Merge pull request 'feat: Establish version maintenance strategy for BIND9 support (#5)' (#7) from main into origin/main

Reviewed-on: #7

.gitea/workflows/test.yaml

@@ -0,0 +1,63 @@
+---
+name: Test
+
+on:  # noqa: yaml[truthy]
+  push:
+    branches:
+      - main
+      - feature/**
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install tools
+        run: |
+          pip install --no-cache-dir yamllint ansible-lint
+
+      - name: Run yamllint
+        run: yamllint -d relaxed .
+
+      - name: Run ansible-lint
+        run: ansible-lint --strict --profile=production
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: lint
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install podman
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y podman
+
+      - name: Install dependencies
+        run: |
+          pip install --no-cache-dir \
+            ansible \
+            molecule[podman] \
+            podman-compose \
+            pyyaml \
+            jinja2
+
+      - name: Run Molecule tests
+        run: molecule test

AGENTS.md

@@ -0,0 +1,6 @@
+<!--# cspell: ignore SSOT CMDB -->
+# AGENTS.md
+
+Ensure that all practices and instructions described by
+https://raw.githubusercontent.com/ansible/ansible-creator/refs/heads/main/docs/agents.md
+are followed.

README.md

@@ -38,7 +38,7 @@ named.conf
 bind configuration is set through the various bind9_*_config parameters. These are, in order of precedence:
 1. bind9_default_config
 2. bind9_group_config
-3. bind9_leaf_config
+3. bind9_site_config
 4. bind9_host_config
 
 All these configuration parameters are merged in a way where each successing config supercedes the previous one at a config-file level. To illustrate:
@@ -59,7 +59,7 @@ bind9_group_config:
       - name: "."
         type: mirror
 
-bind9_leaf_config:
+bind9_site_config:
   - name: named.conf.local
     zone:
       - name: "."
@@ -81,7 +81,7 @@ bind9_config:
         file: /etc/share/dns/root.hints
 ```
 
-The `named.conf.options` block in `bind9_default_config` got completely overwritten by the `bind9_group_config`, and the `bind9_leaf_config` completely overwrote `named.conf.local`, however, `named.conf.options` was left intact after merging with `bind9_leaf_config`.
+The `named.conf.options` block in `bind9_default_config` got completely overwritten by the `bind9_group_config`, and the `bind9_site_config` completely overwrote `named.conf.local`, however, `named.conf.options` was left intact after merging with `bind9_site_config`.
 
 Configuration Grammar
 ---------------------
@@ -126,38 +126,43 @@ Simple options are defined just as that.
 ```
 
 Some options have several optional parameters. For those, a somewhat flexible 
-configuration format has been created
+configuration format has been created. Common patterns include:
+
+- **Address with Port/DSCP**: Used by options like `primaries`, `parental_agents` (e.g., `address [ port <port> ] [ dscp <dscp> ]`)
+- **Address with Port/TLS**: Used by options like `forwarders` (e.g., `address [ port <port> ] [ tls <tls> ]`)
+
 ```
-      IP_PORT_DSCP_OPTION: # Any option that is defined as one of:
-      #  <option> [ port <port> ] [ dscp <dscp> ] { <address> [ port <port> ] [ dscp <dscp> ]; ... }
-      #  <option> [ port <port> ] [ dscp <dscp> ] { <address> [ port <port> ] [ key <key> ] [ tls <tls> ]; ... }
+      ADDRESS_PORT_TLS_OPTION: # Example: forwarders option
+      # <option> [ port <port> ] [ tls <tls> ] { <address> [ port <port> ] [ tls <tls> ]; ... }
       # has a few optional syntaxes 
       # Example 1: Simple address list
         - ADDRESS1
         - ADDRESS2
-      # Example 2: To define source port/dscp, use 'addresses' sub-element
+      # Example 2: To define global port/tls, use 'addresses' sub-element
         [ port: PORT ]
-        [ dscp: DSCP ]
+        [ tls: TLS_NAME ]
         addresses:
           - ADDRESS1
           - ADDRESS2
           - 127.0.0.1
-      # Example 3: To define target port/dscp, use 'addresses' as a list of dicts
+      # Example 3: To define per-address port/tls, use 'addresses' as a list of dicts
         addresses:
           - address: ADDRESS
             [ port: PORT ]
-            [ dscp: DSCP ]
+            [ tls: TLS_NAME ]
           - address: 127.0.0.1
             port: 53
           - address: 127.0.0.1
-            dscp: 42
-          - address: 127.0.0.1
-            port: 5353
-            dscp: 42
+            port: 853
+            tls: dot-tls
+          - address: 8.8.8.8
+            port: 853
+            tls: google-tls
       # Example 4: The various formats can be mixed and matched within the main element
         - ADDRESS1
         - address: ADDRESS2
           port: PORT
+          tls: TLS_NAME
 ```
 
