Initial commit

files/redxen-dns.conf

@@ -0,0 +1,62 @@
+server:
+	local-zone: "redxen.eu." static
+	local-data: "redxen.eu. 10800 IN NS ns0.redxen.eu"
+	local-data: "redxen.eu. 10800 IN NS ns1.redxen.eu"
+	local-data: "redxen.eu. 10800 IN NS ns2.redxen.eu"
+	local-data: "redxen.eu. 10800 IN NS ns3.redxen.eu"
+	local-data: "redxen.eu. 10800 IN NS ns4.redxen.eu"
+
+	local-data: "_amazonses.redxen.eu. 86400 IN TXT PAdK+hmtSCYH2lDwBdiCfJDxyhBj2UHJtwQzL7+kh50="
+	local-data: "6jxdve2mevelrsc4lrp5ymhu2pku67v4._domainkey.redxen.eu. 86400 IN CNAME 6jxdve2mevelrsc4lrp5ymhu2pku67v4.dkim.amazonses.com"
+	local-data: "jqo2wv2wek7sh26vmc2tdzc4gdco6uou._domainkey.redxen.eu. 86400 IN CNAME jqo2wv2wek7sh26vmc2tdzc4gdco6uou.dkim.amazonses.com"
+	local-data: "edzxe6qpinwhafgwlt6b44yarhhfn3xl._domainkey.redxen.eu. 86400 IN CNAME edzxe6qpinwhafgwlt6b44yarhhfn3xl.dkim.amazonses.com"
+
+	local-data: "redxen.eu 86400 IN TXT brave-ledger-verification=1f77ffecf7da410af2f4eeb5953ae13c5ee9ddfdfed5cae63458e63003b97444"
+
+	local-data: "_mumble._tcp.redxen.eu. 86400 IN SRV 0 5 2250 redxen.eu."
+	local-data: "_minecraft._tcp.redxen.eu. 86400 IN SRV 0 5 25565 redxen.eu."
+
+	local-data: "redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "stats.redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "git.redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "seed.redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "sd.redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "social.redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "ns0.redxen.eu. 86400 IN A 88.198.95.52"
+	local-data: "nbg0.redxen.eu. 86400 IN A 88.198.95.52"
+
+	local-data: "redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "stats.redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "git.redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "seed.redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "sd.redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "social.redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "ns1.redxen.eu. 86400 IN A 88.198.95.107"
+	local-data: "nbg1.redxen.eu. 86400 IN A 88.198.95.107"
+
+	local-data: "redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "stats.redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "git.redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "seed.redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "sd.redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "social.redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "ns2.redxen.eu. 86400 IN A 88.198.95.106"
+	local-data: "nbg2.redxen.eu. 86400 IN A 88.198.95.106"
+
+	local-data: "redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "stats.redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "git.redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "seed.redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "sd.redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "social.redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "ns3.redxen.eu. 86400 IN A 88.198.95.100"
+	local-data: "nbg3.redxen.eu. 86400 IN A 88.198.95.100"
+
+	local-data: "redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "stats.redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "git.redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "seed.redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "sd.redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "social.redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "ns4.redxen.eu. 86400 IN A 88.198.95.63"
+	local-data: "nbg4.redxen.eu. 86400 IN A 88.198.95.63"

files/unbound.conf

@@ -0,0 +1,55 @@
+include: "/etc/unbound/redxen-dns.conf"
+server:
+	directory: "/etc/unbound"
+	username: unbound
+	do-not-query-address: 127.0.0.11
+	access-control: 0.0.0.0/0 refuse_non_local
+	# Local Host
+	access-control: 127.0.0.0/24 allow
+	# Docker Host
+	access-control: 172.18.0.1/32 allow
+	# Wireguard Range
+	access-control: 172.22.12.0/24 allow
+	# Allow Loopback connections with public ip as source
+	access-control: 88.198.95.52/32 allow
+	access-control: 88.198.95.107/32 allow
+	access-control: 88.198.95.100/32 allow
+	access-control: 88.198.95.106/32 allow
+	access-control: 88.198.95.63/32 allow
+	# log-replies: yes
+	interface: 0.0.0.0
+	interface: ::0
+	extended-statistics: yes
+	root-hints: root.hints
+	rrset-roundrobin: yes
+	trust-anchor-file: /usr/share/dnssec-root/trusted-key.key
+	tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
+	port: 5353
+	ratelimit: 20
+	prefetch: yes
+	prefetch-key: yes
+	do-daemonize: no
+	logfile: ""
+	cache-min-ttl: 60
+	cache-max-ttl: 960
+	harden-glue: yes
+	aggressive-nsec: yes
+	serve-expired: yes
+	serve-expired-ttl: 86400
+	serve-expired-ttl-reset: yes
+remote-control:
+	control-enable: yes
+	control-use-cert: no
+	control-interface: 0.0.0.0
+forward-zone:
+	name: "."
+	forward-tls-upstream: yes
+	forward-first: yes
+	forward-addr: 2a04:c44:e00:32e0:42a:30ff:fe00:e7d@853#a.cyberiadot.invalid
+	forward-addr: 194.182.165.153@853#a.cyberiadot.invalid
+	forward-addr: 2a01:4f8:1c17:4d9b::853@853#b.cyberiadot.invalid
+	forward-addr: 78.47.220.84@853#b.cyberiadot.invalid
+	forward-addr: 2620:fe::fe@853#dns.quad9.net
+	forward-addr: 9.9.9.9@853#dns.quad9.net
+	forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
+	forward-addr: 1.1.1.1@853#cloudflare-dns.com

handlers/main.yml

@@ -0,0 +1,4 @@
+- name: reload unbound
+  service:
+          name: unbound
+          state: reloaded

tasks/main.yml

@@ -0,0 +1,18 @@
+- name: Install Unbound
+  apt:
+        install_recommends: no
+        name: unbound
+        state: present
+        cache_valid_time: 3600
+- name: Copy configuration files
+  copy:
+        follow: yes
+        src: roles/dns/files/
+        dest: /etc/unbound/
+  notify:
+        - reload unbound
+- name: Enable unbound in systemd
+  systemd:
+        name: unbound
+        enabled: yes
+        state: started