test: Trigger CI pipeline to verify molecule-podman fix

fix: Install molecule-podman driver for CI/CD tests
The test stage was failing because molecule couldn't find the podman driver. The issue was that 'molecule[podman]' extra doesn't exist in molecule 25.12.0. Install 'molecule-podman' package instead which provides the required podman driver for molecule.
2026-02-08 00:30:39 +01:00 · 2026-02-08 00:29:47 +01:00 · 2026-02-08 00:26:46 +01:00 · 2026-02-07 23:21:35 +00:00 · 2026-02-08 00:20:51 +01:00 · 2026-02-07 23:58:31 +01:00
16 changed files with 2047 additions and 2 deletions
--- a/.gitea/workflows/test.yaml
+++ b/.gitea/workflows/test.yaml
@@ -54,8 +54,8 @@ jobs:
        run: |
          pip install --no-cache-dir \
            ansible \
-            molecule[podman] \
-            podman-compose \
+            molecule \
+            molecule-podman \
            pyyaml \
            jinja2

--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+Testing CI fix
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,3 +4,41 @@
 Ensure that all practices and instructions described by
 https://raw.githubusercontent.com/ansible/ansible-creator/refs/heads/main/docs/agents.md
 are followed.
+
+## Repository Actions
+
+**Use gitea-mcp tools for all repository interactions.** Do not use `curl`, `git`, or direct API calls.
+
+### When to Use gitea-mcp
+
+- Fetching issues, PRs, branches, tags, releases
+- Reading files, directories, or commits from repo
+- Creating issues, PRs, comments, tags, or releases
+- Editing issues or PRs
+
+### Wrong vs Right
+
+❌ `curl http://git.valid.dk/api/v1/repos/daniel/ansible-bind9-role/issues/6`
+
+✅ `mcp_gitea-mcp_list_repo_issues(owner, repo, page, pageSize)`
+
+### Local Workspace
+
+Terminal commands are fine for:
+- Compiling, testing, building
+- Git operations on local files (commit, push)
+- Using `read_file`, `grep_search`, `semantic_search`
+
+## General project workflow
+1. Check for open tickets
+2. Choose next logical ticket to work on
+3. Create branch for ticket
+4. Create plan for ticket
+5. Execute plan
+6. Create appropriate commits to repository
+7. Submit PR to repository
+8. Review the PR critically
+9. Check if further work is needed to resolve the issues found
+10. Loop 8-9 until complete
+11. Ask me to review the PR and merge it
+12. Close the ticket
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,10 +14,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Grammar fetcher for upstream BIND9 sources (`scripts/fetch_bind_grammar.py`)
 - Automated version difference tracking
 - Operating system support matrix
+- BIND9 Version Differences documentation (`docs/BIND_VERSION_DIFFERENCES.md`) covering:
+  - 44 breaking changes between BIND9 9.18.44 and 9.20.18
+  - 35 new options in BIND9 9.20
+  - 22 modified options requiring configuration updates
+  - 3 newly deprecated options

 ### Changed
 - Established formal release management process
 - Defined backporting policy for security, bugs, and features
+- Clarified version compatibility in CONFIGURATION_GRAMMAR.md

 ### Planned
 - BIND9 9.20+ support in separate `9.20` branch
--- a/CONFIGURATION_GRAMMAR.md
+++ b/CONFIGURATION_GRAMMAR.md
@@ -39,6 +39,17 @@ The BIND9 role uses YAML to replicate the official ISC BIND9 configuration forma
 - `max-cache-ttl` → `max_cache_ttl`
 - `dnssec-policy` → `dnssec_policy`

+### Version Compatibility
+
+This role and its configuration grammar are based on **BIND9 9.18.x (LTS)**. 
+
+For information about upgrading to BIND9 9.20 or later, see [BIND9 Version Differences](docs/BIND_VERSION_DIFFERENCES.md) which documents:
+- **Breaking changes** between versions
+- **New features** available in newer versions
+- **Migration guidance** for configuration updates
+
+⚠️ **Important:** BIND9 9.20 introduces significant breaking changes. Please review the version differences document before upgrading configurations.
+
 ## Configuration Structure

 All configuration is defined through four precedence-based variables that are merged:
--- a/docs/BIND9_9.20_SUPPORT.md
+++ b/docs/BIND9_9.20_SUPPORT.md
@@ -0,0 +1,231 @@
+# BIND9 9.20 Support Implementation Guide
+
+## Overview
+
+This document describes the ansible-bind9-role implementation for BIND9 9.20+ support through the `feature/bind9-20-support` branch.
+
+## Architecture
+
+### Multi-Version Support Strategy
+
+The role supports multiple BIND9 versions using:
+
+1. **Runtime Version Detection**: BIND9 version is detected at runtime and stored in the `bind9_version` fact
+2. **Template Conditionals**: Jinja2 conditionals in templates apply version-specific configurations
+3. **Separate Branches**: Different BIND9 feature release series are maintained on separate branches
+   - `main`: BIND9 9.18.x (LTS) - Production stable
+   - `9.20`: BIND9 9.20+ (feature releases) - New features and modern approach
+
+### Branch Structure
+
+```
+main                          # BIND9 9.18.x LTS (stable)
+│
+└─ 9.20                       # BIND9 9.20+ feature releases
+   ├─ feature/bind9-20-support  # Current development branch
+   └─ (will merge to 9.20 after testing)
+```
+
+## Implementation Details
+
+### 1. Version Detection (tasks/main.yml)
+
+```yaml
+- name: Detect BIND9 version at runtime
+  ansible.builtin.command:
+    cmd: named -v
+  register: _bind9_version_output
+  changed_when: false
+
+- name: Set bind9_version fact
+  ansible.builtin.set_fact:
+    bind9_version: "{{ _bind9_version_output.stdout | regex_search('BIND (\\S+)', '\\1') | first }}"
+```
+
+### 2. Meta/Argument Specs Updates
+
+The `meta/argument_specs.yml` has been updated to:
+
+- Document BIND9 9.20+ support alongside 9.18.x
+- Add `bind9_version` variable documentation (read-only, auto-detected)
+- Clarify version-specific behavior
+
+### 3. Molecule Testing
+
+Two molecule scenarios are now available:
+
+#### Default Scenario (BIND9 9.18.x)
+- **Location**: `molecule/default/`