 
@@ -199,4 +204,4 @@ Author Information
 ------------------
 
 Daniel Akulenok <daniel@valid.dk>
-Valid.dk A/S - keepit.com
+Valid.dk

bind9-grammar/forward.zoneopt.json

@@ -0,0 +1,19 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "forward"
+            },
+            "forward": {
+                "_grammar": "( first | only )"
+            },
+            "forwarders": {
+                "_grammar": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... }"
+            },
+            "template": {
+                "_grammar": "<string>"
+            }
+        }
+    }
+}

bind9-grammar/hint.zoneopt.json

@@ -0,0 +1,19 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "hint"
+            },
+            "check-names": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "template": {
+                "_grammar": "<string>"
+            }
+        }
+    }
+}

bind9-grammar/in-view.zoneopt.json

@@ -0,0 +1,10 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "in-view": {
+                "_grammar": "<string>"
+            }
+        }
+    }
+}

bind9-grammar/mirror.zoneopt.json

@@ -0,0 +1,171 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "mirror"
+            },
+            "allow-notify": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-transfer": {
+                "_grammar": "[ port <integer> ] [ transport <string> ] { <address_match_element>; ... }"
+            },
+            "allow-update-forwarding": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "also-notify": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "check-names": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "database": {
+                "_grammar": "<string>"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "ixfr-from-differences": {
+                "_grammar": "<boolean>"
+            },
+            "journal": {
+                "_grammar": "<quoted_string>"
+            },
+            "masterfile-format": {
+                "_grammar": "( raw | text )"
+            },
+            "masterfile-style": {
+                "_grammar": "( full | relative )"
+            },
+            "max-ixfr-ratio": {
+                "_grammar": "( unlimited | <percentage> )"
+            },
+            "max-journal-size": {
+                "_grammar": "( default | unlimited | <sizeval> )"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "max-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-in": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-out": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-in": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-out": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "min-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "min-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "min-transfer-rate-in": {
+                "_grammar": "<integer> <integer>"
+            },
+            "multi-master": {
+                "_grammar": "<boolean>"
+            },
+            "notify": {
+                "_grammar": "( explicit | master-only | primary-only | <boolean> )"
+            },
+            "notify-cfg": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_id": "<string>",
+                "_mapbody": {
+                    "notify": {
+                        "_grammar": "<boolean>"
+                    },
+                    "notify-defer": {
+                        "_grammar": "<integer>"
+                    },
+                    "notify-delay": {
+                        "_grammar": "<integer>"
+                    },
+                    "notify-source": {
+                        "_grammar": "( <ipv4_address> | * )"
+                    },
+                    "notify-source-v6": {
+                        "_grammar": "( <ipv6_address> | * )"
+                    }
+                }
+            },
+            "notify-defer": {
+                "_grammar": "<integer>"
+            },
+            "notify-delay": {
+                "_grammar": "<integer>"
+            },
+            "notify-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "notify-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "plugin": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_grammar": "( query ) <string> [ { <unspecified-text> } ]"
+            },
+            "primaries": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "provide-zoneversion": {
+                "_grammar": "<boolean>"
+            },
+            "request-expire": {
+                "_grammar": "<boolean>"
+            },
+            "request-ixfr": {
+                "_grammar": "<boolean>"
+            },
+            "request-ixfr-max-diffs": {
+                "_grammar": "<integer>"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "transfer-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "transfer-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "try-tcp-refresh": {
+                "_grammar": "<boolean>"
+            },
+            "zero-no-soa-ttl": {
+                "_grammar": "<boolean>"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

