summaryrefslogtreecommitdiff
path: root/puppet/modules/site_config/manifests/caching_resolver.pp
blob: 5541472d722df494a43d10703610f87f99089c10 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# deploy local caching resolver
class site_config::caching_resolver {
  tag 'leap_base'

  # We need to make sure Package['bind9'] isn't installed because when it is, it
  # keeps unbound from running. Some base debian installs will install bind9,
  # and then start it, so unbound will never get properly started. So this will
  # make sure bind9 is removed before.
  package { 'bind9':
    ensure => purged
  }

  class { 'unbound':
    root_hints => false,
    anchor     => false,
    ssl        => false,
    require    => Package['bind9'],
    settings   => {
      server => {
        verbosity      => '1',
        interface      => [ '127.0.0.1', '::1' ],
        port           => '53',
        hide-identity  => 'yes',
        hide-version   => 'yes',
        harden-glue    => 'yes',
        access-control => [ '127.0.0.0/8 allow', '::1 allow' ]
      }
    }
  }

  concat::fragment { 'unbound glob include':
    target  => $unbound::params::config,
    content => "include: /etc/unbound/unbound.conf.d/*.conf\n\n",
    order   => 10
  }
}