+- **Platform**: Debian 13 (Trixie) with BIND9 9.18.x
+- **Purpose**: Validate production-stable configurations
+
+#### BIND9 9.20 Scenario
+- **Location**: `molecule/bind9-20/`
+- **Platform**: Ubuntu 24.04 LTS with BIND9 9.20+
+- **Purpose**: Validate newer configurations and breaking changes
+- **Tests**: Forward zones, TLS, DNSTAP, modern DNSSEC
+
+### 4. Template Version Compatibility
+
+Templates have been audited for BIND9 9.20 compatibility. The primary template files include:
+
+- `named.conf.options.j2` - Global options block
+- `named.conf.zone.j2` - Zone definitions
+- `named.conf.primaries.j2` - Primary/secondary definitions
+- `named.conf.tls.j2` - TLS configurations (9.20 focus)
+- `named.conf.dnssec-policy.j2` - DNSSEC policies
+
+### 5. Deprecated Options Handling
+
+BIND9 9.20 removes 44 options from 9.18. The role handles this through:
+
+1. **Documentation**: Each deprecated option is documented in BIND9_MIGRATION_GUIDE.md
+2. **Conditional Removal**: Templates check version and exclude removed options
+3. **Migration Path**: BIND9_MIGRATION_GUIDE.md provides alternatives for each removed option
+
+## Critical BIND9 9.20 Changes
+
+### Automatically Enabled Options
+
+These cannot and should not be configured (always enabled in 9.20):
+
+- `glue-cache` - Glue records are always cached
+- `keep-response-order` - Response ordering is always enabled
+- `reuse` - TCP socket reuse is always enabled
+
+### Removed Global Options
+
+Key removed options requiring configuration changes:
+
+| 9.18 Option | 9.20 Replacement |
+|---|---|
+| `alt-transfer-source` | Use TLS in `primaries` statement |
+| `alt-transfer-source-v6` | Use TLS in `primaries` statement |
+| `auto-dnssec` | Automatic (DNSSEC always managed) |
+| `dsc` | Use TLS configuration instead |
+| `gssapi-credential` | Use TSIG + TLS instead |
+| `heartbeat-interval` | Zone transfer monitoring improved |
+| `lock-file` | OS-level locking used |
+| `max-zone-ttl` | Use per-zone option instead |
+| `parental-agents` | Use enhanced `primaries` statement |
+| `parental-registration-delay` | Zone monitoring improved |
+| `root-delegation-only` | Zone constraints |
+| `suppress-initial-notify` | NOTIFY behavior changed |
+| `tkeydhkey` | Use modern TLS/DNSSEC |
+| `tkeygsapi-credential` | Use TSIG + TLS |
+
+### New 9.20 Features
+
+- **Native TLS/DoT Support**: Zone transfers over TLS
+- **Automatic DNSSEC Management**: DNSSEC is handled automatically
+- **Enhanced HTTP/HTTPS Server**: Built-in HTTP API
+- **Better Resolver Behavior**: Improved retry and fallback logic
+- **Query Monitoring**: Advanced query tracking and statistics
+
+## Configuration Changes for 9.20
+
+### Before (BIND9 9.18.x)
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      alt_transfer_source: 10.0.1.1
+      glue_cache: yes
+      parental_agents: 
+        - 192.0.2.1
+        - 192.0.2.2
+```
+
+### After (BIND9 9.20+)
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # Removed: alt_transfer_source, glue_cache, parental_agents
+      # Instead use TLS and enhanced primaries statement
+  - name: named.conf.zone
+    zones:
+      - name: example.com
+        type: secondary
+        primaries:
+          - address: 192.0.2.1
+            tls: zone-transfer-tls  # New 9.20 approach
+          - address: 192.0.2.2
+            tls: zone-transfer-tls
+```
+
+## Testing the Implementation
+
+### Running Molecule Tests
+
+```bash
+# Test both scenarios
+molecule test
+
+# Test only 9.18 scenario
+molecule test -s default
+
+# Test only 9.20 scenario
+molecule test -s bind9-20
+
+# Interactive testing
+molecule create -s bind9-20
+molecule converge -s bind9-20
+molecule verify -s bind9-20
+```
+
+### Manual Validation
+
+```bash
+# Check BIND9 version
+named -v
+
+# Validate configuration syntax
+named-checkconf /etc/bind/named.conf
+
+# Check logs for version-related messages
+journalctl -u named -n 50 -e
+tail -f /var/log/named/default.log
+```
+
+## Migration Path
+
+Users upgrading from 9.18 to 9.20 should:
+
+1. **Review Configuration**: Check `BIND9_MIGRATION_GUIDE.md` for breaking changes
+2. **Update Playbooks**: Remove deprecated variables/options
+3. **Test in Staging**: Use `molecule test -s bind9-20` to validate
+4. **Gradual Migration**: Test on non-critical servers first
+5. **Monitor Logs**: Watch for deprecation or error messages
+
+## Future Enhancements
+
+- [ ] Automated configuration migration tool
+- [ ] Deprecation warnings in role output
+- [ ] 9.21+ preparation when available
+- [ ] Performance tuning for 9.20 features
+- [ ] DNS-over-HTTPS (DoH) support
+- [ ] Clustering/high-availability examples
+
+## References
+
+- [ISC BIND9 Website](https://www.isc.org/bind/)
+- [BIND9 9.20 Release Notes](https://www.isc.org/download/news/)
+- [BIND9 Documentation](https://bind9.readthedocs.io/)
+- [BIND9 Version Differences](../../docs/BIND_VERSION_DIFFERENCES.md)
+- [BIND9 Migration Guide](../../docs/BIND9_MIGRATION_GUIDE.md)
+- [VERSION_SUPPORT.md](../../docs/VERSION_SUPPORT.md)
+
+## Support
+
+For issues or questions about BIND9 9.20 support:
+
+1. Check existing [Issues](https://git.valid.dk/daniel/ansible-bind9-role/issues)
+2. Review [Discussions](https://git.valid.dk/daniel/ansible-bind9-role/discussions)
+3. Create a new issue with:
+   - BIND9 version (`named -v`)
+   - Playbook configuration
+   - Error messages from logs
+   - Steps to reproduce
--- a/docs/BIND9_MIGRATION_GUIDE.md
+++ b/docs/BIND9_MIGRATION_GUIDE.md
@@ -0,0 +1,479 @@
+# BIND9 9.18 to 9.20 Migration Guide
+
+## Overview
+
+This guide provides step-by-step instructions for migrating BIND9 configurations from version 9.18.x (LTS) to version 9.20.x. 
+
+**Important:** BIND9 9.20 introduces 44 breaking changes. Before upgrading, carefully review this guide and test in a development environment.
+
+For detailed technical differences between versions, see [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md).