bind9-grammar/primary.zoneopt.json

@@ -0,0 +1,258 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "primary"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-transfer": {
+                "_grammar": "[ port <integer> ] [ transport <string> ] { <address_match_element>; ... }"
+            },
+            "allow-update": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "also-notify": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "check-dup-records": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "check-integrity": {
+                "_grammar": "<boolean>"
+            },
+            "check-mx": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "check-mx-cname": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "check-names": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "check-sibling": {
+                "_grammar": "<boolean>"
+            },
+            "check-spf": {
+                "_grammar": "( warn | ignore )"
+            },
+            "check-srv-cname": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "check-svcb": {
+                "_grammar": "<boolean>"
+            },
+            "check-wildcard": {
+                "_grammar": "<boolean>"
+            },
+            "checkds": {
+                "_grammar": "( explicit | <boolean> )"
+            },
+            "database": {
+                "_grammar": "<string>"
+            },
+            "dlz": {
+                "_grammar": "<string>"
+            },
+            "dnskey-sig-validity": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<integer>"
+            },
+            "dnssec-dnskey-kskonly": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "dnssec-loadkeys-interval": {
+                "_grammar": "<integer>"
+            },
+            "dnssec-policy": {
+                "_grammar": "<string>"
+            },
+            "dnssec-secure-to-insecure": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "dnssec-update-mode": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "( maintain | no-resign )"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "forward": {
+                "_grammar": "( first | only )"
+            },
+            "forwarders": {
+                "_grammar": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... }"
+            },
+            "initial-file": {
+                "_grammar": "<quoted_string>"
+            },
+            "inline-signing": {
+                "_grammar": "<boolean>"
+            },
+            "ixfr-from-differences": {
+                "_grammar": "<boolean>"
+            },
+            "journal": {
+                "_grammar": "<quoted_string>"
+            },
+            "key-directory": {
+                "_grammar": "<quoted_string>"
+            },
+            "log-report-channel": {
+                "_grammar": "<boolean>"
+            },
+            "masterfile-format": {
+                "_grammar": "( raw | text )"
+            },
+            "masterfile-style": {
+                "_grammar": "( full | relative )"
+            },
+            "max-ixfr-ratio": {
+                "_grammar": "( unlimited | <percentage> )"
+            },
+            "max-journal-size": {
+                "_grammar": "( default | unlimited | <sizeval> )"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-out": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-out": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "max-zone-ttl": {
+                "_flags": [
+                    "deprecated"
+                ],
+                "_grammar": "( unlimited | <duration> )"
+            },
+            "notify": {
+                "_grammar": "( explicit | master-only | primary-only | <boolean> )"
+            },
+            "notify-cfg": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_id": "<string>",
+                "_mapbody": {
+                    "notify": {
+                        "_grammar": "<boolean>"
+                    },
+                    "notify-defer": {
+                        "_grammar": "<integer>"
+                    },
+                    "notify-delay": {
+                        "_grammar": "<integer>"
+                    },
+                    "notify-source": {
+                        "_grammar": "( <ipv4_address> | * )"
+                    },
+                    "notify-source-v6": {
+                        "_grammar": "( <ipv6_address> | * )"
+                    }
+                }
+            },
+            "notify-defer": {
+                "_grammar": "<integer>"
+            },
+            "notify-delay": {
+                "_grammar": "<integer>"
+            },
+            "notify-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "notify-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "notify-to-soa": {
+                "_grammar": "<boolean>"
+            },
+            "nsec3-test-zone": {
+                "_flags": [
+                    "test only"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "parental-agents": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "parental-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "parental-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "plugin": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_grammar": "( query ) <string> [ { <unspecified-text> } ]"
+            },
+            "provide-zoneversion": {
+                "_grammar": "<boolean>"
+            },
+            "send-report-channel": {
+                "_grammar": "<string>"
+            },
+            "serial-update-method": {
+                "_grammar": "( date | increment | unixtime )"
+            },
+            "sig-signing-nodes": {
+                "_grammar": "<integer>"
+            },
+            "sig-signing-signatures": {
+                "_grammar": "<integer>"
+            },
+            "sig-signing-type": {
+                "_grammar": "<integer>"
+            },
+            "sig-validity-interval": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<integer> [ <integer> ]"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "update-check-ksk": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "update-policy": {
+                "_grammar": "( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } )"
+            },
+            "zero-no-soa-ttl": {
+                "_grammar": "<boolean>"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

bind9-grammar/redirect.zoneopt.json

@@ -0,0 +1,58 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "redirect"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "dlz": {
+                "_grammar": "<string>"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "masterfile-format": {
+                "_grammar": "( raw | text )"
+            },
+            "masterfile-style": {
+                "_grammar": "( full | relative )"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "max-zone-ttl": {
+                "_flags": [
+                    "deprecated"
+                ],
+                "_grammar": "( unlimited | <duration> )"
+            },
+            "plugin": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_grammar": "( query ) <string> [ { <unspecified-text> } ]"
+            },
+            "primaries": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

