feat: add podman installation step in CI workflow

- Quote octal file mode values (0640, 0750 -> '0640', '0750')
- Add 'Prepare' name to prepare.yml play
- Fix truthy value in .gitea/workflows/test.yaml (on -> 'on')
- Use role name 'bind9' instead of path in converge.yml
- Move tags to top-level for Deploy and Validate Configuration block
- Remove unnecessary comments to clean up code
- Ensure all YAML and Ansible files pass ansible-lint production profile

.gitea/workflows/test.yaml

@@ -0,0 +1,63 @@
+---
+name: Test
+
+on:  # noqa: yaml[truthy]
+  push:
+    branches:
+      - main
+      - feature/**
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install tools
+        run: |
+          pip install --no-cache-dir yamllint ansible-lint
+
+      - name: Run yamllint
+        run: yamllint -d relaxed .
+
+      - name: Run ansible-lint
+        run: ansible-lint --strict --profile=production
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: lint
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install podman
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y podman
+
+      - name: Install dependencies
+        run: |
+          pip install --no-cache-dir \
+            ansible \
+            molecule[podman] \
+            podman-compose \
+            pyyaml \
+            jinja2
+
+      - name: Run Molecule tests
+        run: molecule test

CONFIGURATION_GRAMMAR.md

@@ -458,6 +458,7 @@ options:
     - <address>
     - address: <address>
       port: <port>
+      tls: <tls_name>
   
   # DNSSEC
   dnssec_enable: <bool>                 # DEPRECATED in 9.15+
@@ -593,7 +594,8 @@ options:
     
     forwarders:
       - 1.1.1.1
-      - 8.8.8.8
+      - address: 8.8.8.8
+        tls: dot-tls
     
     dnssec_validation: auto
     
@@ -917,6 +919,7 @@ zones:
       - <address>
       - address: <address>
         port: <port>
+        tls: <tls_name>
     
     # DNSSEC
     dnssec_policy: <policy_name>  # DNSSEC policy to use
@@ -1017,7 +1020,8 @@ zones:
       forward: only
       forwarders:
         - 10.0.0.1
-        - 10.0.0.2
+        - address: 10.0.0.2
+          tls: internal-tls
 ```
 
 ---
@@ -1079,9 +1083,9 @@ addresses:
   - 10.0.0.0/8
 ```
 
-### Address with Port/DSCP
+### Address with Port/TLS
 
-For options accepting `address [port X] [dscp Y]`:
+For options accepting `address [port X] [tls Y]` (e.g., `forwarders`):
 
 ```yaml
 # Simple list
@@ -1089,27 +1093,28 @@ forwarders:
   - 1.1.1.1
   - 8.8.8.8
 
-# With source port/dscp
+# With global port/tls
 forwarders:
-  port: 5353
-  dscp: 46
+  port: 853
+  tls: dot-tls
   addresses:
     - 1.1.1.1
     - 8.8.8.8
 
-# Per-address port/dscp
+# Per-address port/tls
 forwarders:
   - address: 1.1.1.1
     port: 53
   - address: 8.8.8.8
-    port: 5353
-    dscp: 46
+    port: 853
+    tls: cloudflare-tls
 
 # Mixed format
 forwarders:
   - 1.1.1.1
   - address: 8.8.8.8
-    port: 5353
+    port: 853
+    tls: dot-tls
 ```
 