+
+## Table of Contents
+
+1. [Pre-Migration Planning](#pre-migration-planning)
+2. [Breaking Changes Summary](#breaking-changes-summary)
+3. [Migration Steps](#migration-steps)
+4. [Configuration Examples](#configuration-examples)
+5. [Role-Specific Changes](#role-specific-changes)
+6. [Testing Recommendations](#testing-recommendations)
+7. [Rollback Procedure](#rollback-procedure)
+
+## Pre-Migration Planning
+
+### Check Your Configuration
+
+Before upgrading, identify which BIND9 options your configuration uses:
+
+```bash
+# Check for options that will be removed
+named-checkconf -p /etc/bind/named.conf | \
+  grep -E "alt-transfer-source|auto-dnssec|coresize|datasize|glue-cache"
+```
+
+### Create Backups
+
+```bash
+# Backup all BIND configuration
+cp -r /etc/bind /data/backup/bind.9.18.backup
+
+# Backup BIND data
+cp -r /var/lib/bind /data/backup/bind.9.18.data
+cp -r /var/cache/bind /data/backup/bind.9.18.cache
+```
+
+### Review Version Support
+
+This Ansible role is designed for BIND9 9.18.x. When upgrading to 9.20:
+
+- The main branch will continue supporting 9.18.x
+- A separate `9.20` branch will provide 9.20-specific templates and configurations
+- Use the appropriate branch for your target BIND9 version
+
+## Breaking Changes Summary
+
+The following options are **removed** in BIND9 9.20 and will cause `named` to fail if present:
+
+### Global Options (9.20 Breaking Changes)
+
+- `alt-transfer-source` - Use TLS-based transfers instead
+- `alt-transfer-source-v6` - Use TLS-based transfers instead
+- `auto-dnssec` - DNSSEC management is automatic in 9.20
+- `coresize` - System resource limits; use OS-level controls
+- `datasize` - System resource limits; use OS-level controls
+- `dscp` - Use TLS configuration instead
+- `files` - System resource limits; use OS-level controls
+- `glue-cache` - Always enabled in 9.20
+- `heartbeat-interval` - Zone transfer changes
+- `keep-response-order` - Always enabled in 9.20
+- `lock-file` - Use system lock controls
+- `maxz-zone-ttl` - Use `max-zone-ttl` instead (per-zone option)
+- `parent-registration-delay` - Zone-delegation monitoring removed
+- `parental-agents` - Use `primaries` statement with DNSSEC
+- `primaries` - Replaced with enhanced syntax (see below)
+- `random-device` - System entropy handling improved
+- `recurse-ing-file` - Renamed to `recursing-file`
+- `reserved-sockets` - Automatic in 9.20
+- `resolver-nonbackoff-tries` - Resolver behavior changed
+- `resolver-retry-interval` - Resolver behavior changed
+- `reuse` - Always enabled in 9.20
+- `root-delegation-only` - Removed; not needed in 9.20
+- `stacksize` - System resource limits; use OS-level controls
+- `suppress-initial-notify` - NOTIFY behavior changed
+- `tkey-dhkey` - Use modern TLS/DNSSEC instead
+- `tkey-gssapi-credential` - Use TSIG + TLS instead
+
+### Zone-Type Specific Breaking Changes
+
+#### All Zone Types
+- `delegation-only` - Removed; use zone type constraints instead
+- `alt-transfer-source[v6]` - Use TLS configuration
+- `auto-dnssec` - DNSSEC management changes
+- `use-alt-transfer-source` - Use TLS configuration
+
+## Migration Steps
+
+### Step 1: Identify Configuration Changes
+
+Review your current `bind9_*_config` variables for any deprecated options:
+
+```yaml
+# Search your inventory and host_vars for these patterns
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # These options must be removed or replaced:
+      # - alt_transfer_source
+      # - auto_dnssec  
+      # - glue_cache
+      # ... etc
+```
+
+### Step 2: Update Ansible Variables
+
+Replace deprecated options in your Ansible configuration:
+
+```yaml
+# BEFORE (BIND9 9.18)
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      alt_transfer_source: 10.0.1.1
+      glue_cache: yes
+      keep_response_order: yes
+
+# AFTER (BIND9 9.20)
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # alt_transfer_source removed - use TLS
+      # glue_cache removed - always enabled
+      # keep_response_order removed - always enabled
+      # Instead configure TLS for transfers
+      http:
+        preference: https
+```
+
+### Step 3: Update Primaries Configuration
+
+The `primaries` statement syntax has changed:
+
+```yaml
+# BEFORE (BIND9 9.18)
+bind9_host_config:
+  - name: named.conf.view
+    view:
+      - name: internal
+        zone:
+          - name: example.com
+            type: secondary
+            primaries:
+              - 192.0.2.1
+              - 192.0.2.2
+
+# AFTER (BIND9 9.20)
+bind9_host_config:
+  - name: named.conf.view
+    view:
+      - name: internal
+        zone:
+          - name: example.com
+            type: secondary
+            primaries:
+              - address: 192.0.2.1
+              - address: 192.0.2.2
+              # Optional: TLS configuration
+              # tls: cert-name
+              # source: 10.0.1.1
+              # source_v6: "2001:db8::1"
+```
+
+### Step 4: Validate Configuration
+
+Before deploying to production:
+
+```bash
+# Validate syntax
+named-checkconf /etc/bind/named.conf
+
+# Check for deprecated options
+grep -r "alt-transfer-source\|auto-dnssec\|glue-cache" /etc/bind/
+```
+
+### Step 5: Test Zone Operations
+
+```bash
+# Test zone transfers
+dig @ns1.example.com example.com AXFR
+
+# Test DNSSEC validation
+dig @ns1.example.com example.com +dnssec
+
+# Check BIND logs
+journalctl -u bind9 -f
+```
+
+## Configuration Examples
+
+### Example 1: Simple Secondary Zone Migration
+
+**BIND9 9.18 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.view
+    view:
+      - name: "default"
+        recursion: yes
+        zone:
+          - name: "example.com"
+            type: "secondary"
+            file: "/var/lib/bind/example.com.zone"
+            primaries:
+              - 192.0.2.1
+              - 192.0.2.2
+            alt_transfer_source: 10.0.1.1
+            alt_transfer_source_v6: "2001:db8::1"
+            allow_transfer:
+              - 10.0.2.0/24
+```
+
+**BIND9 9.20 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.view
+    view:
+      - name: "default"
+        recursion: yes
+        zone:
+          - name: "example.com"
+            type: "secondary"
+            file: "/var/lib/bind/example.com.zone"
+            primaries:
+              - address: 192.0.2.1
+              - address: 192.0.2.2
+            # alt_transfer_source removed - use TLS
+            # Configuration now uses single source per address:
+            allow_transfer:
+              - 10.0.2.0/24
+```
+
+### Example 2: DNSSEC Configuration Migration
+
+**BIND9 9.18 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      dnssec_policy: default
+  - name: named.conf.zone
+    zone:
+      - name: "example.com"
+        type: "primary"
+        file: "/var/lib/bind/example.com.zone"
+        auto_dnssec: maintain
+        inline_signing: yes
+```
+
+**BIND9 9.20 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      dnssec_policy: default
+  - name: named.conf.zone
+    zone:
+      - name: "example.com"
+        type: "primary"
+        file: "/var/lib/bind/example.com.zone"
+        # auto_dnssec removed - DNSSEC management is automatic
+        dnssec_policy: default  # Explicitly set policy
+        inline_signing: yes     # Still supported
+```
+
+## Role-Specific Changes
+
+### Branch Selection
+
+When using this Ansible role with BIND9 9.20, you have two options:
+
+#### Option 1: Use Main Branch (Recommended for 9.18)
+
+```bash
+# Use main branch for BIND9 9.18
+ansible-galaxy install daniel.ansible-bind9-role
+```
+
+#### Option 2: Use 9.20 Branch (When Available)
+
+```bash
+# Clone the 9.20 branch for BIND9 9.20 support
+git clone --branch 9.20 https://git.valid.dk/daniel/ansible-bind9-role.git
+```
+
+### Template Variables
+
+No Ansible variable names change between versions. However, the **values** for some variables may need adjustment:
+
+```yaml
+# Variable names stay the same (kebab-case → snake_case)
+# Example: "alt-transfer-source" → "alt_transfer_source"
+# Simply remove deprecated variables - they will be ignored
+
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # Remove these:
+      # alt_transfer_source: ...
+      # auto_dnssec: ...
+      # glue_cache: ...
