From d8118cdd8c47357c493dfe1b07ee83776a7d5853 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:27:01 +0300 Subject: [PATCH 1/4] add dnsmasq role --- .ansible-lint | 1 + roles/dnsmasq/.ansible-lint | 16 +++++++++ roles/dnsmasq/.gitignore | 2 ++ roles/dnsmasq/.yamllint | 8 +++++ roles/dnsmasq/README.md | 37 ++++++++++++++++++++ roles/dnsmasq/conda.dev.yml | 11 ++++++ roles/dnsmasq/conda.prod.yml | 9 +++++ roles/dnsmasq/defaults/main.yml | 3 ++ roles/dnsmasq/handlers/main.yml | 7 ++++ roles/dnsmasq/meta/main.yml | 17 +++++++++ roles/dnsmasq/molecule/default/converge.yml | 21 ++++++++++++ roles/dnsmasq/molecule/default/molecule.yml | 27 +++++++++++++++ roles/dnsmasq/molecule/default/verify.yml | 19 +++++++++++ roles/dnsmasq/renovate.json | 6 ++++ roles/dnsmasq/requirements.ci.txt | 6 ++++ roles/dnsmasq/requirements.txt | 1 + roles/dnsmasq/requirements.yml | 5 +++ roles/dnsmasq/tasks/main.yml | 38 +++++++++++++++++++++ roles/dnsmasq/vars/main.yml | 1 + 19 files changed, 235 insertions(+) create mode 100644 roles/dnsmasq/.ansible-lint create mode 100644 roles/dnsmasq/.gitignore create mode 100644 roles/dnsmasq/.yamllint create mode 100644 roles/dnsmasq/README.md create mode 100644 roles/dnsmasq/conda.dev.yml create mode 100644 roles/dnsmasq/conda.prod.yml create mode 100644 roles/dnsmasq/defaults/main.yml create mode 100644 roles/dnsmasq/handlers/main.yml create mode 100644 roles/dnsmasq/meta/main.yml create mode 100644 roles/dnsmasq/molecule/default/converge.yml create mode 100644 roles/dnsmasq/molecule/default/molecule.yml create mode 100644 roles/dnsmasq/molecule/default/verify.yml create mode 100644 roles/dnsmasq/renovate.json create mode 100644 roles/dnsmasq/requirements.ci.txt create mode 100644 roles/dnsmasq/requirements.txt create mode 100644 roles/dnsmasq/requirements.yml create mode 100644 roles/dnsmasq/tasks/main.yml create mode 100644 roles/dnsmasq/vars/main.yml diff --git a/.ansible-lint b/.ansible-lint index 43cae14..38f5606 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -7,3 +7,4 @@ loop_var_prefix: "^(__|{role}_)" exclude_paths: - .github/ + - .ansible/ diff --git a/roles/dnsmasq/.ansible-lint b/roles/dnsmasq/.ansible-lint new file mode 100644 index 0000000..f865478 --- /dev/null +++ b/roles/dnsmasq/.ansible-lint @@ -0,0 +1,16 @@ +--- +profile: production +strict: true + +# Enable checking of loop variable prefixes in roles +loop_var_prefix: "^(__|{role}_)" + +skip_list: + - var-naming[no-role-prefix] + +warn_list: + - role-name[path] + - var-naming[no-role-prefix] + +exclude_paths: + - .github/ diff --git a/roles/dnsmasq/.gitignore b/roles/dnsmasq/.gitignore new file mode 100644 index 0000000..8cd0df3 --- /dev/null +++ b/roles/dnsmasq/.gitignore @@ -0,0 +1,2 @@ +.vscode +.idea \ No newline at end of file diff --git a/roles/dnsmasq/.yamllint b/roles/dnsmasq/.yamllint new file mode 100644 index 0000000..611db54 --- /dev/null +++ b/roles/dnsmasq/.yamllint @@ -0,0 +1,8 @@ +--- +rules: + brackets: + forbid: false + min-spaces-inside: 0 + max-spaces-inside: 2 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: 2 diff --git a/roles/dnsmasq/README.md b/roles/dnsmasq/README.md new file mode 100644 index 0000000..2e1d6b4 --- /dev/null +++ b/roles/dnsmasq/README.md @@ -0,0 +1,37 @@ +ansible-dnsmasq +========= + +Deploy dnsmasq on the target node. For now, supports only DNS functionality (DHCP and TFTP are not configuratble). + +Requirements +------------ + +Take care