First commit.

README.md

@@ -1,31 +1,51 @@
 Role Name
 =========
 
-A brief description of the role goes here.
+A role that installs a PowerDNS authoritative service, <https://www.powerdns.com/powerdns-authoritative-server>
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
 
 Role Variables
 --------------
 
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+The most important variables are listed below:
+
+``` yaml
+powerdns_auth_major: 4
+powerdns_auth_minor: 9
+# From https://repo.powerdns.com
+powerdns_auth_version: '{{ powerdns_auth_major }}.{{ powerdns_auth_minor }}'
+powerdns_auth_repo_data: 'deb [arch=amd64] http://repo.powerdns.com/ubuntu {{ ansible_distribution_release }}-auth-{{ powerdns_auth_major }}{{ powerdns_auth_minor }} main'
+powerdns_auth_repo_key: 'https://repo.powerdns.com/FD380FBB-pub.asc'
+
+powerdns_auth_enable_api: true
+powerdns_auth_enable_web_interface: true
+
+powerdns_auth_pkgs:
+  - pdns-server
+  - pdns-tools
+  - pdns-backend-lua
+  - pdns-backend-remote 
+  - pdns-backend-pipe 
+
+powerdns_auth_use_db_backend: true
+powerdns_auth_backend_name: gpgsql
+powerdns_auth_db_backend: pgsql
+powerdns_auth_db_pkgs:
+  - 'pdns-backend-{{ powerdns_auth_db_backend }}'
+
+powerdns_auth_backend_data:
+  - { key: 'gpgsql-host', value: '127.0.0.1' }
+  - { key: 'gpgsql-port', value: 5432 }
+  - { key: 'gpgsql-dbname', value: '' }
+  - { key: 'gpgsql-user', value: '' }
+  - { key: 'gpgsql-password', value: '' }
+  - { key: 'gpgsql-dnssec', value: '' }
+  - { key: 'gpgsql-extra-connection-parameters', value: '' }
+```
 
 Dependencies
 ------------
 
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+None
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
 
 License
 -------
@@ -35,4 +55,4 @@ EUPL-1.2
 Author Information
 ------------------
 
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+Andrea Dell'Amico, <andrea.dellamico@isti.cnr.it>

defaults/main.yml

@@ -1,2 +1,70 @@
 ---
-# defaults file for ansible-role-template
+powerdns_auth_major: 4
+powerdns_auth_minor: 9
+# From https://repo.powerdns.com
+powerdns_auth_version: '{{ powerdns_auth_major }}.{{ powerdns_auth_minor }}'
+powerdns_auth_repo_url: "http://repo.powerdns.com/ubuntu"
+powerdns_auth_repo_rel: "{{ ansible_distribution_release }}-auth-{{ powerdns_auth_major }}{{ powerdns_auth_minor }}"
+powerdns_auth_key_url: 'https://repo.powerdns.com/FD380FBB-pub.asc'
+powerdns_auth_repo_key: '/etc/apt/keyrings/powerdns-pub-{{ powerdns_auth_major }}{{ powerdns_auth_minor }}.asc'
+
+# EPEL is a requiement. See vars/main.yml
+powerdns_auth_el_repo: "https://repo.powerdns.com/repo-files/el-auth-{{ powerdns_auth_major }}{{ powerdns_auth_minor }}.repo"
+
+powerdns_auth_enable_api: true
+powerdns_auth_enable_web_interface: true
+
+powerdns_auth_pkgs:
+  - pdns-server
+  - pdns-tools
+  - pdns-backend-lua
+  - pdns-backend-remote 
+  - pdns-backend-pipe 
+
+powerdns_auth_el_packages:
+  - pdns
+  - pdns-tools
+  - pdns-backend-lua
+  - pdns-backend-remote 
+  - pdns-backend-pipe 
+
+powerdns_auth_use_db_backend: true
+powerdns_auth_backend_name: gpgsql
+powerdns_auth_db_backend: pgsql
+powerdns_auth_db_pkgs:
+  - 'pdns-backend-{{ powerdns_auth_db_backend }}'
+
+powerdns_auth_backend_data:
+  - { key: 'gpgsql-host', value: '127.0.0.1' }
+  - { key: 'gpgsql-port', value: 5432 }
+  - { key: 'gpgsql-dbname', value: '' }
+  - { key: 'gpgsql-user', value: '' }
+  - { key: 'gpgsql-password', value: '' }
+  - { key: 'gpgsql-dnssec', value: '' }
+  - { key: 'gpgsql-extra-connection-parameters', value: '' }
+  
+# pdns_eight_bit_query: 'no'
+# pdns_zone_transfer_ip:
+# - '0/0'
+# pdns_allow_dnsupdate_from:
+# - '0/0'
+# pdns_allow_notify_from:
+# - '0/0'
+# pdns_allow_unsigned_notify: 'yes'
+# pdns_allow_unsigned_supermaster: 'yes'
+# also_notify wants IP addresses and not CIDR
+# pdns_also_notify:
+# - 'x.y.z.x.t'
+# powerdns_auth_enable_api: 'no'
+# powerdns_auth_api_key: 'use a vault file'
+# powerdns_auth_api_readonly: 'no'
+# powerdns_dnsupdate: 'no'
+# powerdns_local_ipv4: '0.0.0.0'
+# powerdns_local_ipv4_fail: 'yes'
+# powerdns_local_port: 53
+# powerdns_auth_master: 'no'
+# powerdns_reuseport: 'yes'
+# powerdns_auth_slave: 'no'
+# powerdns_auth_webserver: 'no'
+# powerdns_auth_web_address: '127.0.0.1'
+# powerdns_auth_web_allowfrom: '127.0.0.1,::1'

