foo.sh/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable DNS over TLS support for local resolvers

Browse source 
Currently uses local CA.
This commit is contained in:
Timo Makinen 2021-09-29 19:09:58 +00:00
parent 581484d207
commit 8bdf278ea6
4 changed files with 31 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
roles/pf/files/pf.conf.gw_home
View file

@ -50,6 +50,7 @@ pass in quick on $int_if proto tcp from $int_net to self port 4949
# allow dns queries from internal net
pass in quick on $int_if proto { tcp, udp } from $int_net to self port domain
pass in quick on $int_if proto tcp from $int_net to self port domain-s
# allow tftp from internal net
pass in quick on $int_if proto udp from $int_net to self port tftp

8
roles/unbound/templates/unbound.conf.dna-gw01.home.foo.sh.j2
View file

@ -2,9 +2,13 @@
server:
interface: 127.0.0.1
interface: ::1
interface: 172.20.20.10
interface: 172.20.21.1
interface: 172.20.20.10@53
interface: 172.20.20.10@853
interface: 172.20.21.1@53
tls-service-key: {{ tls_private }}/dns.home.foo.sh.key
tls-service-pem: {{ tls_certs }}/dns.home.foo.sh.crt
tls-cert-bundle: {{ tls_certs }}/ca.crt
access-control: 127.0.0.0/8 allow
access-control: ::1 allow

8
roles/unbound/templates/unbound.conf.dna-gw02.home.foo.sh.j2
View file

@ -2,9 +2,13 @@
server:
interface: 127.0.0.1
interface: ::1
interface: 172.20.20.10
interface: 172.20.21.2
interface: 172.20.20.10@53
interface: 172.20.20.10@853
interface: 172.20.21.2@53
tls-service-key: {{ tls_private }}/dns.home.foo.sh.key
tls-service-pem: {{ tls_certs }}/dns.home.foo.sh.crt
tls-cert-bundle: {{ tls_certs }}/ca.crt
access-control: 127.0.0.0/8 allow
access-control: ::1 allow