to open the port you choose for dnsmasq to serve queries on. This role does not handle firewall configuration. + +Role Variables +-------------- + +None + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.dnsmasq +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/dnsmasq/conda.dev.yml b/roles/dnsmasq/conda.dev.yml new file mode 100644 index 0000000..d8f50de --- /dev/null +++ b/roles/dnsmasq/conda.dev.yml @@ -0,0 +1,11 @@ +--- +name: ansible-dnsmasq +channels: + - conda-forge +dependencies: + - python~=3.12.0 + - pip>=24.2 + - actionlint + - pip: + - -r requirements.txt + - -r requirements.ci.txt diff --git a/roles/dnsmasq/conda.prod.yml b/roles/dnsmasq/conda.prod.yml new file mode 100644 index 0000000..51dcb83 --- /dev/null +++ b/roles/dnsmasq/conda.prod.yml @@ -0,0 +1,9 @@ +--- +name: ansible-dnsmasq +channels: + - conda-forge +dependencies: + - python~=3.12.0 + - pip>=24.2 + - pip: + - -r requirements.txt diff --git a/roles/dnsmasq/defaults/main.yml b/roles/dnsmasq/defaults/main.yml new file mode 100644 index 0000000..0788c90 --- /dev/null +++ b/roles/dnsmasq/defaults/main.yml @@ -0,0 +1,3 @@ +--- +cache_size: 100 +dns_port: 5300 diff --git a/roles/dnsmasq/handlers/main.yml b/roles/dnsmasq/handlers/main.yml new file mode 100644 index 0000000..c30be1c --- /dev/null +++ b/roles/dnsmasq/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "Restart dnsmasq" + ansible.builtin.systemd_service: + name: dnsmasq + state: restarted + daemon_reload: true + enabled: true diff --git a/roles/dnsmasq/meta/main.yml b/roles/dnsmasq/meta/main.yml new file mode 100644 index 0000000..414d68d --- /dev/null +++ b/roles/dnsmasq/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: dnsmasq + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/dnsmasq/molecule/default/converge.yml b/roles/dnsmasq/molecule/default/converge.yml new file mode 100644 index 0000000..f41738d --- /dev/null +++ b/roles/dnsmasq/molecule/default/converge.yml @@ -0,0 +1,21 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.ufw + disable_ipv6: true + rules: + - rule: allow + # proto: udp + port: 5300 + interface: lo + direction: in + comment: "Allow dnsmasq to serve DNS queries on the given interface" + + - role: genlab.dnsmasq + iface: lo + domain: adm.local + dns_port: 5300 + nodes: + - name: hub + ip: 127.0.0.1 diff --git a/roles/dnsmasq/molecule/default/molecule.yml b/roles/dnsmasq/molecule/default/molecule.yml new file mode 100644 index 0000000..fd2f06d --- /dev/null +++ b/roles/dnsmasq/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml new file mode 100644 index 0000000..3a4ca5f --- /dev/null +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -0,0 +1,19 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + pre_tasks: + - name: "Install a package providing the `dig` tool" + ansible.builtin.apt: + name: dnsutils + state: present + + tasks: + - name: "Test the output of the `dig` command" + changed_when: false + register: dig + failed_when: 'dig.stdout != "127.0.0.1"' + ansible.builtin.command: + cmd: "dig @127.0.0.1 -p 5353 hub.adm.vpn +short" diff --git a/roles/dnsmasq/renovate.json b/roles/dnsmasq/renovate.json new file mode 100644 index 0000000..5db72dd --- /dev/null +++ b/roles/dnsmasq/renovate.