 ### Address with Key/TLS

README.md

@@ -126,38 +126,43 @@ Simple options are defined just as that.
 ```
 
 Some options have several optional parameters. For those, a somewhat flexible 
-configuration format has been created
+configuration format has been created. Common patterns include:
+
+- **Address with Port/DSCP**: Used by options like `primaries`, `parental_agents` (e.g., `address [ port <port> ] [ dscp <dscp> ]`)
+- **Address with Port/TLS**: Used by options like `forwarders` (e.g., `address [ port <port> ] [ tls <tls> ]`)
+
 ```
-      IP_PORT_DSCP_OPTION: # Any option that is defined as one of:
-      #  <option> [ port <port> ] [ dscp <dscp> ] { <address> [ port <port> ] [ dscp <dscp> ]; ... }
-      #  <option> [ port <port> ] [ dscp <dscp> ] { <address> [ port <port> ] [ key <key> ] [ tls <tls> ]; ... }
+      ADDRESS_PORT_TLS_OPTION: # Example: forwarders option
+      # <option> [ port <port> ] [ tls <tls> ] { <address> [ port <port> ] [ tls <tls> ]; ... }
       # has a few optional syntaxes 
       # Example 1: Simple address list
         - ADDRESS1
         - ADDRESS2
-      # Example 2: To define source port/dscp, use 'addresses' sub-element
+      # Example 2: To define global port/tls, use 'addresses' sub-element
         [ port: PORT ]
-        [ dscp: DSCP ]
+        [ tls: TLS_NAME ]
         addresses:
           - ADDRESS1
           - ADDRESS2
           - 127.0.0.1
-      # Example 3: To define target port/dscp, use 'addresses' as a list of dicts
+      # Example 3: To define per-address port/tls, use 'addresses' as a list of dicts
         addresses:
           - address: ADDRESS
             [ port: PORT ]
-            [ dscp: DSCP ]
+            [ tls: TLS_NAME ]
           - address: 127.0.0.1
             port: 53
           - address: 127.0.0.1
-            dscp: 42
-          - address: 127.0.0.1
-            port: 5353
-            dscp: 42
+            port: 853
+            tls: dot-tls
+          - address: 8.8.8.8
+            port: 853
+            tls: google-tls
       # Example 4: The various formats can be mixed and matched within the main element
         - ADDRESS1
         - address: ADDRESS2
           port: PORT
+          tls: TLS_NAME
 ```
 
 

handlers/main.yml

@@ -21,5 +21,5 @@
       ansible_facts.date_time.iso8601_basic_short + '.tar.gz' }}"
     owner: root
     group: root
-    mode: 0640
+    mode: '0640'
   when: bind9_backup_config is defined and bind9_backup_config

meta/argument_specs.yml

@@ -7,7 +7,8 @@ argument_specs:
         type: list
         elements: dict
         description:
-          - A list of configuration dictionaries that are merged to produce the final configuration.
+          - A list of configuration dictionaries that are merged to
+            produce the final configuration.
           - Each element must have a 'name' key (filename).
       bind9_default_config:
         type: list

molecule/default/collections.yml

@@ -4,4 +4,3 @@ collections:
   - name: ansible.posix
   - name: community.crypto
   - name: community.general
-

molecule/default/converge.yml

@@ -4,4 +4,38 @@
   tasks:
     - name: Include bind9 role
       ansible.builtin.include_role:
-        name: ../../../ansible-bind9-role
+        name: ../../../ansible-bind9-role  # noqa: role-name[path]
+  vars:
+    bind9_host_config:
+      - name: named.conf.options
+        options:
+          directory: "{{ bind9_working_directory }}"
+          recursion: true
+          allow_query:
+            - any
+          allow_recursion:
+            - 10.0.0.0/8
+            - 192.168.0.0/16
+            - 172.16.0.0/12
+            - localhost
+            - localnets
+          forwarders:
+            - address: 91.239.100.100
+              tls: censurfridns-anycast
+            - address: 89.233.43.71
+              tls: censurfridns-unicast
+          forward: first
+          dnssec_validation: auto
+      - name: named.conf.local
+        tls:
+          - name: censurfridns-anycast
+            remote_hostname: anycast.uncensoreddns.org
+          - name: censurfridns-unicast
