AGENTS

- Add Ansible collections configuration
- Update converge and prepare playbooks
- Restructure molecule.yml for improved testing

AGENTS.md

@@ -0,0 +1,6 @@
+<!--# cspell: ignore SSOT CMDB -->
+# AGENTS.md
+
+Ensure that all practices and instructions described by
+https://raw.githubusercontent.com/ansible/ansible-creator/refs/heads/main/docs/agents.md
+are followed.

README.md

@@ -38,7 +38,7 @@ named.conf
 bind configuration is set through the various bind9_*_config parameters. These are, in order of precedence:
 1. bind9_default_config
 2. bind9_group_config
-3. bind9_leaf_config
+3. bind9_site_config
 4. bind9_host_config
 
 All these configuration parameters are merged in a way where each successing config supercedes the previous one at a config-file level. To illustrate:
@@ -59,7 +59,7 @@ bind9_group_config:
       - name: "."
         type: mirror
 
-bind9_leaf_config:
+bind9_site_config:
   - name: named.conf.local
     zone:
       - name: "."
@@ -81,7 +81,7 @@ bind9_config:
         file: /etc/share/dns/root.hints
 ```
 
-The `named.conf.options` block in `bind9_default_config` got completely overwritten by the `bind9_group_config`, and the `bind9_leaf_config` completely overwrote `named.conf.local`, however, `named.conf.options` was left intact after merging with `bind9_leaf_config`.
+The `named.conf.options` block in `bind9_default_config` got completely overwritten by the `bind9_group_config`, and the `bind9_site_config` completely overwrote `named.conf.local`, however, `named.conf.options` was left intact after merging with `bind9_site_config`.
 
 Configuration Grammar
 ---------------------
@@ -198,5 +198,5 @@ BSD
 Author Information
 ------------------
 
-Daniel Akulenok <dak@keepit.com>
+Daniel Akulenok <daniel@valid.dk>
-Keepit A/S - keepit.com
+Valid.dk

defaults/main.yml

@@ -14,7 +14,7 @@ bind9_debug_config: false
 bind9_config_indent: 4
 
 bind9_group_config: []
-bind9_leaf_config: []
+bind9_site_config: []
 bind9_host_config: []
 
 bind9_default_config:
@@ -30,7 +30,7 @@ bind9_default_config:
 
 bind9_config: "{{ [bind9_default_config,
   bind9_group_config,
-  bind9_leaf_config,
+  bind9_site_config,
   bind9_host_config] |
   community.general.lists_mergeby('name',
     recursive=true,

meta/argument_specs.yml

@@ -0,0 +1,55 @@
+---
+argument_specs:
+  main:
+    short_description: The main entry point for the bind9 role.
+    options:
+      bind9_config:
+        type: list
+        elements: dict
+        description:
+          - A list of configuration dictionaries that are merged to produce the final configuration.
+          - Each element must have a 'name' key (filename).
+      bind9_default_config:
+        type: list
+        elements: dict
+        description: Default configuration.
+      bind9_group_config:
+        type: list
+        elements: dict
+        description: Group-level configuration.
+      bind9_site_config:
+        type: list
+        elements: dict
+        description: Site/Leaf-level configuration.
+      bind9_host_config:
+        type: list
+        elements: dict
+        description: Host-level configuration.
+      bind9_backup_config:
+        type: bool
+        default: true
+        description: Whether to backup configuration files before overwriting.
+      bind9_debug_config:
+        type: bool
+        default: false
+        description: Whether to print the merged configuration during execution.
+      bind9_config_indent:
+        type: int
+        default: 4
+        description: Indentation level for generated configuration files.
+      bind9_packages:
+        type: list
+        elements: str
+        description: List of packages to install.
+      bind9_cfgdir:
+        type: str
+        description: Directory for configuration files.
+      bind9_working_directory:
+        type: str
+        description: Working directory for BIND.
+      bind9_libdir:
+        type: str
+        description: Library directory for BIND.
+      bind9_backup_dir:
+        type: str
+        description: Directory for backups.

meta/main.yml

@@ -1,13 +1,13 @@
 ---
 galaxy_info:
   role_name: bind9
-  namespace: keepit
+  namespace: valid
 
   author: Daniel Akulenok
   description: Configure Bind9