handlers/main.yml

@@ -1,2 +1,4 @@
 ---
-# handlers file for ansible-role-template
+- name: Restart powerdns
+  service: name=pdns state=restarted
+

meta/main.yml

@@ -1,46 +1,23 @@
 galaxy_info:
-  author: your name
+  author: Andrea Dell'Amico
-  description: your description
+  description: Role that installs the PowerDNS authoritative server
-  company: your company (optional)
+  company: ISTI-CNR
+  namespace: adellam
+  role_name: powerdns
+  license: EUPL 1.2+
+  min_ansible_version: "2.13"
 
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  issue_tracker_url: https://support.d4science.org/projects/automatic-provisioning/issues
-
-  license: EUPL-1.2
-
-  min_ansible_version: 2.8
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  # Optionally specify the branch Galaxy will use when accessing the GitHub
-  # repo for this role. During role install, if no tags are available,
-  # Galaxy will use this branch. During import Galaxy will access files on
-  # this branch. If Travis integration is configured, only notifications for this
-  # branch will be accepted. Otherwise, in all cases, the repo's default branch
-  # (usually master) will be used.
-  #github_branch:
-
-  #
-  # Provide a list of supported platforms, and for each platform a list of versions.
-  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
   # To view available platforms and versions (or releases), visit:
   # https://galaxy.ansible.com/api/v1/platforms/
   #
   platforms:
-  - name: Ubuntu
+    - name: Ubuntu
-    versions:
+      versions:
-    - bionic
+        - jammy
+        - noble
+    - name: EL
+      versions:
+        - "9"
 
-  galaxy_tags: []
+  galaxy_tags:
-    # List tags for your role here, one per line. A tag is a keyword that describes
+    - powerdns
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
-
-dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