bind9-grammar/secondary.zoneopt.json

@@ -0,0 +1,258 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "secondary"
+            },
+            "allow-notify": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-transfer": {
+                "_grammar": "[ port <integer> ] [ transport <string> ] { <address_match_element>; ... }"
+            },
+            "allow-update-forwarding": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "also-notify": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "check-names": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "checkds": {
+                "_grammar": "( explicit | <boolean> )"
+            },
+            "database": {
+                "_grammar": "<string>"
+            },
+            "dlz": {
+                "_grammar": "<string>"
+            },
+            "dnskey-sig-validity": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<integer>"
+            },
+            "dnssec-dnskey-kskonly": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "dnssec-loadkeys-interval": {
+                "_grammar": "<integer>"
+            },
+            "dnssec-policy": {
+                "_grammar": "<string>"
+            },
+            "dnssec-update-mode": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "( maintain | no-resign )"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "forward": {
+                "_grammar": "( first | only )"
+            },
+            "forwarders": {
+                "_grammar": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... }"
+            },
+            "inline-signing": {
+                "_grammar": "<boolean>"
+            },
+            "ixfr-from-differences": {
+                "_grammar": "<boolean>"
+            },
+            "journal": {
+                "_grammar": "<quoted_string>"
+            },
+            "key-directory": {
+                "_grammar": "<quoted_string>"
+            },
+            "log-report-channel": {
+                "_grammar": "<boolean>"
+            },
+            "masterfile-format": {
+                "_grammar": "( raw | text )"
+            },
+            "masterfile-style": {
+                "_grammar": "( full | relative )"
+            },
+            "max-ixfr-ratio": {
+                "_grammar": "( unlimited | <percentage> )"
+            },
+            "max-journal-size": {
+                "_grammar": "( default | unlimited | <sizeval> )"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "max-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-in": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-out": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-in": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-out": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "min-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "min-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "min-transfer-rate-in": {
+                "_grammar": "<integer> <integer>"
+            },
+            "multi-master": {
+                "_grammar": "<boolean>"
+            },
+            "notify": {
+                "_grammar": "( explicit | master-only | primary-only | <boolean> )"
+            },
+            "notify-cfg": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_id": "<string>",
+                "_mapbody": {
+                    "notify": {
+                        "_grammar": "<boolean>"
+                    },
+                    "notify-defer": {
+                        "_grammar": "<integer>"
+                    },
+                    "notify-delay": {
+                        "_grammar": "<integer>"
+                    },
+                    "notify-source": {
+                        "_grammar": "( <ipv4_address> | * )"
+                    },
+                    "notify-source-v6": {
+                        "_grammar": "( <ipv6_address> | * )"
+                    }
+                }
+            },
+            "notify-defer": {
+                "_grammar": "<integer>"
+            },
+            "notify-delay": {
+                "_grammar": "<integer>"
+            },
+            "notify-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "notify-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "notify-to-soa": {
+                "_grammar": "<boolean>"
+            },
+            "nsec3-test-zone": {
+                "_flags": [
+                    "test only"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "parental-agents": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "parental-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "parental-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "plugin": {
+                "_flags": [
+                    "may occur multiple times"
+                ],
+                "_grammar": "( query ) <string> [ { <unspecified-text> } ]"
+            },
+            "primaries": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "provide-zoneversion": {
+                "_grammar": "<boolean>"
+            },
+            "request-expire": {
+                "_grammar": "<boolean>"
+            },
+            "request-ixfr": {
+                "_grammar": "<boolean>"
+            },
+            "request-ixfr-max-diffs": {
+                "_grammar": "<integer>"
+            },
+            "send-report-channel": {
+                "_grammar": "<string>"
+            },
+            "sig-signing-nodes": {
+                "_grammar": "<integer>"
+            },
+            "sig-signing-signatures": {
+                "_grammar": "<integer>"
+            },
+            "sig-signing-type": {
+                "_grammar": "<integer>"
+            },
+            "sig-validity-interval": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<integer> [ <integer> ]"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "transfer-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "transfer-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "try-tcp-refresh": {
+                "_grammar": "<boolean>"
+            },
+            "update-check-ksk": {
+                "_flags": [
+                    "obsolete"
+                ],
+                "_grammar": "<boolean>"
+            },
+            "zero-no-soa-ttl": {
+                "_grammar": "<boolean>"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

bind9-grammar/static-stub.zoneopt.json

@@ -0,0 +1,43 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "static-stub"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "forward": {
+                "_grammar": "( first | only )"
+            },
+            "forwarders": {
+                "_grammar": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... }"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "server-addresses": {
+                "_grammar": "{ ( <ipv4_address> | <ipv6_address> ); ... }"
+            },
+            "server-names": {
+                "_grammar": "{ <string>; ... }"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

