init: add ansible-dns

.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+---
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+  workflow_dispatch:
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+
+      - name: Install test dependencies
+        run: pip3 install ansible yamllint==1.30.0 ansible-lint==6.14.6
+
+      - name: Ansible-lint
+        run: ansible-lint playbook.yml
+
+      - name: Lint yaml files
+        run: yamllint .

.gitignore

@@ -0,0 +1 @@
+*.retry

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+---
+repos:
+  # - repo: https://github.com/ansible-community/ansible-lint.git
+  #   rev: v6.14.6
+  #   hooks:
+  #     - id: ansible-lint
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.30.0
+    hooks:
+      - id: yamllint

.vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+    "recommendations": [
+        "redhat.ansible",
+        "redhat.vscode-yaml",
+        "tamasfe.even-better-toml",
+        "ybaumes.highlight-trailing-white-spaces"
+    ]
+}

.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+    "yaml.schemaStore.enable": false,
+    "ansible.python.interpreterPath": "/bin/python"
+}

.yamllint

@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length:
+    max: 180
+    level: warning

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Nebula
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,20 @@
+.PHONY: help run install checks
+
+help:
+	@echo Ansible-DNS Development Help
+	@echo -------------------------------------------------------------------------
+	@echo run     : Run the playbook
+	@echo install : Install requirements
+	@echo checks  : Run syntax and pre-commit checks
+	@echo -------------------------------------------------------------------------
+
+run:
+	ansible-playbook -i inventories/sample/hosts playbook.yml -b
+
+install:
+	ansible-galaxy install -r requirements.yml
+
+checks:
+	ansible-playbook playbook.yml --syntax-check
+	pre-commit run --all-files
+

README.md

@@ -0,0 +1,41 @@
+# Ansible-DNS
+
+Deploy a fast recursive DNS server with Ansible.
+
+## Requirements
+
+- Linux machine with a modern Python version
+- Another Linux machine with a fresh Debian/Ubuntu installation
+
+## Installation
+
+1. Install Ansible and jmespath on the host: `pip install ansible jmespath`
+2. Clone this repo: `git clone https://github.com/itsnebulalol/ansible-dns && cd ansible-dns`
+3. Prepare your host file: `cp -rfp inventories/sample inventories/my-inventory`
+4. Edit your hosts file (`inventories/my-inventory/hosts`)
+5. Modify `group_vars/all.yml` to your needs
+6. Install dependencies: `ansible-galaxy install -r requirements.yml`
+7. Run the playbook: `ansible-playbook -i inventories/my-inventory/hosts playbook.yml -b -K`
+
+## Uninstallation
+
+Coming soon
+
+## License
+
+This repository is licensed under the MIT License. A copy is included when cloning the repository, and can also be found [here](https://github.com/itsnebulalol/ansible-dns/blob/main/LICENSE).
+
+## I need help
+
+Please open an [issue](https://github.com/itsnebulalol/ansible-dns/issues) if you think there is a bug.
+
+## Support
+
+If you would like to support my work, you can [sponsor me with GitHub Sponsors](https://github.com/sponsors/itsnebulalol)!
+
+## Credits
+
+- [ansible-nas](https://github.com/davestephens/ansible-nas)
+- [ansible-role-blocky-dns](https://github.com/ngine-io/ansible-role-blocky-dns)
+- [ansible-role-unbound](https://github.com/publicarray/ansible-role-unbound) ([fork](https://github.com/itsnebulalol/ansible-role-unbound))
+- [unbound-docker](https://github.com/MatthewVance/unbound-docker)

ansible.cfg

@@ -0,0 +1,10 @@
+[defaults]
+retry_files_enabled = False
+
+# fact caching
+gathering = smart
+fact_caching = jsonfile
+fact_caching_connection = /tmp/facts_cache
+
+# two hours timeout
+fact_caching_timeout = 7200

group_vars/all.yml

@@ -0,0 +1,95 @@
+sysctl_config:
+  net.ipv4.ip_forward: 1
+  net.ipv4.conf.all.forwarding: 1
+  net.ipv6.conf.all.forwarding: 1
+  net.core.rmem_max: 4194304
+  net.core.wmem_max: 4194304
+
+unbound_compile: true
+unbound_compile_version: 1.19.0
+unbound_compile_sha256: a97532468854c61c2de48ca4170de854fd3bc95c8043bb0cfb0fe26605966624
+
+unbound_optimise: true
+unbound_optimise_memory: 80
+unbound:
+  server:
+    cache_max_ttl: 86400
+    cache_min_ttl: 300
+    root_hints: "root.hints"
+    do_ip4: yes
+    do_ip6: yes
+    do_tcp: yes
+    do_udp: yes
+    edns_buffer_size: 1232
+    interface: 0.0.0.0@5053
+    port: 5053
+    prefer_ip6: no
+    rrset_roundrobin: yes
+    username: "unbound"
+    directory: "/usr/local/etc/unbound"
+    chroot: "/usr/local/etc/unbound"
+
+    log_local_actions: no
+    log_queries: no
+    log_replies: no
+    log_servfail: no
+    logfile: unbound.log
+    verbosity: 1
+
+    infra_cache_slabs: 4
+    incoming_num_tcp: 10
+    key_cache_slabs: 4
+    msg_cache_size: 142768128
+    msg_cache_slabs: 4
+    num_queries_per_thread: 4096
+    num_threads: 4
+    outgoing_range: 8192
+    rrset_cache_size: 285536256
+    rrset_cache_slabs: 4
+    minimal_responses: yes
+    prefetch: yes
+    prefetch_key: yes
+    serve_expired: yes
+    so-rcvbuf: 4m
+    so_sndbuf: 4m
+    so_reuseport: yes
+
+    aggressive_nsec: yes
+    delay_close: 10000
+    do_daemonize: no
+    do_not_query_localhost: no
+    neg_cache_size: 4M
+    qname_minimisation: yes
+
+    auto_trust_anchor_file: root.key
+    deny_any: yes
+    harden_algo_downgrade: yes
+    harden_below_nxdomain: yes
+    harden_dnssec_stripped: yes
+    harden_glue: yes
+    harden_large_queries: yes
+    harden_referral_path: no
+    harden_short_bufsize: yes
+    hide_http_user_agent: no
+    hide_identity: yes
+    hide_version: yes
+    http_user_agent: "DNS"
+    identity: "DNS"
+
+    ratelimit: 1000
+    tls_cert_bundle: /etc/ssl/certs/ca-certificates.crt
+    unwanted_reply_threshold: 10000
+    use_caps_for_id: yes
+    val_clean_additional: yes
+
+    private_address:
+      - 127.0.0.0/8
+      - 10.0.0.0/8 # private networks (RFC 1918)
+      - 172.16.0.0/12
+      - 192.168.0.0/16
+      - 169.254.0.0/16 # link_local network (RFC 3927)
+      - fd00::/8
+      - fe80::/10
+
+  remote_control:
+    control_enable: false