-  company: Keepit
+  company: Valid.dk
 
-  issue_tracker_url: https://gitlab.off.keepit.com/operations/ansible-bind9-role
+  issue_tracker_url: https://git.valid.dk/daniel/ansible-bind9-role
 
   license: GPL-3.0-or-later
 

molecule/default/converge.yml

@@ -1,30 +1,6 @@
 ---
 - name: Converge
   hosts: all
-  vars:
-    bind9_group_config:
-      - name: named.conf.options
-        options:
-          directory: "{{ bind9_working_directory }}"
-          forwarders:
-            port: 853
-            tls: common-upstream
-            addresses:
-              - address: 192.0.2.10
-                port: 5353
-                tls: leaf-a
-              - address:
-                  - 2001:db8::10
-                  - 198.51.100.10
-                tls: dual-stack
-              - 203.0.113.10
-        tls:
-          - name: common-upstream
-            remote_hostname: upstream.example
-          - name: leaf-a
-            remote_hostname: leaf-a.example
-          - name: dual-stack
-            remote_hostname: dual-stack.example
   tasks:
     - name: Include bind9 role
       ansible.builtin.include_role:

molecule/default/molecule.yml

@@ -2,6 +2,13 @@
 driver:
   name: podman
 platforms:
+  - name: debian-bookworm
+    image: docker.io/jrei/systemd-debian:12
+    command: /lib/systemd/systemd
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
   - name: debian-trixie
     image: docker.io/jrei/systemd-debian:13
     command: /lib/systemd/systemd

molecule/default/verify.yml

@@ -1,21 +0,0 @@
----
-- name: Verify forwarders configuration
-  hosts: all
-  gather_facts: false
-  tasks:
-    - name: Read named.conf.options
-      ansible.builtin.slurp:
-        src: /etc/bind/named.conf.options
-      register: forwarders_file
-
-    - name: Assert forwarders render with port and tls
-      ansible.builtin.assert:
-        that:
-          - forwarders_content is search('forwarders port 853 tls common-upstream \{')
-          - forwarders_content is search('192.0.2.10 port 5353 tls leaf-a;')
-          - forwarders_content is search('2001:db8::10 tls dual-stack;')
-          - forwarders_content is search('198.51.100.10 tls dual-stack;')
-          - forwarders_content is search('203.0.113.10;')
-        fail_msg: "Forwarders block missing expected port/tls entries"
-      vars:
-        forwarders_content: "{{ forwarders_file.content | b64decode }}"

tasks/main.yml

@@ -16,20 +16,69 @@
     owner: root
     group: root
     mode: 0750
-  when: bind9_backup_config is defined and bind9_backup_config
+  when: bind9_backup_config is defined and bind9_backup_config | bool
 
-- name: Template named.conf.generator
+- name: Deploy and Validate Configuration
-  ansible.builtin.template:
+  block:
-    src: named.conf.generator.j2
+    - name: Create backup of current config
-    dest: "{{ bind9_cfgdir }}/{{ item.name }}"
+      ansible.builtin.copy:
-    owner: root
+        src: "{{ bind9_cfgdir }}/{{ item.name }}"
-    group: bind
+        dest: "{{ bind9_cfgdir }}/{{ item.name }}.bak"
-    mode: 0640
+        remote_src: true
-    backup: "{{ item.backup | default('false') | bool }}"
+        owner: root
-  # validate: 'named-checkconf -z -j %s'
+        group: bind
-  loop: "{{ bind9_config }}"
+        mode: 0640
-  loop_control:
+      failed_when: false # It's okay if the file doesn't exist yet
-    label: "{{ item.name }}"
+      # We do this for every file in the loop
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+    - name: Template named.conf.generator
+      ansible.builtin.template:
+        src: named.conf.generator.j2
+        dest: "{{ bind9_cfgdir }}/{{ item.name }}"
+        owner: root
+        group: bind
+        mode: 0640
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+      register: _template_result
+
+    - name: Validate configuration using named-checkconf
+      ansible.builtin.command:
+        cmd: "named-checkconf -z {{ bind9_cfgdir }}/named.conf"
+      changed_when: false
+
+  rescue:
+    - name: Restore configuration from backup
+      ansible.builtin.copy:
+        src: "{{ bind9_cfgdir }}/{{ item.name }}.bak"
+        dest: "{{ bind9_cfgdir }}/{{ item.name }}"
+        remote_src: true
+        owner: root
+        group: bind