bind9-grammar/stub.zoneopt.json

@@ -0,0 +1,85 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "stub"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "check-names": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "database": {
+                "_grammar": "<string>"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "forward": {
+                "_grammar": "( first | only )"
+            },
+            "forwarders": {
+                "_grammar": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... }"
+            },
+            "masterfile-format": {
+                "_grammar": "( raw | text )"
+            },
+            "masterfile-style": {
+                "_grammar": "( full | relative )"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "max-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-in": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-in": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "min-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "min-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "min-transfer-rate-in": {
+                "_grammar": "<integer> <integer>"
+            },
+            "multi-master": {
+                "_grammar": "<boolean>"
+            },
+            "primaries": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "transfer-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "transfer-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

bind9-grammar/zoneopt.json

@@ -0,0 +1,85 @@
+{
+    "zone": {
+        "_id": "<string> [ <class> ]",
+        "_mapbody": {
+            "type": {
+                "_grammar": "stub"
+            },
+            "allow-query": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "allow-query-on": {
+                "_grammar": "{ <address_match_element>; ... }"
+            },
+            "check-names": {
+                "_grammar": "( fail | warn | ignore )"
+            },
+            "database": {
+                "_grammar": "<string>"
+            },
+            "file": {
+                "_grammar": "<quoted_string>"
+            },
+            "forward": {
+                "_grammar": "( first | only )"
+            },
+            "forwarders": {
+                "_grammar": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... }"
+            },
+            "masterfile-format": {
+                "_grammar": "( raw | text )"
+            },
+            "masterfile-style": {
+                "_grammar": "( full | relative )"
+            },
+            "max-records": {
+                "_grammar": "<integer>"
+            },
+            "max-records-per-type": {
+                "_grammar": "<integer>"
+            },
+            "max-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "max-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-idle-in": {
+                "_grammar": "<integer>"
+            },
+            "max-transfer-time-in": {
+                "_grammar": "<integer>"
+            },
+            "max-types-per-name": {
+                "_grammar": "<integer>"
+            },
+            "min-refresh-time": {
+                "_grammar": "<integer>"
+            },
+            "min-retry-time": {
+                "_grammar": "<integer>"
+            },
+            "min-transfer-rate-in": {
+                "_grammar": "<integer> <integer>"
+            },
+            "multi-master": {
+                "_grammar": "<boolean>"
+            },
+            "primaries": {
+                "_grammar": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }"
+            },
+            "template": {
+                "_grammar": "<string>"
+            },
+            "transfer-source": {
+                "_grammar": "( <ipv4_address> | * )"
+            },
+            "transfer-source-v6": {
+                "_grammar": "( <ipv6_address> | * )"
+            },
+            "zone-statistics": {
+                "_grammar": "( full | terse | none | <boolean> )"
+            }
+        }
+    }
+}

defaults/main.yml

@@ -14,9 +14,8 @@ bind9_debug_config: false
 bind9_config_indent: 4
 
 bind9_group_config: []
-bind9_leaf_config: []
+bind9_site_config: []
 bind9_host_config: []
-
 bind9_default_config:
   - name: named.conf
     backup: false
@@ -28,10 +27,11 @@ bind9_default_config:
     options:
       directory: "{{ bind9_working_directory }}"
 
-bind9_config: "{{ [bind9_default_config,
-  bind9_group_config,
-  bind9_leaf_config,
-  bind9_host_config] |
-  community.general.lists_mergeby('name',
-    recursive=true,
-    list_merge='append_rp') }}"
+bind9_config: >-
+  {{
+    [bind9_default_config,
+     bind9_group_config,
+     bind9_site_config,
+     bind9_host_config] |
+    community.general.lists_mergeby('name', recursive=true, list_merge='append_rp')
+  }}

handlers/main.yml

@@ -16,10 +16,8 @@
       - "{{ bind9_cfgdir }}"
       - "{{ bind9_working_directory }}"
       - "{{ bind9_libdir }}"
-    dest: "{{
-      bind9_backup_dir + '/bind9-config-' +
-      ansible_date_time.iso8601_basic_short + '.tar.gz' }}"
+    dest: "{{ bind9_backup_dir + '/bind9-config-' + ansible_facts.date_time.iso8601_basic_short + '.tar.gz' }}"
     owner: root
     group: root
-    mode: 0640
+    mode: "0640"
   when: bind9_backup_config is defined and bind9_backup_config