tasks/main.yml

@@ -1,2 +1,107 @@
 ---
-# tasks file for ansible-role-template
+- name: Manage the PowerDNS repository on Deb systems
+  tags: ['dns', 'powerdns', 'powerdns_repository']
+  when: ansible_distribution_file_variety == "Debian"
+  block:
+    - name: Stop and disable systemd-resolved
+      ansible.builtin.service:
+        name: systemd-resolved
+        state: stopped
+        enabled: false
+      when: ansible_distribution_major_version >= '18'
+    - name: Ensure that /etc/apt.d/keyrings exists
+      ansible.builtin.file:
+        dest: /etc/apt/keyrings
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    - name: Get the signing key for the powerdns.com repository
+      ansible.builtin.get_url:
+        url: "{{ powerdns_auth_key_url }}"
+        dest: "{{ powerdns_auth_repo_key }}"
+        owner: root
+        group: root
+        mode: "0644"
+    - name: Install the repository for Ubuntu
+      ansible.builtin.deb822_repository:
+        name: powerdns-com
+        types: [deb]
+        uris: "{{ powerdns_auth_repo_url }}"
+        components:
+          - main
+        suites: ["{{ powerdns_auth_repo_rel }}"]
+        signed_by: "{{ powerdns_auth_repo_key }}"
+        state: present
+        enabled: true
+      register: postgresql_org_repo
+    - name: Update the apt cache
+      ansible.builtin.apt:
+        update_cache: yes
+      when: postgresql_org_repo is changed
+
+- name: Manage the PowerDNS packages on deb systems
+  tags: ['dns', 'powerdns', 'powerdns_packages']
+  when: ansible_distribution_file_variety == "Debian"
+  block:
+    - name: Install the powerdns packages
+      ansible.builtin.apt:
+        pkg: "{{ powerdns_auth_pkgs }}"
+        state: present
+        cache_valid_time: 1800
+    - name: Install the powerdns DB backend packages
+      ansible.builtin.apt:
+        pkg: "{{ powerdns_auth_db_pkgs }}"
+        state: present
+        cache_valid_time: 1800
+      when: powerdns_auth_use_db_backend
+
+- name: Manage the PowerDNS repository and packages on EL systems
+  tags: ['dns', 'powerdns', 'powerdns_repository', 'powerdns_packages']
+  when: ansible_distribution_file_variety == "RedHat"
+  block:
+    - name: Get the powerdns repository file
+      ansible.builtin.get_url:
+        url: "{{ powerdns_auth_el_repo }}"
+        dest: "/etc/yum.repos.d/powerdns-auth-{{ powerdns_auth_major }}{{ powerdns_auth_minor }}.repo"
+        owner: root
+        group: root
+        mode: "0444"
+    - name: Install the powerdns packages on EL systems
+      ansible.builtin.dnf:
+        pkg: "{{ powerdns_auth_el_packages }}"
+        state: present
+    - name: Install the powerdns DB backend packages
+      ansible.builtin.dnf:
+        pkg: "{{ powerdns_auth_db_pkgs }}"
+        state: present
+      when: powerdns_auth_use_db_backend
+
+- name: Manage the PowerDNS configuration
+  tags: ['dns', 'powerdns', 'powerdns_conf']
+  block:
+    - name: Install the powerdns main configuration file
+      ansible.builtin.template:
+        src: pdns.conf.j2
+        dest: /etc/powerdns/pdns.conf
+        owner: root
+        group: root
+        mode: "0600"
+      notify: Restart powerdns
+    - name: Install the powerdns local configuration file
+      ansible.builtin.template:
+        src: pdns.local.conf.j2
+        dest: /etc/powerdns/pdns.d/pdns.local.conf
+        owner: root
+        group: root
+        mode: "0600"
+      notify: Restart powerdns
+
+- name: Manage the PowerDNS service
+  tags: ['dns', 'powerdns', 'powerdns_service']
+  block:
+    - name: Ensure that powerdns is running and enabled
+      ansible.builtin.service:
+        name: pdns
+        state: started
+        enabled: true