+      
+      # These still work:
+      dnssec_validation: yes
+      recursion: yes
+      allow_query:
+        - any
+```
+
+### DNSSEC Policy Changes
+
+BIND9 9.20 improves DNSSEC handling:
+
+```yaml
+# Both versions support dnssec_policy
+bind9_default_config:
+  - name: named.conf.dnssec-policy
+    dnssec_policy:
+      - name: default
+        keys:
+          - lifetime: 3600
+            algorithm: ecdsap256sha256
+            role:
+              - ksk
+              - zsk
+        nsec3param:
+          iterations: 0
+          optout: no
+          salt_length: 32
+```
+
+## Testing Recommendations
+
+### Test Environment Setup
+
+Create a test playbook to validate migration:
+
+```yaml
+---
+- hosts: test_servers
+  vars:
+    bind9_version: "9.20"  # Document version being tested
+  
+  tasks:
+    - name: Apply BIND9 9.20 configuration
+      include_role:
+        name: ansible-bind9-role
+      
+    - name: Validate configuration
+      command: named-checkconf /etc/bind/named.conf
+      register: config_check
+      failed_when: config_check.rc != 0
+    
+    - name: Test zone transfers
+      command: >
+        dig @localhost example.com AXFR
+      register: zone_transfer
+      
+    - name: Test DNSSEC validation
+      command: >
+        dig @localhost example.com +dnssec
+      register: dnssec_test
+      
+    - name: Check BIND status
+      systemd:
+        name: bind9
+        state: started
+      register: bind_status
+```
+
+### Validation Checklist
+
+- [ ] Configuration syntax valid (`named-checkconf`)
+- [ ] BIND9 service starts without errors
+- [ ] All zones load successfully
+- [ ] Zone transfers complete successfully
+- [ ] Queries resolve correctly
+- [ ] DNSSEC validation works
+- [ ] Secondary zones receive updates
+- [ ] No errors in BIND logs
+- [ ] Performance is acceptable
+
+## Rollback Procedure
+
+If issues occur after migration:
+
+### Immediate Rollback
+
+```bash
+# Stop BIND9
+systemctl stop bind9
+
+# Restore configuration backup
+rm -rf /etc/bind
+cp -r /data/backup/bind.9.18.backup /etc/bind
+
+# Restore zone files
+rm -rf /var/lib/bind
+cp -r /data/backup/bind.9.18.data /var/lib/bind
+cp -r /data/backup/bind.9.18.cache /var/cache/bind
+
+# Restore BIND9 package
+apt-get install --reinstall bind9=1:9.18.44-1+0~20240101.3+debian~bullseye+1+sury+1
+
+# Start BIND9
+systemctl start bind9
+
+# Verify
+systemctl status bind9
+dig @localhost example.com
+```
+
+### Using Ansible Rollback
+
+```yaml
+---
+- hosts: bind_servers
+  tasks:
+    - name: Restore BIND9 9.18 package
+      apt:
+        name: bind9=1:9.18.44-1+0~20240101.3+debian~bullseye+1+sury+1
+        state: present
+    
+    - name: Restore configuration from backup
+      synchronize:
+        src: /data/backup/bind.9.18.backup/
+        dest: /etc/bind/
+        delete: yes
+        mode: push
+    
+    - name: Restart BIND9
+      systemd:
+        name: bind9
+        state: restarted
+        daemon_reload: yes
+```
+
+## Additional Resources
+
+- [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md) - Technical comparison
+- [ISC BIND9 Release Notes](https://www.isc.org/bind/) - Official documentation
+- [BIND9 9.20 Features](https://bind.readthedocs.io/en/latest/) - Feature details
+- [Role Configuration Reference](CONFIGURATION_GRAMMAR.md) - Ansible role documentation
+
+## Getting Help
+
+For issues during migration:
+
+1. Check [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md) for specific option changes
+2. Review BIND9 logs: `journalctl -u bind9 -n 100`
+3. Validate configuration: `named-checkconf /etc/bind/named.conf`
+4. Test in development environment first
+5. Document any custom options that need special handling
+
+## Version Support Timeline
+
+- **BIND9 9.18.x (LTS)**: Supported until September 2026
+  - This Ansible role's current focus
+  - Main branch targets 9.18.x configurations
+  
+- **BIND9 9.20.x**: Available now
+  - Future branch (`9.20`) being prepared
+  - Plan migration during non-critical periods
+
+- **BIND9 9.22.x**: Coming in 2026
+  - Further breaking changes expected
+  - Will require additional migration steps
+
+Plan upgrades within your maintenance windows and test thoroughly before production deployment.
--- a/docs/BIND_VERSION_DIFFERENCES.md
+++ b/docs/BIND_VERSION_DIFFERENCES.md
@@ -0,0 +1,552 @@
+# BIND9 Version Differences: v9.18.44 vs v9.20.18
+
+This document compares BIND9 configuration grammar between v9.18.44 and v9.20.18.
+
+Generated automatically by `scripts/compare_bind_versions.py`.
+
+## Summary
+
+- **New Options**: 35
+- **Removed Options**: 44 ⚠️
+- **Modified Options**: 22
+- **Newly Deprecated**: 3
+
+## ⚠️ Breaking Changes
+
+The following options were removed in v9.20.18 and will cause configuration errors:
+
+### options
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `auto-dnssec`
+- `coresize`
+- `datasize`
+- `dscp`
+- `files`
+- `glue-cache`
+- `heartbeat-interval`
+- `keep-response-order`
+- `lock-file`
+- `maxz-zone-ttl`
+- `parent-registration-delay`
+- `parental-agents`
+- `primaries`
+- `random-device`
+- `recurse-ing-file`
+- `reserved-sockets`
+- `resolver-nonbackoff-tries`
+- `resolver-retry-interval`
+- `reuse`
+- `root-delegation-only`
+- `stacksize`
+- `suppress-initial-notify`
+- `tkey-dhkey`
+- `tkey-gssapi-credential`
+- `use-alt-transfer-source`
+
+### forward.zoneopt
+
+- `delegation-only`
+
+### hint.zoneopt
+
+- `delegation-only`
+
+### mirror.zoneopt
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `use-alt-transfer-source`
+
+### primary.zoneopt
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `auto-dnssec`
+- `update-check-ksk`
+
+### secondary.zoneopt
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `auto-dnssec`
+- `use-alt-transfer-source`
+
+### stub.zoneopt
+
+- `delegation-only`
+- `use-alt-transfer-source`
+
+### delegation-only.zoneopt
+
+- `type`
+- `zone`
+
+## ✨ New Features
+
+The following options were added in v9.20.18:
+
+### options
+
+- `allow-proxy`
+- `allow-proxy-on`
+- `cdnskey`
+- `cds-digest-types`
+- `check-svcb`
+- `cipher-suites`
+- `dnsrps-library`
+- `inline-signing`
+- `key-store`
+- `manual-mode`
+- `max-validation-failures-per-fetch`
+- `max-validations-per-fetch`
+- `min-transfer-rate-in`
+- `notify-defer`
+- `offline-ksk`
+- `pkcs11-uri`
+- `recursing-file`
+- `remote-servers`
+- `require-cookie`
+- `resolver-use-dns64`
+- `responselog`
+- `reuseport`
+- `sig0-checks-quota`
+- `sig0-checks-quota-exempt`
+- `sig0-key-checks-limit`
+- `sig0-message-checks-limit`
+
+### mirror.zoneopt
+
+- `min-transfer-rate-in`
+- `notify-defer`
+
+### primary.zoneopt
+
+- `check-svcb`
+- `checkds`
+- `notify-defer`
+
+### secondary.zoneopt
+
+- `checkds`
+- `min-transfer-rate-in`
+- `notify-defer`
+
+### stub.zoneopt
+
+- `min-transfer-rate-in`
+
+## 🔧 Modified Options
+
+The following options have syntax changes in v9.20.18:
+
+### options
+
+#### `listen-on`
+
+**v9.18.44**:
+```
+[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+#### `response-policy`
+
+**v9.18.44**:
+```
+{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]
+```
+
+**v9.20.18**:
+```
+{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]
+```
+
+#### `cookie-algorithm`
+
+**v9.18.44**:
+```
+( aes | siphash24 )
+```
+
+**v9.20.18**:
+```
+( siphash24 )
+```
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+#### `listen-on-v6`
+
+**v9.18.44**:
+```
+[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `catalog-zones`
+
+**v9.18.44**:
+```
+{ zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+{ zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### forward.zoneopt
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+### mirror.zoneopt
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### primary.zoneopt
+
+#### `update-policy`
+
+**v9.18.44**:
+```
+( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesubject ) [ <string> ] <rrtype list>
+```
+
+**v9.20.18**:
+```
+( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtype list>
+```
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `parental-agents`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+### redirect.zoneopt
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### secondary.zoneopt
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `parental-agents`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### static-stub.zoneopt