meta/argument_specs.yml

@@ -0,0 +1,55 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the bind9 role.
+    options:
+      bind9_config:
+        type: list
+        elements: dict
+        description:
+          - A list of configuration dictionaries that are merged to produce the final configuration.
+          - Each element must have a 'name' key (filename).
+      bind9_default_config:
+        type: list
+        elements: dict
+        description: Default configuration.
+      bind9_group_config:
+        type: list
+        elements: dict
+        description: Group-level configuration.
+      bind9_site_config:
+        type: list
+        elements: dict
+        description: Site/Leaf-level configuration.
+      bind9_host_config:
+        type: list
+        elements: dict
+        description: Host-level configuration.
+      bind9_backup_config:
+        type: bool
+        default: true
+        description: Whether to backup configuration files before overwriting.
+      bind9_debug_config:
+        type: bool
+        default: false
+        description: Whether to print the merged configuration during execution.
+      bind9_config_indent:
+        type: int
+        default: 4
+        description: Indentation level for generated configuration files.
+      bind9_packages:
+        type: list
+        elements: str
+        description: List of packages to install.
+      bind9_cfgdir:
+        type: str
+        description: Directory for configuration files.
+      bind9_working_directory:
+        type: str
+        description: Working directory for BIND.
+      bind9_libdir:
+        type: str
+        description: Library directory for BIND.
+      bind9_backup_dir:
+        type: str
+        description: Directory for backups.

meta/main.yml

@@ -7,7 +7,7 @@ galaxy_info:
   description: Configure Bind9
   company: Valid.dk
 
-  issue_tracker_url: https://gitlab.valid.dk/operations/ansible-bind9-role
+  issue_tracker_url: https://git.valid.dk/daniel/ansible-bind9-role
 
   license: GPL-3.0-or-later
 

molecule/default/collections.yml

@@ -0,0 +1,6 @@
+---
+collections:
+  - name: ansible.utils
+  - name: ansible.posix
+  - name: community.crypto
+  - name: community.general

molecule/default/converge.yml

@@ -1,5 +1,115 @@
 ---
 - name: Converge
   hosts: all
-  roles:
-    - keepit.bind9
+  tasks:
+    - name: Create log directory for BIND
+      ansible.builtin.file:
+        path: /var/log/named
+        state: directory
+        mode: '0755'
+        owner: bind
+        group: bind
+
+    - name: Include bind9 role
+      ansible.builtin.include_role:
+        name: ../../../ansible-bind9-role  # noqa: role-name[path]
+  vars:
+    bind9_backup_config: false
+    bind9_host_config:
+      - name: named.conf.options
+        options:
+          directory: "{{ bind9_working_directory }}"
+          recursion: true
+          allow_query:
+            - any
+          allow_recursion:
+            - 10.0.0.0/8
+            - 192.168.0.0/16
+            - 172.16.0.0/12
+            - localhost
+            - localnets
+          forwarders:
+            - address: 91.239.100.100
+              tls: censurfridns-anycast
+            - address: 89.233.43.71
+              tls: censurfridns-unicast
+          forward: first
+          dnssec_validation: auto
+          dnstap:
+            - type: auth
+            - type: resolver
+              log: query
+            - type: client
+              log: response
+          dnstap_output:
+            output_type: file
+            output_file: /var/log/named/dnstap.log
+            size: 20m
+            versions: 3
+            suffix: increment
+          dnstap_identity: dns-server-01
+          dnstap_version: 9.18
+        logging:
+          channels:
+            - name: default_log
+              file:
+                name: /var/log/named/default.log
+              severity: info
+              print_time: true
+              print_severity: true
+              print_category: true
+            - name: security_log
+              file:
+                name: /var/log/named/security.log
+              severity: dynamic
+              print_time: true
+              print_severity: true
+              print_category: true
+            - name: query_log
+              file:
+                name: /var/log/named/queries.log
+                versions: 5
+                size: 10m
+              severity: info
+              print_time: true
+            - name: dnssec_log
+              file:
+                name: /var/log/named/dnssec.log
+              severity: debug
+              print_time: true
+              print_severity: true
+            - name: rate_limit_log
+              syslog: daemon
+              severity: warning
+          categories:
+            - name: default
+              channels:
+                - default_log
+            - name: general
+              channels:
+                - default_log
+            - name: security
+              channels:
+                - security_log
+            - name: queries
+              channels:
+                - query_log
+            - name: dnssec
+              channels:
+                - dnssec_log
+            - name: rate-limit
+              channels:
+                - rate_limit_log
+      - name: named.conf.local
+        tls:
+          - name: censurfridns-anycast
+            remote_hostname: anycast.uncensoreddns.org
+          - name: censurfridns-unicast
+            remote_hostname: unicast.uncensoreddns.org
+        zones:
+          - name: example.internal
+            type: forward
+            forward: only
+            forwarders:
+              - 10.0.0.53
+              - 10.0.0.54