templates/pdns.conf

@@ -0,0 +1,660 @@
+# Autogenerated configuration file template
+#################################
+# 8bit-dns	Allow 8bit dns queries
+#
+{% if pdns_eight_bit_query is defined %}
+8bit-dns={{ pdns_eight_bit_query }}
+{% endif %}
+
+#################################
+# allow-axfr-ips	Allow zonetransfers only to these subnets
+#
+{% if pdns_zone_transfer_ip is defined %}
+allow-axfr-ips=127.0.0.0/8,::1,{%for ip in pdns_zone_transfer_ip %}{{ ip }}{%if not loop.last %},{% endif %}{% endfor %}
+{% endif %}
+
+#################################
+# allow-dnsupdate-from	A global setting to allow DNS updates from these IP ranges.
+#
+# allow-dnsupdate-from=127.0.0.0/8,::1
+{% if pdns_allow_dnsupdate_from is defined %}
+allow-dnsupdate-from=127.0.0.0/8,::1,{%for ip in pdns_allow_dnsupdate_from %}{{ ip }}{%if not loop.last %},{% endif %}{% endfor %}
+{% endif %}
+
+#################################
+# allow-notify-from	Allow AXFR NOTIFY from these IP ranges. If empty, drop all incoming notifies.
+#
+# allow-notify-from=0.0.0.0/0,::/0
+{% if pdns_allow_notify_from is defined %}
+allow-notify-from={%for ip in pdns_allow_notify_from %}{{ ip }}{%if not loop.last %},{% endif %}{% endfor %}
+{% endif %}
+
+#################################
+# allow-unsigned-notify	Allow unsigned notifications for TSIG secured domains
+#
+#allow-unsigned-notify=yes
+allow-unsigned-notify={{ pdns_allow_unsigned_notify | default('yes') }}
+
+
+#################################
+# superslave (boolean)
+#
+superslave={{ pdns_i_am_superslave | default('no') }}
+
+#################################
+# allow-unsigned-supermaster	Allow supermasters to create zones without TSIG signed NOTIFY
+#
+# allow-unsigned-supermaster=yes
+allow-unsigned-supermaster={{ pdns_allow_unsigned_supermaster | default('yes') }}
+
+#################################
+# also-notify	When notifying a domain, also notify these nameservers
+#
+# also-notify=
+{% if pdns_also_notify is defined %}
+also-notify={%for ip in pdns_also_notify %}{{ ip }}{%if not loop.last %},{% endif %}{% endfor %}
+{% endif %}
+
+#################################
+# any-to-tcp	Answer ANY queries with tc=1, shunting to TCP
+#
+# any-to-tcp=yes
+
+#################################
+# api	Enable/disable the REST API (including HTTP listener)
+#
+# api=no
+api={{ powerdns_auth_enable_api | default('no') }}
+
+#################################
+# api-key	Static pre-shared authentication key for access to the REST API
+#
+# api-key=
+api-key={{ powerdns_auth_api_key | default(omit) }}
+
+#################################
+# api-logfile	Location of the server logfile (used by the REST API)
+#
+# api-logfile=/var/log/pdns.log
+
+{% if powerdns_auth_minor == 1 %}
+#################################
+# api-readonly	Disallow data modification through the REST API when set
+#
+api-readonly={{ powerdns_auth_api_readonly | default('no') }}
+{% endif %}
+
+#################################
+# axfr-lower-serial	Also AXFR a zone from a master with a lower serial
+#
+# axfr-lower-serial=no
+
+#################################
+# cache-ttl	Seconds to store packets in the PacketCache
+#
+# cache-ttl=20
+
+#################################
+# carbon-interval	Number of seconds between carbon (graphite) updates
+#
+# carbon-interval=30
+
+#################################
+# carbon-ourname	If set, overrides our reported hostname for carbon stats
+#
+# carbon-ourname=
+
+#################################
+# carbon-server	If set, send metrics in carbon (graphite) format to this server IP address
+#
+# carbon-server=
+
+#################################
+# chroot	If set, chroot to this directory for more security
+#
+# chroot=
+
+#################################
+# config-dir	Location of configuration directory (pdns.conf)
+#
+# config-dir=/etc/powerdns
+
+#################################
+# config-name	Name of this virtual configuration - will rename the binary image
+#
+# config-name=
+
+#################################
+# control-console	Debugging switch - don't use
+#
+# control-console=no
+
+#################################
+# daemon	Operate as a daemon
+#
+# daemon=no
+
+#################################
+# default-ksk-algorithm	Default KSK algorithm
+#
+# default-ksk-algorithm=ecdsa256
+
+#################################
+# default-ksk-size	Default KSK size (0 means default)
+#
+# default-ksk-size=0
+
+#################################
+# default-soa-edit	Default SOA-EDIT value
+#
+# default-soa-edit=
+
+#################################
+# default-soa-edit-signed	Default SOA-EDIT value for signed zones
+#
+# default-soa-edit-signed=
+
+#################################
+# default-soa-mail	mail address to insert in the SOA record if none set in the backend