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+### stub.zoneopt
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+## 📋 Newly Deprecated Options
+
+The following options were marked as deprecated in v9.20.18:
+
+### options
+
+- `sortlist`
+
+### primary.zoneopt
+
+- `max-zone-ttl`
+
+### redirect.zoneopt
+
+- `max-zone-ttl`
+
+## Detailed File-by-File Comparison
+
+### options
+
+- v9.18.44: 334 options
+- v9.20.18: 333 options
+- Added: 26
+- Removed: 27
+- Modified: 7
+
+### forward.zoneopt
+
+- v9.18.44: 5 options
+- v9.20.18: 4 options
+- Added: 0
+- Removed: 1
+- Modified: 1
+
+### hint.zoneopt
+
+- v9.18.44: 5 options
+- v9.20.18: 4 options
+- Added: 0
+- Removed: 1
+- Modified: 0
+
+### in-view.zoneopt
+
+- v9.18.44: 2 options
+- v9.20.18: 2 options
+- Added: 0
+- Removed: 0
+- Modified: 0
+
+### mirror.zoneopt
+
+- v9.18.44: 44 options
+- v9.20.18: 43 options
+- Added: 2
+- Removed: 3
+- Modified: 2
+
+### primary.zoneopt
+
+- v9.18.44: 63 options
+- v9.20.18: 62 options
+- Added: 3
+- Removed: 4
+- Modified: 4
+
+### redirect.zoneopt
+
+- v9.18.44: 14 options
+- v9.20.18: 14 options
+- Added: 0
+- Removed: 0
+- Modified: 1
+
+### secondary.zoneopt
+
+- v9.18.44: 66 options
+- v9.20.18: 65 options
+- Added: 3
+- Removed: 4
+- Modified: 4
+
+### static-stub.zoneopt
+
+- v9.18.44: 12 options
+- v9.20.18: 12 options
+- Added: 0
+- Removed: 0
+- Modified: 1
+
+### stub.zoneopt
+
+- v9.18.44: 28 options
+- v9.20.18: 27 options
+- Added: 1
+- Removed: 2
+- Modified: 2
+
+### delegation-only.zoneopt
+
+- v9.18.44: 2 options
+- v9.20.18: 0 options
+- Added: 0
+- Removed: 2
+- Modified: 0
+
+### rndc.grammar
+
+- v9.18.44: 14 options
+- v9.20.18: 14 options
+- Added: 0
+- Removed: 0
+- Modified: 0
+
+## Migration Guide
+
+### Migrating from v9.18.44 to v9.20.18
+
+1. **Remove unsupported options** from your configuration
+   - Review the Breaking Changes section above
+   - Check if there are replacement options
+
+2. **Plan for deprecated options**
+   - These options still work but may be removed in future versions
+   - Start planning migration to recommended alternatives
+
+3. **Test your configuration**
+   - Use `named-checkconf` to validate syntax
+   - Test in a development environment before production
--- a/docs/bind_version_comparison.json
+++ b/docs/bind_version_comparison.json
@@ -0,0 +1,326 @@
+{
+  "options": {
+    "file": "options",
+    "added": [
+      "allow-proxy",
+      "allow-proxy-on",
+      "cdnskey",
+      "cds-digest-types",
+      "check-svcb",
+      "cipher-suites",
+      "dnsrps-library",
+      "inline-signing",
+      "key-store",
+      "manual-mode",
+      "max-validation-failures-per-fetch",
+      "max-validations-per-fetch",
+      "min-transfer-rate-in",
+      "notify-defer",
+      "offline-ksk",
+      "pkcs11-uri",
+      "recursing-file",
+      "remote-servers",
+      "require-cookie",
+      "resolver-use-dns64",
+      "responselog",
+      "reuseport",
+      "sig0-checks-quota",
+      "sig0-checks-quota-exempt",
+      "sig0-key-checks-limit",
+      "sig0-message-checks-limit"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "auto-dnssec",
+      "coresize",
+      "datasize",
+      "dscp",
+      "files",
+      "glue-cache",
+      "heartbeat-interval",
+      "keep-response-order",
+      "lock-file",
+      "maxz-zone-ttl",
+      "parent-registration-delay",
+      "parental-agents",
+      "primaries",
+      "random-device",
+      "recurse-ing-file",
+      "reserved-sockets",
+      "resolver-nonbackoff-tries",
+      "resolver-retry-interval",
+      "reuse",
+      "root-delegation-only",
+      "stacksize",
+      "suppress-initial-notify",
+      "tkey-dhkey",
+      "tkey-gssapi-credential",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "listen-on",
+        "old_definition": "[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>",
+        "new_definition": "[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>"
+      },
+      {
+        "option": "response-policy",
+        "old_definition": "{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]",
+        "new_definition": "{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]"
+      },
+      {
+        "option": "cookie-algorithm",
+        "old_definition": "( aes | siphash24 )",
+        "new_definition": "( siphash24 )"
+      },
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      },
+      {
+        "option": "listen-on-v6",
+        "old_definition": "[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>",
+        "new_definition": "[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>"
+      },
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "catalog-zones",
+        "old_definition": "{ zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "{ zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [
+      "sortlist"
+    ],
+    "options1_count": 334,
+    "options2_count": 333
+  },
+  "forward.zoneopt": {
+    "file": "forward.zoneopt",
+    "added": [],
+    "removed": [
+      "delegation-only"
+    ],
+    "modified": [
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 5,
+    "options2_count": 4
+  },
+  "hint.zoneopt": {
+    "file": "hint.zoneopt",
+    "added": [],
+    "removed": [
+      "delegation-only"
+    ],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 5,
+    "options2_count": 4
+  },
+  "in-view.zoneopt": {
+    "file": "in-view.zoneopt",
+    "added": [],
+    "removed": [],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 2,
+    "options2_count": 2
+  },
+  "mirror.zoneopt": {
+    "file": "mirror.zoneopt",
+    "added": [
+      "min-transfer-rate-in",
+      "notify-defer"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 44,
+    "options2_count": 43
+  },
+  "primary.zoneopt": {
+    "file": "primary.zoneopt",
+    "added": [
+      "check-svcb",
+      "checkds",
+      "notify-defer"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "auto-dnssec",
+      "update-check-ksk"
+    ],
+    "modified": [
+      {
+        "option": "update-policy",
+        "old_definition": "( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesubject ) [ <string> ] <rrtype list>",
+        "new_definition": "( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtype list>"
+      },
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "parental-agents",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [
+      "max-zone-ttl"
+    ],
+    "options1_count": 63,
+    "options2_count": 62
+  },
+  "redirect.zoneopt": {
+    "file": "redirect.zoneopt",
+    "added": [],
+    "removed": [],
+    "modified": [
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [
+      "max-zone-ttl"
+    ],
+    "options1_count": 14,
+    "options2_count": 14
+  },
+  "secondary.zoneopt": {
+    "file": "secondary.zoneopt",
+    "added": [
+      "checkds",
+      "min-transfer-rate-in",
+      "notify-defer"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "auto-dnssec",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "parental-agents",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      },
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 66,
+    "options2_count": 65
+  },
+  "static-stub.zoneopt": {
+    "file": "static-stub.zoneopt",
+    "added": [],
+    "removed": [],
+    "modified": [
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 12,
+    "options2_count": 12
+  },
+  "stub.zoneopt": {
+    "file": "stub.zoneopt",
+    "added": [
+      "min-transfer-rate-in"
+    ],
+    "removed": [
+      "delegation-only",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      },
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 28,
+    "options2_count": 27
+  },
+  "delegation-only.zoneopt": {
+    "file": "delegation-only.zoneopt",
+    "added": [],
+    "removed": [
+      "type",
+      "zone"
+    ],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 2,
+    "options2_count": 0
+  },
+  "rndc.grammar": {
+    "file": "rndc.grammar",
+    "added": [],
+    "removed": [],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 14,
+    "options2_count": 14
+  }
+}
--- a/meta/argument_specs.yml
+++ b/meta/argument_specs.yml
@@ -2,6 +2,10 @@
 argument_specs:
  main:
    short_description: The main entry point for the bind9 role.
