xai-corp.net/provisioning
1
0
Fork 0
Code Issues 9 Releases Activity

setup bind config files in ns.xai-corp.net role

Browse Source
This commit is contained in:
richard
2015-09-20 15:41:18 -04:00
parent c639e5dc4b
commit c187c1005c
14 changed files with 380 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
roles/ns.xai-corp.net/templates/localhost.zone.j2 Normal file
View File

@@ -0,0 +1,12 @@
$TTL 1W
@ IN SOA localhost. root.localhost. (
20150920 ; Serial
28800 ; Refresh
14400 ; Retry
604800 ; Expire - 1 week
86400 ) ; Minimum
@ IN NS localhost.
@ IN A 127.0.0.1
@ IN AAAA ::1

205
roles/ns.xai-corp.net/templates/named.conf.j2 Normal file
View File

@@ -0,0 +1,205 @@
/*
* Refer to the named.conf(5) and named(8) man pages, and the documentation
* in /usr/share/doc/bind-9 for more details.
* Online versions of the documentation can be found here:
* http://www.isc.org/software/bind/documentation
*
* If you are going to set up an authoritative server, make sure you
* understand the hairy details of how DNS works. Even with simple mistakes,
* you can break connectivity for affected parties, or cause huge amounts of
* useless Internet traffic.
*/
acl "xfer" {
/* Deny transfers by default except for the listed hosts.
* If we have other name servers, place them here.
*/
none;
};
/*
* You might put in here some ips which are allowed to use the cache or
* recursive queries
*/
acl "trusted" {
127.0.0.0/8;
192.168.2.0/24;
::1/128;
};
options {
directory "/var/bind";
pid-file "/var/run/named/named.pid";
/* https://www.isc.org/solutions/dlv >=bind-9.7.x only */
//bindkeys-file "/etc/bind/bind.keys";
/*listen-on-v6 { ::1; };*/
listen-on { 127.0.0.1; 192.168.2.12; };
allow-query {
/*
* Accept queries from our "trusted" ACL. We will
* allow anyone to query our master zones below.
* This prevents us from becoming a free DNS server
* to the masses.
*/
trusted;
};
allow-query-cache {
/* Use the cache for the "trusted" ACL. */
trusted;
};
// allow-recursion {
// /* Only trusted addresses are allowed to use recursion. */
// trusted;
// };
allow-transfer {
/* Zone tranfers are denied by default. */
none;
};
allow-update {
/* Don't allow updates, e.g. via nsupdate. */
none;
};
/*
* If you've got a DNS server around at your upstream provider, enter its
* IP address here, and enable the line below. This will make you benefit
* from its cache, thus reduce overall DNS traffic in the Internet.
*
* Uncomment the following lines to turn on DNS forwarding, and change
* and/or update the forwarding ip address(es):
*/
forward first;
forwarders {
// 207.164.234.129; // Your ISP NS
// 207.164.234.193; // Your ISP NS
// 4.2.2.1; // Level3 Public DNS
// 4.2.2.2; // Level3 Public DNS
8.8.8.8; // Google Open DNS
8.8.4.4; // Google Open DNS
};
//dnssec-enable yes;
//dnssec-validation yes;
/*
* As of bind 9.8.0:
* "If the root key provided has expired,
* named will log the expiration and validation will not work."
*/
//dnssec-validation auto;
/* if you have problems and are behind a firewall: */
//query-source address * port 53;
};
logging {
channel default_log {
file "/var/log/named/named.log" versions 3 size 5M;
severity notice;
print-time yes;
print-severity yes;
print-category yes;
};
category default { default_log; };
category general { default_log; };
};
include "/etc/bind/rndc.key";
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1/24; ::1/128; } keys { "rndc-key"; };
};
view "internal" {
match-clients { 192.168.2.12; localhost; 192.168.2.0/24; };
recursion yes;
zone "." in {
type hint;
file "/var/bind/named.cache";
};
zone "localhost" IN {
type master;
file "pri/localhost.zone";
notify no;
};
zone "127.in-addr.arpa" IN {
type master;
file "pri/localhost.zone";
notify no;
};
zone "xai-corp.net." IN {
type master;
file "pri/xai-corp.net.internal";
allow-transfer { none; };
};
zone "2.168.192.in-addr.arpa." IN {
type master;
file "pri/xai-corp.net.reverse";
allow-update { none; };
};
};
view "external" {
match-clients { none; };
recursion no;
// zone "xai-corp.net" {
// type master;
// file "pri/xai-corp.net.external";
// allow-query { none; };
// allow-transfer { 127.0.0.1; };
// };
};
/*
* Briefly, a zone which has been declared delegation-only will be effectively
* limited to containing NS RRs for subdomains, but no actual data beyond its
* own apex (for example, its SOA RR and apex NS RRset). This can be used to
* filter out "wildcard" or "synthesized" data from NAT boxes or from
* authoritative name servers whose undelegated (in-zone) data is of no
* interest.
* See http://www.isc.org/software/bind/delegation-only for more info
*/
//zone "COM" { type delegation-only; };
//zone "NET" { type delegation-only; };
//zone "YOUR-DOMAIN.TLD" {
// type master;
// file "/var/bind/pri/YOUR-DOMAIN.TLD.zone";
// allow-query { any; };
// allow-transfer { xfer; };
//};
//zone "YOUR-SLAVE.TLD" {
// type slave;
// file "/var/bind/sec/YOUR-SLAVE.TLD.zone";
// masters { <MASTER>; };
/* Anybody is allowed to query but transfer should be controlled by the master. */
// allow-query { any; };
// allow-transfer { none; };
/* The master should be the only one who notifies the slaves, shouldn't it? */
// allow-notify { <MASTER>; };
// notify no;
//};