+#
+# default-soa-mail=
+
+#################################
+# default-soa-name	name to insert in the SOA record if none set in the backend
+#
+# default-soa-name=a.misconfigured.powerdns.server
+
+#################################
+# default-ttl	Seconds a result is valid if not set otherwise
+#
+# default-ttl=3600
+
+#################################
+# default-zsk-algorithm	Default ZSK algorithm
+#
+# default-zsk-algorithm=
+
+#################################
+# default-zsk-size	Default ZSK size (0 means default)
+#
+# default-zsk-size=0
+
+#################################
+# direct-dnskey	Fetch DNSKEY RRs from backend during DNSKEY synthesis
+#
+# direct-dnskey=no
+
+#################################
+# disable-axfr	Disable zonetransfers but do allow TCP queries
+#
+# disable-axfr=no
+
+#################################
+# disable-axfr-rectify	Disable the rectify step during an outgoing AXFR. Only required for regression testing.
+#
+# disable-axfr-rectify=no
+
+#################################
+# disable-syslog	Disable logging to syslog, useful when running inside a supervisor that logs stdout
+#
+# disable-syslog=no
+
+#################################
+# disable-tcp	Do not listen to TCP queries
+#
+# disable-tcp=no
+
+#################################
+# distributor-threads	Default number of Distributor (backend) threads to start
+#
+# distributor-threads=3
+
+#################################
+# dname-processing	If we should support DNAME records
+#
+# dname-processing=no
+
+#################################
+# dnssec-key-cache-ttl	Seconds to cache DNSSEC keys from the database
+#
+# dnssec-key-cache-ttl=30
+
+#################################
+# dnsupdate	Enable/Disable DNS update (RFC2136) support. Default is no.
+#
+dnsupdate={{ powerdns_dnsupdate | default('no') }}
+
+#################################
+# do-ipv6-additional-processing	Do AAAA additional processing
+#
+# do-ipv6-additional-processing=yes
+
+#################################
+# domain-metadata-cache-ttl	Seconds to cache domain metadata from the database
+#
+# domain-metadata-cache-ttl=60
+
+#################################
+# edns-subnet-processing	If we should act on EDNS Subnet options
+#
+# edns-subnet-processing=no
+
+#################################
+# entropy-source	If set, read entropy from this file
+#
+# entropy-source=/dev/urandom
+
+#################################
+# expand-alias	Expand ALIAS records
+#
+# expand-alias=no
+
+#################################
+# forward-dnsupdate	A global setting to allow DNS update packages that are for a Slave domain, to be forwarded to the master.
+#
+# forward-dnsupdate=yes
+
+#################################
+# forward-notify	IP addresses to forward received notifications to regardless of master or slave settings
+#
+# forward-notify=
+{% if powerdns_forward_notify is defined %}
+forward-notify={{ powerdns_forward_notify }}
+{% endif %}
+
+#################################
+# guardian	Run within a guardian process
+#
+# guardian=no
+
+#################################
+# include-dir	Include *.conf files from this directory
+#
+# include-dir=
+include-dir=/etc/powerdns/pdns.d
+
+#################################
+# launch	Which backends to launch and order to query them in
+#
+# launch=
+{% if powerdns_auth_use_db_backend %}
+launch={{ powerdns_auth_backend_name }}
+{% endif %}
+
+#################################
+# load-modules	Load this module - supply absolute or relative path
+#
+# load-modules=
+
+#################################
+# local-address	Local IP addresses to which we bind
+#
+local-address={{ powerdns_local_ipv4 | default('0.0.0.0') }}
+
+#################################
+# local-address-nonexist-fail	Fail to start if one or more of the local-address's do not exist on this server
+#
+local-address-nonexist-fail={{ powerdns_local_ipv4_fail | default('yes') }}
+
+#################################
+# local-ipv6	Local IP address to which we bind
+#
+# local-ipv6=::
+
+#################################
+# local-ipv6-nonexist-fail	Fail to start if one or more of the local-ipv6 addresses do not exist on this server
+#
+# local-ipv6-nonexist-fail=yes
+
+#################################
+# local-port	The port on which we listen
+#
+local-port={{ powerdns_local_port | default('53') }}
+
+#################################
+# log-dns-details	If PDNS should log DNS non-erroneous details
+#
+# log-dns-details=no
+
+#################################
+# log-dns-queries	If PDNS should log all incoming DNS queries
+#
+# log-dns-queries=no
+
+#################################
+# log-timestamp	Print timestamps in log lines
+#
+# log-timestamp=yes
+
+#################################