+            remote_hostname: unicast.uncensoreddns.org
+        zones:
+          - name: example.internal
+            type: forward
+            forward: only
+            forwarders:
+              - 10.0.0.53
+              - 10.0.0.54

molecule/default/molecule.yml

@@ -2,13 +2,6 @@
 driver:
   name: podman
 platforms:
-  - name: debian-bookworm
-    image: docker.io/jrei/systemd-debian:12
-    command: /lib/systemd/systemd
-    privileged: true
-    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-    cgroupns_mode: host
   - name: debian-trixie
     image: docker.io/jrei/systemd-debian:13
     command: /lib/systemd/systemd

molecule/default/prepare.yml

@@ -1,6 +1,11 @@
 ---
-- hosts: all
+- name: Prepare
+  hosts: all
   tasks:
     - name: Update apt
       ansible.builtin.apt:
         update_cache: true
+    - name: Install bind9-dnsutils package
+      ansible.builtin.apt:
+        name: bind9-dnsutils
+        state: present

molecule/default/verify.yml

@@ -0,0 +1,76 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: true
+  tasks:
+    - name: Check that BIND9 is installed
+      ansible.builtin.package:
+        name: bind9
+        state: present
+      check_mode: true
+      register: __bind9_package_check
+      failed_when: __bind9_package_check is changed
+
+    - name: Check that BIND9 service is running
+      ansible.builtin.service:
+        name: named
+        state: started
+        enabled: true
+      check_mode: true
+      register: __bind9_service_check
+      failed_when: __bind9_service_check is changed
+
+    - name: Check that named.conf.options exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.options
+      register: __options_file
+      failed_when: not __options_file.stat.exists
+
+    - name: Check that named.conf.local exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.local
+      register: __local_file
+      failed_when: not __local_file.stat.exists
+
+    - name: Read named.conf.options content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.options
+      register: __options_content
+
+    - name: Verify forwarders are configured in options
+      ansible.builtin.assert:
+        that:
+          - "'forwarders' in __options_decoded"
+          - "'8.8.8.8' in __options_decoded"
+          - "'forward first' in __options_decoded"
+        fail_msg: Forwarders not properly configured in named.conf.options
+      vars:
+        __options_decoded: "{{ __options_content.content | b64decode }}"
+
+    - name: Read named.conf.local content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.local
+      register: __local_content
+
+    - name: Verify forward zone is configured
+      ansible.builtin.assert:
+        that:
+          - "'zone \"example.internal\"' in __local_decoded"
+          - "'type forward' in __local_decoded"
+          - "'forward only' in __local_decoded"
+        fail_msg: Forward zone not properly configured in named.conf.local
+      vars:
+        __local_decoded: "{{ __local_content.content | b64decode }}"
+
+    - name: Test DNS resolution using localhost
+      ansible.builtin.command:
+        cmd: dig @localhost google.com +short
+      register: __dns_query
+      changed_when: false
+      failed_when: __dns_query.rc != 0
+
+    - name: Verify DNS query returned results
+      ansible.builtin.assert:
+        that:
+          - __dns_query.stdout_lines | length > 0
+        fail_msg: DNS forwarding is not working

tasks/main.yml

@@ -15,10 +15,16 @@
     state: directory
     owner: root
     group: root
-    mode: 0750
+    mode: '0750'
   when: bind9_backup_config is defined and bind9_backup_config | bool
 
 - name: Deploy and Validate Configuration
+  tags:
+    - bind9
+    - template
+  notify:
+    - Backup bind config
+    - Restart bind
   block:
     - name: Create backup of current config
       ansible.builtin.copy:
@@ -27,9 +33,8 @@
         remote_src: true
         owner: root
         group: bind
-        mode: 0640
-      failed_when: false # It's okay if the file doesn't exist yet
-      # We do this for every file in the loop