17
roles/ns.xai-corp.net/templates/xai-corp.net.external.j2 Normal file
View File

@@ -0,0 +1,17 @@
$ORIGIN xai-corp.net.
$TTL 2d
@ IN SOA ns.xai-corp.net. root.xai-corp.net. (
20150920;serial
3h ;refresh
1h ;retry
1w ;expiry
1d ) ;minimum
xai-corp.net. IN NS ns.xai-corp.net.
xai-corp.net. IN A 208.94.116.179
xai-corp.net. IN A 208.94.116.21
xai-corp.net. IN A 208.94.117.26
www.xai-corp.net. IN A 208.94.116.179
www.xai-corp.net. IN A 208.94.116.21
www.xai-corp.net. IN A 208.94.117.26

34
roles/ns.xai-corp.net/templates/xai-corp.net.internal.j2 Normal file
View File

@@ -0,0 +1,34 @@
$TTL 1D
@ IN SOA xai-corp.net. root.xai-corp.net. (
20150920; serial
3h ; refresh
1h ; retry
1w ; expiry
1d ) ; minimum
xai-corp.net. IN NS ns.xai-corp.net.
xai-corp.net. IN MX 0 mail.xai-corp.net.
xai-corp.net. IN TXT "v=spf1 ip4:192.168.2.12/32 mx ptr mx:mail.xai-corp.net ~all"
ns IN A 192.168.2.12
mail IN A 192.168.2.12
getafix IN CNAME ns
test IN CNAME ns
home IN CNAME ns
tunedb IN CNAME ns
sql IN CNAME ns
jenkins IN CNAME ns
cik IN CNAME ns
phonecat IN CNAME ns
blog IN CNAME ns
www IN A 208.94.116.179
IN A 208.94.116.21
IN A 208.94.117.26
gateway IN A 192.168.2.1
wireless IN A 192.168.2.3
printer IN A 192.168.2.13
scanner IN CNAME printer
laser IN A 192.168.2.14
tv IN A 192.168.2.16
xaicorp1 IN A 192.168.2.103
garden IN A 192.168.2.20

19
roles/ns.xai-corp.net/templates/xai-corp.net.reverse.j2 Normal file
View File

@@ -0,0 +1,19 @@
$TTL 24h
$ORIGIN 2.168.192.IN-ADDR.ARPA.
@ IN SOA ns.xai-corp.net. root.xai-corp.net. (
20150920; serial
3h ; refresh
1h ; retry
1w ; expiry
1d ) ; minimum
@ IN NS ns.xai-corp.net.
1 IN PTR gateway.xai-corp.net.
3 IN PTR wireless.xai-corp.net.
13 IN PTR printer.xai-corp.net.
14 IN PTR laser.xai-corp.net.
16 IN PTR tv.xai-corp.net.
103 IN PTR xaicorp1.xai-corp.net.
12 IN PTR home.xai-corp.net.