molecule/default/molecule.yml

@@ -1,22 +1,18 @@
 ---
-dependency:
-  name: galaxy
 driver:
   name: podman
 platforms:
-  - name: ubuntu-jammy
-    image: ubuntu:jammy
-  - name: ubuntu-focal
-    image: ubuntu:focal
-  - name: debian-bullseye
-    image: debian:bullseye
+  - name: debian-trixie
+    image: docker.io/jrei/systemd-debian:13
+    command: /lib/systemd/systemd
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
 provisioner:
   name: ansible
-  lint:
-    name: ansible-lint
+  config_options:
+    defaults:
+      ALLOW_BROKEN_CONDITIONALS: true
 verifier:
   name: ansible
-lint: |
-  set -e
-  ansible-lint .
-  yamllint .

molecule/default/prepare.yml

@@ -0,0 +1,11 @@
+---
+- name: Prepare
+  hosts: all
+  tasks:
+    - name: Update apt
+      ansible.builtin.apt:
+        update_cache: true
+    - name: Install bind9-dnsutils package
+      ansible.builtin.apt:
+        name: bind9-dnsutils
+        state: present

molecule/default/verify.yml

@@ -0,0 +1,76 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: true
+  tasks:
+    - name: Check that BIND9 is installed
+      ansible.builtin.package:
+        name: bind9
+        state: present
+      check_mode: true
+      register: __bind9_package_check
+      failed_when: __bind9_package_check is changed
+
+    - name: Check that BIND9 service is running
+      ansible.builtin.service:
+        name: named
+        state: started
+        enabled: true
+      check_mode: true
+      register: __bind9_service_check
+      failed_when: __bind9_service_check is changed
+
+    - name: Check that named.conf.options exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.options
+      register: __options_file
+      failed_when: not __options_file.stat.exists
+
+    - name: Check that named.conf.local exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.local
+      register: __local_file
+      failed_when: not __local_file.stat.exists
+
+    - name: Read named.conf.options content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.options
+      register: __options_content
+
+    - name: Verify forwarders are configured in options
+      ansible.builtin.assert:
+        that:
+          - "'forwarders' in __options_decoded"
+          - "'8.8.8.8' in __options_decoded"
+          - "'forward first' in __options_decoded"
+        fail_msg: Forwarders not properly configured in named.conf.options
+      vars:
+        __options_decoded: "{{ __options_content.content | b64decode }}"
+
+    - name: Read named.conf.local content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.local
+      register: __local_content
+
+    - name: Verify forward zone is configured
+      ansible.builtin.assert:
+        that:
+          - "'zone \"example.internal\"' in __local_decoded"
+          - "'type forward' in __local_decoded"
+          - "'forward only' in __local_decoded"
+        fail_msg: Forward zone not properly configured in named.conf.local
+      vars:
+        __local_decoded: "{{ __local_content.content | b64decode }}"
+
+    - name: Test DNS resolution using localhost
+      ansible.builtin.command:
+        cmd: dig @localhost google.com +short
+      register: __dns_query
+      changed_when: false
+      failed_when: __dns_query.rc != 0
+
+    - name: Verify DNS query returned results
+      ansible.builtin.assert:
+        that:
+          - __dns_query.stdout_lines | length > 0
+        fail_msg: DNS forwarding is not working

tasks/main.yml

@@ -15,27 +15,77 @@
     state: directory
     owner: root
     group: root
-    mode: 0750
-  when: bind9_backup_config is defined and bind9_backup_config
+    mode: "0750"
+  when: bind9_backup_config is defined and bind9_backup_config | bool
 
