main
parent
dbe8bd5f14
commit
7d1b92a9da
SSH Key Fingerprint:
SHA256:3fOT8fiYQG/aK9ntivV3Bqtg8AYQ7q4nV6ZgihOA20g
@ -0,0 +1,66 @@
|
||||
- hosts: on-fire-within
|
||||
become: yes
|
||||
vars_files:
|
||||
- vars.private
|
||||
tasks:
|
||||
|
||||
# Workaround for https://github.com/pi-hole/docker-pi-hole/issues/1048
|
||||
# - https://github.com/pi-hole/docker-pi-hole/issues/1042#issuecomment-1086728157
|
||||
# - https://github.com/pi-hole/docker-pi-hole/issues/1043#issuecomment-1086936352
|
||||
- name: Work around a Docker libseccomp issue w/Pi-Hole
|
||||
block:
|
||||
- apt_key:
|
||||
keyserver: keyserver.ubuntu.com
|
||||
id: "{{ item }}"
|
||||
loop:
|
||||
- 0E98404D386FA1D9
|
||||
- 6ED0E7B82643E131
|
||||
- apt_repository:
|
||||
repo: deb http://deb.debian.org/debian buster-backports main
|
||||
filename: buster-backports
|
||||
state: present
|
||||
- shell: apt-cache policy libseccomp2 | grep buster-backports -B1 | head -n1 | sed -e 's/^\s*\**\s*\(\S*\).*/\1/'
|
||||
register: libseccomp2_version
|
||||
- apt:
|
||||
update_cache: yes
|
||||
name: libseccomp2={{ libseccomp2_version.stdout_lines[0] }}
|
||||
|
||||
# https://docs.pi-hole.net/guides/dns/unbound/
|
||||
- name: Set up Pi-hole as recursive DNS server
|
||||
block:
|
||||
- name: Install unbound
|
||||
apt:
|
||||
name: unbound
|
||||
- name: Configure unbound
|
||||
ansible.builtin.copy:
|
||||
src: unbound.conf
|
||||
dest: /etc/unbound/unbound.conf.d/pi-hole.conf
|
||||
notify: Restart unbound
|
||||
- name: Use the same limit for FTL as unbound
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/dnsmasq.d/99-edns.conf
|
||||
line: edns-packet-max=1232
|
||||
create: true
|
||||
|
||||
- name: Disable resolvconf.conf entry for unbound
|
||||
block:
|
||||
- name: Disable unbound-resolvconf.service
|
||||
service:
|
||||
name: unbound-resolvconf
|
||||
enabled: false
|
||||
- name: Disable resolvconf_resolvers.conf from being generated
|
||||
ansible.builtin.replace:
|
||||
path: /etc/resolvconf.conf
|
||||
regexp: '^unbound_conf='
|
||||
replace: '#unbound_conf='
|
||||
- name: Remove resolvconf_resolvers.conf
|
||||
ansible.builtin.file:
|
||||
path: /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
|
||||
state: absent
|
||||
notify: Restart unbound
|
||||
|
||||
handlers:
|
||||
- name: Restart unbound
|
||||
ansible.builtin.service:
|
||||
name: unbound
|
||||
state: restarted
|
||||
@ -0,0 +1,66 @@
|
||||
server:
|
||||
# If no logfile is specified, syslog is used
|
||||
# logfile: "/var/log/unbound/unbound.log"
|
||||
verbosity: 1
|
||||
|
||||
interface: 127.0.0.1
|
||||
port: 5335
|
||||
do-ip4: yes
|
||||
do-udp: yes
|
||||
do-tcp: yes
|
||||
|
||||
# May be set to yes if you have IPv6 connectivity
|
||||
do-ip6: no
|
||||
|
||||
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
|
||||
# Terredo tunnels your web browser should favor IPv4 for the same reasons
|
||||
prefer-ip6: no
|
||||
|
||||
# Use this only when you downloaded the list of primary root servers!
|
||||
# If you use the default dns-root-data package, unbound will find it automatically
|
||||
#root-hints: "/var/lib/unbound/root.hints"
|
||||
|
||||
# Trust glue only if it is within the server's authority
|
||||
harden-glue: yes
|
||||
|
||||
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
|
||||
harden-dnssec-stripped: yes
|
||||
|
||||
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
|
||||
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
|
||||
use-caps-for-id: no
|
||||
|
||||
# Reduce EDNS reassembly buffer size.
|
||||
# IP fragmentation is unreliable on the Internet today, and can cause
|
||||
# transmission failures when large DNS messages are sent via UDP. Even
|
||||
# when fragmentation does work, it may not be secure; it is theoretically
|
||||
# possible to spoof parts of a fragmented DNS message, without easy
|
||||
# detection at the receiving end. Recently, there was an excellent study
|
||||
# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
|
||||
# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
|
||||
# in collaboration with NLnet Labs explored DNS using real world data from the
|
||||
# the RIPE Atlas probes and the researchers suggested different values for
|
||||
# IPv4 and IPv6 and in different scenarios. They advise that servers should
|
||||
# be configured to limit DNS messages sent over UDP to a size that will not
|
||||
# trigger fragmentation on typical network links. DNS servers can switch
|
||||
# from UDP to TCP when a DNS response is too big to fit in this limited
|
||||
# buffer size. This value has also been suggested in DNS Flag Day 2020.
|
||||
edns-buffer-size: 1232
|
||||
|
||||
# Perform prefetching of close to expired message cache entries
|
||||
# This only applies to domains that have been frequently queried
|
||||
prefetch: yes
|
||||
|
||||
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
|
||||
num-threads: 1
|
||||
|
||||
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
|
||||
so-rcvbuf: 1m
|
||||
|
||||
# Ensure privacy of local IP ranges
|
||||
private-address: 192.168.0.0/16
|
||||
private-address: 169.254.0.0/16
|
||||
private-address: 172.16.0.0/12
|
||||
private-address: 10.0.0.0/8
|
||||
private-address: fd00::/8
|
||||
private-address: fe80::/10
|
||||
Loading…
Reference in new issue