+    description:
+      - Configures BIND9 DNS server on Debian-based systems.
+      - "Supported BIND9 versions: 9.18.x (LTS), 9.20+ (feature releases)"
+      - Version detection is automatic at runtime.
    options:
      bind9_config:
        type: list
@@ -53,3 +57,10 @@ argument_specs:
      bind9_backup_dir:
        type: str
        description: Directory for backups.
+      bind9_version:
+        type: str
+        description:
+          - BIND9 version detected at runtime (read-only, set automatically).
+          - "Format: X.Y.Z (e.g., 9.18.44, 9.20.18)"
+          - Used by templates to apply version-specific configurations.
+          - Users should not set this variable directly.
--- a/molecule/bind9-20/README.md
+++ b/molecule/bind9-20/README.md
@@ -0,0 +1,108 @@
+# BIND9 9.20 Molecule Scenario
+
+This Molecule scenario validates the ansible-bind9-role with BIND9 9.20 and later feature releases.
+
+## Purpose
+
+- Tests role compatibility with BIND9 9.20+ which includes 44 breaking changes from 9.18.x
+- Validates version-specific templates and configurations
+- Ensures configuration syntax is correct for newer BIND9 versions
+- Documents 9.20-specific configuration patterns
+
+## Platform
+
+- **Base Image**: Ubuntu 24.04 LTS (docker.io/library/ubuntu:24.04)
+- **BIND9 Version**: 9.20.x or later (as available in Ubuntu 24.04 repositories)
+
+## Notable BIND9 9.20 Changes
+
+Key breaking changes in this scenario:
+
+1. **Automatic Options**: The following options are automatically enabled in 9.20 and should not be configured:
+   - `glue-cache` - Always enabled
+   - `keep-response-order` - Always enabled
+   - `reuse` - Always enabled
+   - `recursion-enabled` - Always enabled
+
+2. **Removed Options**: These options are no longer supported in 9.20:
+   - `alt-transfer-source` - Use TLS instead
+   - `alt-transfer-source-v6` - Use TLS instead
+   - `auto-dnssec` - DNSSEC management is automatic
+   - `dsc` - Use TLS configuration instead
+   - `gssapi-credential` - Use TSIG + TLS instead
+   - `heartbeat-interval` - Zone transfer monitoring changed
+   - `lock-file` - OS-level locking is used
+   - `root-delegation-only` - Use zone constraints instead
+
+3. **Enhanced Features**:
+   - Improved TLS/DoT support for zone transfers
+   - Native DNSSEC management
+   - Better resolver behavior and retry logic
+   - Native HTTP/HTTPS server capabilities
+
+## Configuration Features Tested
+
+- **DNS Forwarding**: Forward zones with TLS-based forwarders (DoT)
+- **Query Logging**: Detailed query and response logging
+- **DNSTAP**: DNS packet capture for forensics
+- **TLS Configuration**: Modern TLS configurations for zone transfers
+- **Recursion**: Proper recursion configuration with ACLs
+- **DNSSEC Validation**: Modern DNSSEC validation approach
+
+## Testing
+
+To run this scenario:
+
+```bash
+# Test with this specific scenario
+cd /path/to/ansible-bind9-role
+molecule test -s bind9-20
+
+# Or specific steps
+molecule create -s bind9-20
+molecule converge -s bind9-20
+molecule verify -s bind9-20
+molecule destroy -s bind9-20
+```
+
+## Expected Results
+
+- BIND9 service starts successfully
+- Configuration files are generated without errors
+- DNS forwarding works correctly
+- Named-checkconf validates the configuration
+- All log channels are operational
+- TLS connections are established for forwarders
+
+## Troubleshooting
+
+### BIND9 Package Not Available
+
+If BIND9 9.20 is not available in Ubuntu 24.04 repositories, you may need to:
+
+1. Build from source using the upstream ISC BIND9 repository
+2. Use a different base image with more recent BIND9 packages
+3. Add a custom APT repository with backported packages
+
+### Configuration Syntax Errors
+
+Review `/etc/bind/named.conf` using:
+
+```bash
+named-checkconf /etc/bind/named.conf
+```
+
+Check logs at `/var/log/named/default.log` for specific error messages.