-- name: Template named.conf.generator
-  ansible.builtin.template:
-    src: named.conf.generator.j2
-    dest: "{{ bind9_cfgdir }}/{{ item.name }}"
-    owner: root
-    group: bind
-    mode: 0640
-    backup: "{{ item.backup | default('false') | bool }}"
-  # validate: 'named-checkconf -z -j %s'
-  loop: "{{ bind9_config }}"
-  loop_control:
-    label: "{{ item.name }}"
+- name: Deploy and Validate Configuration
   tags:
     - bind9
     - template
   notify:
     - Backup bind config
     - Restart bind
+  block:
+    - name: Create backup of current config
+      ansible.builtin.copy:
+        src: "{{ bind9_cfgdir }}/{{ item.name }}"
+        dest: "{{ bind9_cfgdir }}/{{ item.name }}.bak"
+        remote_src: true
+        owner: root
+        group: bind
+        mode: "0640"
+      changed_when: false
+      failed_when: false # It's okay if the file doesn't exist yet
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+    - name: Template named.conf.generator
+      ansible.builtin.template:
+        src: named.conf.generator.j2
+        dest: "{{ bind9_cfgdir }}/{{ item.name }}"
+        owner: root
+        group: bind
+        mode: "0640"
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+      register: bind9_template_result
+
+    - name: Validate configuration using named-checkconf
+      ansible.builtin.command:
+        cmd: "named-checkconf -z {{ bind9_cfgdir }}/named.conf"
+      changed_when: false
+
+  rescue:
+    - name: Restore configuration from backup
+      ansible.builtin.copy:
+        src: "{{ bind9_cfgdir }}/{{ item.name }}.bak"
+        dest: "{{ bind9_cfgdir }}/{{ item.name }}"
+        remote_src: true
+        owner: root
+        group: bind
+        mode: "0640"
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+      failed_when: false # Best effort restore
+
+    - name: Fail due to invalid configuration
+      ansible.builtin.fail:
+        msg: |
+          Configuration validation failed. Changes have been reverted.
+          Check the logs for named-checkconf errors.
+
+  always:
+    - name: Remove backup files
+      ansible.builtin.file:
+        path: "{{ bind9_cfgdir }}/{{ item.name }}.bak"
+        state: absent
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+      when: bind9_backup_config | bool is false
 
 - name: Ensure the named service is started
   ansible.builtin.service:

templates/named.conf.functions.j2

@@ -111,3 +111,35 @@
 {{ name }} "{{ value }}";
 {% endif %}
 {% endmacro %}
+
+{% macro list_address_port_tls(dict, indent=bind9_config_indent) %}
+{# This macro is for use for statements with grammar like #}
+{#  address port 00 tls str; address port 00 tls str; #}
+{# it is usually called by a parent macro #}
+{% filter indent(indent, true) %}
+{% for item in dict %}
+{% if item is not mapping %}
+{{ item }};
+{% else %}
+{{ item.address }}
+{{- (' port ' + item.port | string) if item.port is defined and item.port -}}
+{{- (' tls ' + item.tls | string) if item.tls is defined and item.tls -}};
+{% endif %}
+{% endfor %}
+{% endfilter %}
+{% endmacro %}
+
+{% macro parent_address_port_tls(name, dict) %}
+{# This macro is for use for statements with grammar like #}
+{# statement port 00 tls str { address port 00 tls str; address port 00 tls str; } #}
+{# the list inside the statement is handled by list_address_port_tls #}
+{% if dict is not mapping and dict is iterable %}
+{{ name }} {
+{{ list_address_port_tls(dict) }}};
+{% else %}
+{{ name }}
+{{- (' port ' + dict.port | string) if dict.port is defined and dict.port -}}
+{{- (' tls ' + dict.tls | string) if dict.tls is defined and dict.tls }} {
+{{ list_address_port_tls(dict.addresses) }}};
+{% endif %}
+{% endmacro %}

templates/named.conf.options.j2

@@ -101,7 +101,7 @@ listen-on
 {{ functions.simple_item_list(item.options.listen_on.addresses) }}};
 {% endfor %}
 {% endif %}
-{{ functions.parent_address_port_dscp("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}}
+{{ functions.parent_address_port_tls("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}}
 {% if item.options.dual_stack_servers is defined and item.options.dual_stack_servers %}
 dual-stack-servers
 {{ (' port ' + item.options.dual_stack_servers.port | string) if item.options.dual_stack_servers.port is defined and item.options.dual_stack_servers }} {

templates/named.conf.zone.j2

@@ -47,7 +47,7 @@ server-names {
 server-addresses {
 {{ functions.simple_item_list(zone.server_addresses) }}};
 {% endif %}
-{{ functions.parent_address_port_dscp('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}}
+{{ functions.parent_address_port_tls('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}}
 {% if zone.allow_transfer is defined and zone.allow_transfer is not string %}
 allow-transfer
 {{- (' port ' + zone.allow_transfer.port | string) if zone.allow_transfer.port is defined and zone.allow_transfer.port -}}

tests/test.yml

@@ -2,4 +2,4 @@
 - hosts: localhost
   remote_user: root
   roles:
-    - bind9
+    - bind9  # noqa: syntax-check[specific]