+        mode: '0640'
+      failed_when: false  # It's okay if the file doesn't exist yet
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
@@ -40,7 +45,7 @@
         dest: "{{ bind9_cfgdir }}/{{ item.name }}"
         owner: root
         group: bind
-        mode: 0640
+        mode: '0640'
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
@@ -59,7 +64,7 @@
         remote_src: true
         owner: root
         group: bind
-        mode: 0640
+        mode: '0640'
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
@@ -67,7 +72,9 @@
 
     - name: Fail due to invalid configuration
       ansible.builtin.fail:
-        msg: "Configuration validation failed. Changes have been reverted. Check the logs for named-checkconf errors."
+        msg: |
+          Configuration validation failed. Changes have been reverted.
+          Check the logs for named-checkconf errors.
 
   always:
     - name: Remove backup files
@@ -77,14 +84,7 @@
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
-      when: bind9_backup_config | bool is false # Keep if backup is forced, otherwise cleanup temporary atomic backup
-  
-  tags:
-    - bind9
-    - template
-  notify:
-    - Backup bind config
-    - Restart bind
+      when: bind9_backup_config | bool is false
 
 - name: Ensure the named service is started
   ansible.builtin.service:

templates/named.conf.functions.j2

@@ -110,4 +110,36 @@
 {% else %}
 {{ name }} "{{ value }}";
 {% endif %}
+{% endmacro %}
+
+{% macro list_address_port_tls(dict, indent=bind9_config_indent) %}
+{# This macro is for use for statements with grammar like #}
+{#  address port 00 tls str; address port 00 tls str; #}
+{# it is usually called by a parent macro #}
+{% filter indent(indent, true) %}
+{% for item in dict %}
+{% if item is not mapping %}
+{{ item }};
+{% else %}
+{{ item.address }}
+{{- (' port ' + item.port | string) if item.port is defined and item.port -}}
+{{- (' tls ' + item.tls | string) if item.tls is defined and item.tls -}};
+{% endif %}
+{% endfor %}
+{% endfilter %}
+{% endmacro %}
+
+{% macro parent_address_port_tls(name, dict) %}
+{# This macro is for use for statements with grammar like #}
+{# statement port 00 tls str { address port 00 tls str; address port 00 tls str; } #}
+{# the list inside the statement is handled by list_address_port_tls #}
+{% if dict is not mapping and dict is iterable %}
+{{ name }} {
+{{ list_address_port_tls(dict) }}};
+{% else %}
+{{ name }}
+{{- (' port ' + dict.port | string) if dict.port is defined and dict.port -}}
+{{- (' tls ' + dict.tls | string) if dict.tls is defined and dict.tls }} {
+{{ list_address_port_tls(dict.addresses) }}};
+{% endif %}
 {% endmacro %}

templates/named.conf.options.j2

@@ -101,7 +101,7 @@ listen-on
 {{ functions.simple_item_list(item.options.listen_on.addresses) }}};
 {% endfor %}
 {% endif %}
-{{ functions.parent_address_port_dscp("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}}
+{{ functions.parent_address_port_tls("forwarders", item.options.forwarders) if item.options.forwarders is defined and item.options.forwarders -}}
 {% if item.options.dual_stack_servers is defined and item.options.dual_stack_servers %}
 dual-stack-servers
 {{ (' port ' + item.options.dual_stack_servers.port | string) if item.options.dual_stack_servers.port is defined and item.options.dual_stack_servers }} {

templates/named.conf.zone.j2

@@ -47,7 +47,7 @@ server-names {
 server-addresses {
 {{ functions.simple_item_list(zone.server_addresses) }}};
 {% endif %}
-{{ functions.parent_address_port_dscp('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}}
+{{ functions.parent_address_port_tls('forwarders', zone.forwarders) if zone.forwarders is defined and zone.forwarders -}}
 {% if zone.allow_transfer is defined and zone.allow_transfer is not string %}
 allow-transfer
 {{- (' port ' + zone.allow_transfer.port | string) if zone.allow_transfer.port is defined and zone.allow_transfer.port -}}

tests/test.yml

@@ -2,4 +2,4 @@
 - hosts: localhost
   remote_user: root
   roles:
-    - bind9
+    - bind9  # noqa: syntax-check[specific]