+# logging-facility	Log under a specific facility
+#
+# logging-facility=
+
+#################################
+# loglevel	Amount of logging. Higher is more. Do not set below 3
+#
+# loglevel=4
+
+#################################
+# lua-axfr-script	Script to be used to edit incoming AXFRs
+#
+# lua-axfr-script=
+
+#################################
+# lua-dnsupdate-policy-script	Lua script with DNS update policy handler
+#
+# lua-dnsupdate-policy-script=
+
+#################################
+# lua-prequery-script	Lua script with prequery handler (DO NOT USE)
+#
+# lua-prequery-script=
+
+#################################
+# master	Act as a master
+#
+master={{ powerdns_auth_master | default('no') }}
+
+#################################
+# max-cache-entries	Maximum number of entries in the query cache
+#
+# max-cache-entries=1000000
+
+#################################
+# max-ent-entries	Maximum number of empty non-terminals in a zone
+#
+# max-ent-entries=100000
+
+#################################
+# max-nsec3-iterations	Limit the number of NSEC3 hash iterations
+#
+# max-nsec3-iterations=500
+
+#################################
+# max-packet-cache-entries	Maximum number of entries in the packet cache
+#
+# max-packet-cache-entries=1000000
+
+#################################
+# max-queue-length	Maximum queuelength before considering situation lost
+#
+# max-queue-length=5000
+
+#################################
+# max-signature-cache-entries	Maximum number of signatures cache entries
+#
+# max-signature-cache-entries=
+
+#################################
+# max-tcp-connection-duration	Maximum time in seconds that a TCP DNS connection is allowed to stay open.
+#
+# max-tcp-connection-duration=0
+
+#################################
+# max-tcp-connections	Maximum number of TCP connections
+#
+# max-tcp-connections=20
+
+#################################
+# max-tcp-connections-per-client	Maximum number of simultaneous TCP connections per client
+#
+# max-tcp-connections-per-client=0
+
+#################################
+# max-tcp-transactions-per-conn	Maximum number of subsequent queries per TCP connection
+#
+# max-tcp-transactions-per-conn=0
+
+#################################
+# module-dir	Default directory for modules
+#
+
+
+#################################
+# negquery-cache-ttl	Seconds to store negative query results in the QueryCache
+#
+# negquery-cache-ttl=60
+
+#################################
+# no-shuffle	Set this to prevent random shuffling of answers - for regression testing
+#
+# no-shuffle=off
+
+#################################
+# non-local-bind	Enable binding to non-local addresses by using FREEBIND / BINDANY socket options
+#
+# non-local-bind=no
+
+#################################
+# only-notify	Only send AXFR NOTIFY to these IP addresses or netmasks
+#
+# only-notify=0.0.0.0/0,::/0
+
+#################################
+# out-of-zone-additional-processing	Do out of zone additional processing
+#
+# out-of-zone-additional-processing=yes
+
+#################################
+# outgoing-axfr-expand-alias	Expand ALIAS records during outgoing AXFR
+#
+# outgoing-axfr-expand-alias=no
+
+#################################
+# overload-queue-length	Maximum queuelength moving to packetcache only
+#
+# overload-queue-length=0
+
+#################################
+# prevent-self-notification	Don't send notifications to what we think is ourself
+#
+# prevent-self-notification=yes
+
+#################################
+# query-cache-ttl	Seconds to store query results in the QueryCache
+#
+# query-cache-ttl=20
+
+#################################
+# query-local-address	Source IP address for sending queries
+#
+# query-local-address=0.0.0.0
+
+#################################
+# query-local-address6	Source IPv6 address for sending queries
+#
+# query-local-address6=::
+
+#################################
+# query-logging	Hint backends that queries should be logged
+#
+# query-logging=no
+
+#################################
+# queue-limit	Maximum number of milliseconds to queue a query
+#
+# queue-limit=1500
+
+#################################
+# receiver-threads	Default number of receiver threads to start
+#
+# receiver-threads=1
+
+#################################
+# resolver	Use this resolver for ALIAS and the internal stub resolver
+#
+# resolver=no
+
+#################################
+# retrieval-threads	Number of AXFR-retrieval threads for slave operation
+#
+{% if powerdns_auth_slave is defined and powerdns_auth_slave %}
+retrieval-threads=2
+{% endif %}
+
+#################################
+# reuseport	Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket
+#
+reuseport={{ powerdns_reuseport | default('yes' ) }}
+