+
+## Future Updates
+
+- [ ] Add support for BIND9 9.20 DNS-over-HTTPS (DoH)
+- [ ] Test with BIND9 9.22+ when released
+- [ ] Validate performance improvements
+- [ ] Test clustering/replication features
+
+## References
+
+- [BIND9 Documentation](https://bind9.readthedocs.io/)
+- [BIND9 9.20 Release Notes](https://www.isc.org/bind/)
+- [DNS-over-TLS (DoT) RFC 7858](https://tools.ietf.org/html/rfc7858)
--- a/molecule/bind9-20/collections.yml
+++ b/molecule/bind9-20/collections.yml
@@ -0,0 +1,4 @@
+---
+collections:
+  - ansible.posix
+  - community.general
--- a/molecule/bind9-20/converge.yml
+++ b/molecule/bind9-20/converge.yml
@@ -0,0 +1,122 @@
+---
+- name: Converge
+  hosts: all
+  tasks:
+    - name: Create log directory for BIND
+      ansible.builtin.file:
+        path: /var/log/named
+        state: directory
+        mode: '0755'
+        owner: bind
+        group: bind
+
+    - name: Include bind9 role
+      ansible.builtin.include_role:
+        name: ../../../ansible-bind9-role  # noqa: role-name[path]
+  vars:
+    bind9_backup_config: false
+    # BIND9 9.20+ configuration with version-specific options
+    bind9_host_config:
+      - name: named.conf.options
+        options:
+          directory: "{{ bind9_working_directory }}"
+          recursion: true
+          allow_query:
+            - any
+          allow_recursion:
+            - 10.0.0.0/8
+            - 192.168.0.0/16
+            - 172.16.0.0/12
+            - localhost
+            - localnets
+          forwarders:
+            - address: 91.239.100.100
+              tls: censurfridns-anycast
+            - address: 89.233.43.71
+              tls: censurfridns-unicast
+          forward: first
+          dnssec_validation: auto
+          dnstap:
+            - type: auth
+            - type: resolver
+              log: query
+            - type: client
+              log: response
+          dnstap_output:
+            output_type: file
+            output_file: /var/log/named/dnstap.log
+            size: 20m
+            versions: 3
+            suffix: increment
+          dnstap_identity: dns-server-01
+          dnstap_version: 9.20
+          # Note: BIND9 9.20 automatically enables glue-cache, keep-response-order, reuse
+          # These options are removed in 9.20 and should not be configured
+          # Removed options (9.18 compatibility note):
+          # - alt_transfer_source (use TLS instead)
+          # - auto_dnssec (automatic in 9.20)
+          # - glue_cache (always enabled in 9.20)
+        logging:
+          channels:
+            - name: default_log
+              file:
+                name: /var/log/named/default.log
+              severity: info
+              print_time: true
+              print_severity: true
+              print_category: true
+            - name: security_log
+              file:
+                name: /var/log/named/security.log
+              severity: dynamic
+              print_time: true
+              print_severity: true
+              print_category: true
+            - name: query_log
+              file:
+                name: /var/log/named/queries.log
+                versions: 5
+                size: 10m
+              severity: info
+              print_time: true
+            - name: dnssec_log
+              file:
+                name: /var/log/named/dnssec.log
+              severity: debug
+              print_time: true
+              print_severity: true
+            - name: rate_limit_log
+              syslog: daemon
+              severity: warning
+          categories:
+            - name: default
+              channels:
+                - default_log
+            - name: general
+              channels:
+                - default_log
+            - name: security
+              channels:
+                - security_log
+            - name: queries
+              channels:
+                - query_log
+            - name: dnssec
+              channels:
+                - dnssec_log
+            - name: rate-limit
+              channels:
+                - rate_limit_log
+      - name: named.conf.local
+        tls:
+          - name: censurfridns-anycast
+            remote_hostname: anycast.uncensoreddns.org
+          - name: censurfridns-unicast
+            remote_hostname: unicast.uncensoreddns.org
+        zones:
+          - name: example.internal
+            type: forward
+            forward: only
+            forwarders:
+              - 10.0.0.53
+              - 10.0.0.54
--- a/molecule/bind9-20/molecule.yml
+++ b/molecule/bind9-20/molecule.yml
@@ -0,0 +1,22 @@
+---
+# Molecule scenario for BIND9 9.20+ support validation
+# This scenario tests the role with BIND9 9.20 and later feature releases
+# Note: May require ubuntu:24.04 or Debian 13 (Trixie) for 9.20 package availability
+
+driver:
+  name: podman
+platforms:
+  - name: ubuntu-2404-bind920
+    image: docker.io/library/ubuntu:24.04
+    command: /lib/systemd/systemd
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      ALLOW_BROKEN_CONDITIONALS: true
+verifier:
+  name: ansible
--- a/molecule/bind9-20/prepare.yml
+++ b/molecule/bind9-20/prepare.yml
@@ -0,0 +1,14 @@
+---
+- name: Prepare
+  hosts: all
+  tasks:
+    - name: Update package cache
+      ansible.builtin.apt:
+        update_cache: true
+
+    - name: Install DNS query tools (dnsutils)
+      ansible.builtin.apt:
+        name:
+          - dnsutils
+          - bind9-doc
+        state: present
--- a/molecule/bind9-20/verify.yml
+++ b/molecule/bind9-20/verify.yml
@@ -0,0 +1,120 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: true
+  tasks:
+    - name: Check that BIND9 is installed
+      ansible.builtin.package:
+        name: bind9
+        state: present
+      check_mode: true
+      register: __bind9_package_check
+      failed_when: __bind9_package_check is changed
+
+    - name: Check that BIND9 service is running
+      ansible.builtin.service:
+        name: named
+        state: started
+        enabled: true
+      check_mode: true
+      register: __bind9_service_check
+      failed_when: __bind9_service_check is changed
+
+    - name: Check that BIND9 version is 9.20 or later
+      ansible.builtin.command:
+        cmd: named -v
+      register: __bind9_version_check
+      changed_when: false
+      failed_when: false
+
+    - name: Display BIND9 version
+      ansible.builtin.debug:
+        msg: "BIND9 version: {{ __bind9_version_check.stdout }}"
+
+    - name: Check that named.conf.options exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.options
+      register: __options_file
+      failed_when: not __options_file.stat.exists
+
+    - name: Check that named.conf.local exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.local
+      register: __local_file
+      failed_when: not __local_file.stat.exists
+
+    - name: Read named.conf.options content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.options
+      register: __options_content
+
+    - name: Verify forwarders are configured in options
+      ansible.builtin.assert:
+        that:
+          - "'forwarders' in __options_decoded"
+          - "'91.239.100.100' in __options_decoded"
+          - "'forward first' in __options_decoded"
+        fail_msg: Forwarders not properly configured in named.conf.options
+      vars:
+        __options_decoded: "{{ __options_content.content | b64decode }}"
+
+    - name: Read named.conf.local content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.local
+      register: __local_content
+
+    - name: Verify forward zone is configured
+      ansible.builtin.assert:
+        that:
+          - "'zone \"example.internal\"' in __local_decoded"
+          - "'type forward' in __local_decoded"
+          - "'forward only' in __local_decoded"
+        fail_msg: Forward zone not properly configured in named.conf.local
+      vars:
+        __local_decoded: "{{ __local_content.content | b64decode }}"
+
+    - name: Test DNS resolution using localhost
+      ansible.builtin.command:
+        cmd: dig @localhost google.com +short
+      register: __dns_query
+      changed_when: false
+      failed_when: __dns_query.rc != 0
+
+    - name: Verify DNS query returned results
+      ansible.builtin.assert:
+        that:
+          - __dns_query.stdout_lines | length > 0
+        fail_msg: DNS forwarding is not working