+        mode: 0640
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+      failed_when: false # Best effort restore
+
+    - name: Fail due to invalid configuration
+      ansible.builtin.fail:
+        msg: "Configuration validation failed. Changes have been reverted. Check the logs for named-checkconf errors."
+
+  always:
+    - name: Remove backup files
+      ansible.builtin.file:
+        path: "{{ bind9_cfgdir }}/{{ item.name }}.bak"
+        state: absent
+      loop: "{{ bind9_config }}"
+      loop_control:
+        label: "{{ item.name }}"
+      when: bind9_backup_config | bool is false # Keep if backup is forced, otherwise cleanup temporary atomic backup
+  
   tags:
     - bind9
     - template

templates/named.conf.functions.j2

@@ -42,46 +42,6 @@
 {% endif %}
 {% endmacro %}
 
-{% macro list_address_port_tls(dict, indent=bind9_config_indent) %}
-{# This macro is for use for statements with grammar like #}
-{#  address port 00 tls string; address port 00 tls string; #}
-{# it is usually called by a parent macro #}
-{% filter indent(indent, true) %}
-{% for item in dict %}
-{% if item is not mapping %}
-{{ item }};
-{% elif item.address is string %}
-{{ item.address -}}
-{{- (' port ' + item.port | string) if item.port is defined and item.port -}}
-{{- (' tls ' + item.tls | string) if item.tls is defined and item.tls -}};
-{% elif item.address is sequence %}
-{% for address in item.address %}
-{{ address -}}
-{{- (' port ' + item.port | string) if item.port is defined and item.port -}}
-{{- (' tls ' + item.tls | string) if item.tls is defined and item.tls -}};
-{% endfor %}
-{% endif %}
-{% endfor %}
-{% endfilter %}
-{% endmacro %}
-
-{% macro parent_address_port_tls(name, dict) %}
-{# This macro is for statements with grammar like #}
-{# statement port 00 tls string { address port 00 tls string; address port 00 tls string; } #}
-{# the list inside the statement is handled by list_address_port_tls #}
-{% if dict is not mapping and dict is iterable %}
-{{ name }} {
-{{ list_address_port_tls(dict) -}}
-};
-{% else %}
-{{ name }}
-{{- (' port ' + dict.port | string) if dict.port is defined and dict.port -}}
-{{- (' tls ' + dict.tls | string) if dict.tls is defined and dict.tls }} {
-{{ list_address_port_tls(dict.addresses) -}}
-};
-{% endif %}
-{% endmacro %}
-
 {% macro list_address_port_dscp(dict, indent=bind9_config_indent) %}
 {# This macro is for use for statements with grammar like #}
 {#  address port 00 dscp 00; address port 00 dscp 00; #}
@@ -105,14 +65,12 @@
 {# the list inside the statement is handled by list_address_port #}
 {% if dict is not mapping and dict is iterable %}
 {{ name }} {
-{{ list_address_port_dscp(dict) }}
+{{ list_address_port_dscp(dict) }}};
-};
 {% else %}
 {{ name }}
 {{- (' port ' + dict.port | string) if dict.port is defined and dict.port -}}
 {{- (' dscp ' + dict.dscp | string) if dict.dscp is defined and dict.dscp }} {
-{{ list_address_port_dscp(dict.addresses) }}
+{{ list_address_port_dscp(dict.addresses) }}};
-};
 {% endif %}
 {% endmacro %}
 

templates/named.conf.options.j2

@@ -101,7 +101,7 @@ listen-on
 {{ functions.simple_item_list(item.options.listen_on.addresses) }}};
 {% endfor %}
 {% endif %}
-{{ functions.parent_address_port_tls('forwarders', item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}}
+{{ functions.parent_address_port_dscp("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}}
 {% if item.options.dual_stack_servers is defined and item.options.dual_stack_servers %}
 dual-stack-servers
 {{ (' port ' + item.options.dual_stack_servers.port | string) if item.options.dual_stack_servers.port is defined and item.options.dual_stack_servers }} {

templates/named.conf.zone.j2

@@ -47,7 +47,7 @@ server-names {
 server-addresses {
 {{ functions.simple_item_list(zone.server_addresses) }}};
 {% endif %}
-{{ functions.parent_address_port_tls('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}}
+{{ functions.parent_address_port_dscp('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}}
 {% if zone.allow_transfer is defined and zone.allow_transfer is not string %}
 allow-transfer
 {{- (' port ' + zone.allow_transfer.port | string) if zone.allow_transfer.port is defined and zone.allow_transfer.port -}}