+#################################
+# security-poll-suffix	Domain name from which to query security update notifications
+#
+# security-poll-suffix=secpoll.powerdns.com.
+
+#################################
+# server-id	Returned when queried for 'id.server' TXT or NSID, defaults to hostname - disabled or custom
+#
+# server-id=
+
+#################################
+# setgid	If set, change group id to this gid for more security
+#
+setgid=pdns
+
+#################################
+# setuid	If set, change user id to this uid for more security
+#
+setuid=pdns
+
+#################################
+# signing-threads	Default number of signer threads to start
+#
+# signing-threads=3
+
+#################################
+# slave	Act as a slave
+#
+{% if powerdns_auth_slave is defined and powerdns_auth_slave %}
+slave=yes
+
+#################################
+# slave-cycle-interval	Schedule slave freshness checks once every .. seconds
+#
+slave-cycle-interval=60
+
+#################################
+# slave-renotify	If we should send out notifications for slaved updates
+#
+# slave-renotify=no
+{% else %}
+slave=no
+{% endif %}
+
+#################################
+# soa-expire-default	Default SOA expire
+#
+# soa-expire-default=604800
+
+#################################
+# soa-minimum-ttl	Default SOA minimum ttl
+#
+# soa-minimum-ttl=3600
+
+#################################
+# soa-refresh-default	Default SOA refresh
+#
+# soa-refresh-default=10800
+
+#################################
+# soa-retry-default	Default SOA retry
+#
+# soa-retry-default=3600
+
+#################################
+# socket-dir	Where the controlsocket will live, /var/run when unset and not chrooted
+#
+# socket-dir=
+
+#################################
+# tcp-control-address	If set, PowerDNS can be controlled over TCP on this address
+#
+# tcp-control-address=
+
+#################################
+# tcp-control-port	If set, PowerDNS can be controlled over TCP on this address
+#
+# tcp-control-port=53000
+
+#################################
+# tcp-control-range	If set, remote control of PowerDNS is possible over these networks only
+#
+# tcp-control-range=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10
+
+#################################
+# tcp-control-secret	If set, PowerDNS can be controlled over TCP after passing this secret
+#
+# tcp-control-secret=
+
+#################################
+# tcp-fast-open	Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size
+#
+# tcp-fast-open=0
+
+#################################
+# tcp-idle-timeout	Maximum time in seconds that a TCP DNS connection is allowed to stay open while being idle
+#
+# tcp-idle-timeout=5
+
+#################################
+# traceback-handler	Enable the traceback handler (Linux only)
+#
+# traceback-handler=yes
+
+#################################
+# trusted-notification-proxy	IP address of incoming notification proxy
+#
+# trusted-notification-proxy=
+
+#################################
+# udp-truncation-threshold	Maximum UDP response size before we truncate
+#
+# udp-truncation-threshold=1680
+
+#################################
+# version-string	PowerDNS version in packets - full, anonymous, powerdns or custom
+#
+# version-string=full
+
+#################################
+# webserver	Start a webserver for monitoring (api=yes also enables the HTTP listener)
+#
+webserver={{ powerdns_auth_webserver | default('no') }}
+
+#################################
+# webserver-address	IP Address of webserver/API to listen on
+#
+webserver-address={{ powerdns_auth_web_address | default('127.0.0.1') }} 
+
+#################################
+# webserver-allow-from	Webserver/API access is only allowed from these subnets
+#
+webserver-allow-from={{ powerdns_auth_web_allowfrom | default('127.0.0.1,::1') }}
+
+#################################
+# webserver-password	Password required for accessing the webserver
+#
+# webserver-password=
+
+#################################
+# webserver-port	Port of webserver/API to listen on
+#
+# webserver-port=8081
+
+#################################
+# webserver-print-arguments	If the webserver should print arguments
+#
+# webserver-print-arguments=no
+
+#################################
+# write-pid	Write a PID file
+#
+# write-pid=yes
+
+#################################
+# xfr-max-received-mbytes	Maximum number of megabytes received from an incoming XFR
+#
+# xfr-max-received-mbytes=100
+
+

templates/pdns.local.conf

@@ -0,0 +1,5 @@
+{% if powerdns_auth_use_db_backend %}
+{% for bk_data in powerdns_auth_backend_data %}
+{{ bk_data.key }}={{ bk_data.value }}
+{% endfor %}
+{% endif %}

vars/main.yml

@@ -1,2 +1,2 @@
 ---
-# vars file for ansible-role-template
+centos_install_epel: true