inventories/sample/hosts

@@ -0,0 +1,12 @@
+# To connect using a non-root user (and elevate to root with sudo later),
+# replace `ansible_ssh_user=root` with something like this: `ansible_ssh_user=username become=true become_user=root`
+#
+# If you're running this Ansible playbook on the same server as the one you're installing to,
+# consider adding an additional `ansible_connection=local` argument to the host line below.
+#
+# Ansible may fail to discover which Python interpreter to use on the host for some distros (like Ubuntu 20.04).
+# You may sometimes need to explicitly add the argument `ansible_python_interpreter=/usr/bin/python3`
+# to the host line below.
+
+[all]
+server1     ansible_host=192.168.1.10

playbook.yml

@@ -0,0 +1,35 @@
+---
+- name: Ansible-DNS
+  hosts: all
+  become: true
+
+  pre_tasks:
+    - name: Set sysctl config
+      ansible.posix.sysctl:
+        name: '{{ item.key }}'
+        value: '{{ item.value }}'
+        sysctl_set: true
+        state: present
+        reload: true
+        ignoreerrors: true
+      with_dict: '{{ sysctl_config }}'
+
+  #   - name: Check if port 53 is in use
+  #     ansible.builtin.wait_for:
+  #       host: localhost
+  #       port: 53
+  #       timeout: 1
+  #     register: port_53_status
+  #     ignore_errors: true
+
+  #   - name: Disable systemd-resolved
+  #     ansible.builtin.systemd:
+  #       name: systemd-resolved
+  #       state: stopped
+  #       enabled: false
+  #       masked: true
+  #     when: port_53_status.elapsed < 1
+
+  roles:
+    - unbound
+    - blocky

requirements-dev.txt

@@ -0,0 +1 @@
+pre-commit

requirements.yml

@@ -0,0 +1,7 @@
+collections:
+  - community.general
+
+roles:
+  - name: unbound
+    src: https://github.com/itsnebulalol/ansible-role-unbound
+    version: master

roles/blocky/defaults/main.yml

@@ -0,0 +1,46 @@
+---
+blocky_version: v0.23
+blocky_base: "blocky-{{ blocky_version }}"
+blocky_arch: "{{ ansible_machine }}"
+blocky_system: "{{ ansible_system }}"
+blocky_base_url: https://github.com/0xERR0R/blocky/releases/download
+blocky_download_url: "{{ blocky_base_url }}/{{ blocky_version }}/blocky_{{ blocky_version }}_{{ blocky_system }}_{{ blocky_arch }}.tar.gz"
+blocky_checksum_url: "{{ blocky_base_url }}/{{ blocky_version }}/blocky_checksums.txt"
+blocky_download_path: /tmp
+blocky_install_path: /opt/blocky
+
+blocky_blocking_ttl: 1h
+
+blocky_blocking_client_groups_block:
+  default:
+    - ads
+    - malware
+
+blocky_blocking_blacklists:
+  ads:
+    - https://github.com/T145/black-mirror/releases/download/latest/BLOCK_DOMAIN.txt
+    - https://big.oisd.nl
+    - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt
+    - https://gist.github.com/itsnebulalol/21205b44c081be2b2417829d4396408b/raw/blocklist.txt
+  malware:
+    - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt
+
+blocky_blocking_whitelists:
+  ads:
+    - https://github.com/T145/black-mirror/releases/download/latest/ALLOW_DOMAIN.txt
+    - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/whitelist.txt
+    - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/whitelist-referral.txt
+    - https://gist.github.com/itsnebulalol/21205b44c081be2b2417829d4396408b/raw/allowlist.txt
+
+blocky_ports_dns: 53
+blocky_ports_http: 4000
+
+blocky_log_level: info
+
+blocky_upstreams:
+  default:
+    - 127.0.0.1:5053
+
+blocky_custom_dns: {}
+
+blocky_custom_domain: {}

roles/blocky/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart blocky
+  ansible.builtin.systemd:
+    name: blocky
+    state: restarted