-rollover'
options:
- name: 'keys'
options:
- name: 'ksk'
comment: 'Original: key-directory lifetime 365d algorithm ecdsap256sha256'
value: 'key-directory lifetime 6m algorithm ecdsap256sha256'
Syntax
Configuration options are defined using a list of YAML dictionaries, each dictionary uses specific parameters, most of which follow well-known Universal Configuration patterns:
name
Required, string. Name of a given option. Multiple configuration options with the same
name
are merged together. If theoption
parameter is specified, it will be used rather thanname
as the configuration option name.option
Optional, string. This can be used to override the default configuration option name (i.e.
name
). This is useful when the same option needs to appear more than once in the configuration (in which case each instance can have the sameoption
value, but a differentname
).comment
Optional, string. A comment for the option which will be included in the generated configuration for documentation purposes.
state
Optional, string. If not specified or
present
, a given option will be present in the generated configuration. Ifabsent
,init
orignore
, the option will not be present in the generated configuration. Ifcomment
, the option will be present, but commented out (that also carries over to sub-configuration options defined inoptions
).raw
Optional, string. If defined, this parameter will be included verbatim in the generated configuration, ignoring
name
,option
,options
, andvalue
.separator
Optional, boolean. If
True
, an extra blank line will be inserted before the option in the configuration file for increased readability.value
Optional, string. The value of the option to be included in the generated configuration file.
autovalue
Optional, string. Instead of a verbatim configuration
value
, the role templates can generate automatic values.Currently supported autovalues are:
keys
Will generate a list of keys defined using the
bind__*_keys
variables (see Keys).zones
Will generate and include configuration for all views/and zones defined using the
bind__*_zones
andbind__*_generic_zones
variables (see Zones and Views).zone_file_path
The absolute path to the zone file for a given zone. This generally only makes sense in the
bind__*_zones
variables (see Zone syntax).
options
Optional, list of YAML dicts. This can be used to define a number of sub-options. The YAML dicts of sub-options follow the same syntax as defined in this section and can be used to create the nested configuration hierarchy used in the
/etc/bind/named.conf
syntax.