+
+    - name: Validate configuration syntax with named-checkconf
+      ansible.builtin.command:
+        cmd: named-checkconf /etc/bind/named.conf
+      register: __named_checkconf
+      changed_when: false
+      failed_when: __named_checkconf.rc != 0
+
+    - name: Check BIND logs for errors
+      ansible.builtin.command:
+        cmd: tail -30 /var/log/named/default.log
+      register: __bind_logs
+      changed_when: false
+
+    - name: Display BIND logs
+      ansible.builtin.debug:
+        msg: "BIND logs:\n{{ __bind_logs.stdout }}"
+
+    - name: Verify no critical errors in logs
+      ansible.builtin.shell: |
+        set -o pipefail
+        if grep -i "error" /var/log/named/default.log | grep -v "error reporting" > /dev/null; then
+          exit 1
+        fi
+      changed_when: false
+      failed_when: false
+      register: __error_check
+
+    - name: Assert no critical errors found
+      ansible.builtin.assert:
+        that:
+          - __error_check.rc == 0
+        fail_msg: Found critical errors in BIND logs
Author	SHA1	Message	Date
Daniel Akulenok	b0d2a914f8	test: Trigger CI pipeline to verify molecule-podman fix Some checks failed Test / Lint (pull_request) Successful in 15s Details Test / Test (pull_request) Failing after 2m11s Details	2026-02-08 00:30:39 +01:00
Daniel Akulenok	a4f06d3daf	fix: Install molecule-podman driver for CI/CD tests All checks were successful Test / Lint (push) Successful in 16s Details Test / Test (push) Has been skipped Details The test stage was failing because molecule couldn't find the podman driver. The issue was that 'molecule[podman]' extra doesn't exist in molecule 25.12.0. Install 'molecule-podman' package instead which provides the required podman driver for molecule.	2026-02-08 00:29:47 +01:00
Daniel Akulenok	282e7601b4	fix: Add pipefail option to shell command in verify.yml All checks were successful Test / Lint (push) Successful in 15s Details Test / Test (push) Has been skipped Details Resolves ansible-lint risky-shell-pipe violation by adding 'set -o pipefail' to shell task that uses pipes.	2026-02-08 00:26:46 +01:00
Daniel Akulenok	f15d33b619	Merge pull request 'feat: Add BIND9 9.20 support with molecule scenario and documentation' (#14 ) from feature/bind9-20-support into main Some checks failed Test / Lint (push) Failing after 15s Details Test / Test (push) Has been skipped Details Reviewed-on: #14	2026-02-07 23:21:35 +00:00
Daniel Akulenok	a298665e93	fix: Improve BIND9 9.20 molecule scenario testing Some checks failed Test / Lint (push) Failing after 15s Details Test / Lint (pull_request) Failing after 15s Details Test / Test (push) Has been skipped Details Test / Test (pull_request) Has been skipped Details - Add dnsutils and bind9-doc installation in prepare.yml Ensures dig command and documentation are available for testing - Enhance verify.yml with improved validation: - Add named-checkconf syntax validation - Improve error detection logic in BIND logs - Add explicit error check assertions - Increase log tail output from 20 to 30 lines for better diagnostics These fixes address PR #14 review issues #3, #4, and #5: - Issue #3: Molecule converge.yml configuration (valid, no changes needed) - Issue #4: prepare.yml now installs required testing tools - Issue #5: verify.yml now includes better validation and error checking Related to: PR #14	2026-02-08 00:20:51 +01:00
Daniel Akulenok	528caeddeb	feat: Add BIND9 9.20 molecule scenario and support documentation Some checks failed Test / Lint (push) Successful in 15s Details Test / Lint (pull_request) Successful in 15s Details Test / Test (push) Has been skipped Details Test / Test (pull_request) Failing after 34s Details - Added molecule/bind9-20 scenario for testing BIND9 9.20+ compatibility - molecule.yml: Ubuntu 24.04 platform configuration - converge.yml: Complete 9.20 configuration with TLS, DNSTAP, and modern features - verify.yml: Comprehensive test cases for 9.20 features - collections.yml: Required Ansible collections - prepare.yml: Pre-test environment setup - README.md: Scenario documentation with breaking changes reference - Added docs/BIND9_9.20_SUPPORT.md implementation guide - Architecture overview for multi-version support - Runtime version detection strategy - Configuration changes and examples - Migration path for upgrading users - Feature highlights for BIND9 9.20 - Updated meta/argument_specs.yml - Added multi-version support documentation - Documented bind9_version variable (read-only, auto-detected) - Clarified supported BIND9 versions (9.18.x LTS and 9.20+) These changes establish the feature/bind9-20-support branch as the development path for BIND9 9.20+ support, separate from the main branch's 9.18.x focus. Closes #9: Create feature/bind9-20-support branch with 9.20 templates	2026-02-07 23:58:31 +01:00
Daniel Akulenok	0eff38f202	docs: Add detailed project workflow steps to AGENTS.md All checks were successful Test / Lint (push) Successful in 13s Details Test / Test (push) Has been skipped Details	2026-02-07 23:54:25 +01:00
Daniel Akulenok	14a8ff61cf	docs: Make AGENTS.md instructions concise and precise All checks were successful Test / Lint (push) Successful in 14s Details Test / Test (push) Has been skipped Details	2026-02-07 23:48:14 +01:00
Daniel Akulenok	1c635e5c55	docs: Add comprehensive BIND9 9.18 to 9.20 migration guide All checks were successful Test / Lint (push) Successful in 14s Details Test / Test (push) Has been skipped Details - Create step-by-step migration guide with pre-planning checklist - Document all 44 breaking changes with explanations - Provide before/after configuration examples - Include Ansible role-specific changes and branch selection - Add DNSSEC policy migration guidance - Include testing recommendations and validation checklist - Provide rollback procedures for safe migration - Link to technical version differences documentation Closes #6	2026-02-07 23:46:18 +01:00
Daniel Akulenok	db379be31f	docs: Add BIND9 version comparison and migration guidance - Generate BIND_VERSION_DIFFERENCES.md with detailed grammar comparison - Document 44 breaking changes between BIND9 9.18.44 and 9.20.18 - Document 35 new options and 22 modified options in BIND9 9.20 - Document 3 newly deprecated options - Add version compatibility section to CONFIGURATION_GRAMMAR.md - Update CHANGELOG.md with version differences details - Include migration guide for upgrading from 9.18 to 9.20 Closes #11	2026-02-07 23:43:51 +01:00
Daniel Akulenok	9df24a4a30	docs: Add repository actions guidelines for Gitea interaction All checks were successful Test / Lint (push) Successful in 14s Details Test / Test (push) Has been skipped Details	2026-02-07 23:40:16 +01:00
Daniel Akulenok	9622514d84	Merge branch 'main' of ssh://git.valid.dk:2222/daniel/ansible-bind9-role All checks were successful Test / Lint (push) Successful in 13s Details Test / Test (push) Has been skipped Details	2026-02-07 23:36:56 +01:00
Daniel Akulenok	1ee8ac1e0b	Merge pull request 'docs: Add BIND9 grammar files for v9.18.44 and v9.20.18' (#13 ) from 9.18 into main All checks were successful Test / Lint (push) Successful in 13s Details Test / Test (push) Has been skipped Details Reviewed-on: #13	2026-02-07 22:33:14 +00:00
Daniel Akulenok	3221070075	docs: Update README with version compatibility matrix - Add version support table to README - Link to VERSION_SUPPORT.md for detailed policies - Add minimum requirements documentation - Update license to GPL-3.0-or-later - Add links to key documentation and contributing info	2026-02-07 22:52:41 +01:00
Daniel Akulenok	dc4113088e	feat: Add grammar fetch and comparison tooling - Add fetch_bind_grammar.py for MCP-based grammar file retrieval - Add compare_bind_versions.py for version differences analysis - Add process_mcp_result.py for handling base64-encoded MCP output - Create upstream directory structure with fetching instructions - Document grammar file locations and structure	2026-02-07 22:52:35 +01:00
Daniel Akulenok	149692bcc4	docs: Add version support policy and changelog - Establish formal version maintenance strategy - Define BIND9 9.18 (LTS) and 9.20+ support tiers - Document branching strategy (main for 9.18, 9.20 for next major) - Define backporting policies for security, bugs, features - Create release management and CI/CD framework - Add OS platform compatibility matrix	2026-02-07 22:52:20 +01:00