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended" + ] +} diff --git a/roles/dnsmasq/requirements.ci.txt b/roles/dnsmasq/requirements.ci.txt new file mode 100644 index 0000000..f99c76a --- /dev/null +++ b/roles/dnsmasq/requirements.ci.txt @@ -0,0 +1,6 @@ +ansible-lint +molecule==24.12.0 +molecule-plugins[docker] +docker~=7.1.0 +requests==2.31.0 # pinned to the latest version not breaking Docker SDK +yamllint diff --git a/roles/dnsmasq/requirements.txt b/roles/dnsmasq/requirements.txt new file mode 100644 index 0000000..cd252b9 --- /dev/null +++ b/roles/dnsmasq/requirements.txt @@ -0,0 +1 @@ +ansible~=11.1.0 diff --git a/roles/dnsmasq/requirements.yml b/roles/dnsmasq/requirements.yml new file mode 100644 index 0000000..cf52e39 --- /dev/null +++ b/roles/dnsmasq/requirements.yml @@ -0,0 +1,5 @@ +# requirements file +--- +roles: + - name: genlab.ufw + src: https://github.com/corvus-migratorius/ansible-ufw.git diff --git a/roles/dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml new file mode 100644 index 0000000..6f7d0ec --- /dev/null +++ b/roles/dnsmasq/tasks/main.yml @@ -0,0 +1,38 @@ +--- +- name: "Install dnsmasq" + ansible.builtin.apt: + name: dnsmasq + state: present + update_cache: true + + +- name: "Create interface-specific configuration file" + notify: "Restart dnsmasq" + ansible.builtin.blockinfile: + path: /etc/dnsmasq.d/{{ domain }}.conf + create: true + owner: root + group: root + mode: "0660" + block: | + interface="{{ iface }}" + port="{{ dns_port }}" + cache-size="{{ cache_size }}" + log-queries + server=1.1.1.1 # Cloudflare DNS + server=8.8.8.8 # Google DNS + server=8.8.4.4 # Google DNS (secondary) + + +- name: "Add nodes to the configuration file" + notify: "Restart dnsmasq" + loop: "{{ nodes }}" + ansible.builtin.blockinfile: + path: /etc/dnsmasq.d/{{ domain }}.conf + marker: "# {mark} ANSIBLE MANAGED: {{ item.name }}.{{ domain }}" + block: | + address=/{{ item.name }}.{{ domain }}/{{ item.ip }} + + +- name: "Flush handlers" + ansible.builtin.meta: flush_handlers diff --git a/roles/dnsmasq/vars/main.yml b/roles/dnsmasq/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/dnsmasq/vars/main.yml @@ -0,0 +1 @@ +--- From c1311a77c4a4d08e66bbae55485ba634711b779e Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Fri, 12 Dec 2025 10:32:18 +0300 Subject: [PATCH 2/4] fix linter errors --- roles/dnsmasq/defaults/main.yml | 4 ++-- roles/dnsmasq/meta/main.yml | 4 ++-- roles/dnsmasq/molecule/default/converge.yml | 12 ++++++------ roles/dnsmasq/molecule/default/verify.yml | 2 +- roles/dnsmasq/tasks/main.yml | 18 +++++++++--------- 5 files changed, 20 insertions(+), 20 deletions(-) diff --git a/roles/dnsmasq/defaults/main.yml b/roles/dnsmasq/defaults/main.yml index 0788c90..24e3d56 100644 --- a/roles/dnsmasq/defaults/main.yml +++ b/roles/dnsmasq/defaults/main.yml @@ -1,3 +1,3 @@ --- -cache_size: 100 -dns_port: 5300 +dnsmasq_cache_size: 100 +dnsmasq_dns_port: 5300 diff --git a/roles/dnsmasq/meta/main.yml b/roles/dnsmasq/meta/main.yml index 414d68d..03ddef7 100644 --- a/roles/dnsmasq/meta/main.yml +++ b/roles/dnsmasq/meta/main.yml @@ -10,8 +10,8 @@ galaxy_info: platforms: - name: "Ubuntu" - versions: [ "focal", "jammy" ] + versions: ["focal", "jammy"] - galaxy_tags: [ ] + galaxy_tags: [] dependencies: [] diff --git a/roles/dnsmasq/molecule/default/converge.yml b/roles/dnsmasq/molecule/default/converge.yml index f41738d..6a8f31d 100644 --- a/roles/dnsmasq/molecule/default/converge.yml +++ b/roles/dnsmasq/molecule/default/converge.yml @@ -2,7 +2,7 @@ - name: Converge hosts: all roles: - - role: genlab.ufw + - role: genlab.common.ufw disable_ipv6: true rules: - rule: allow @@ -12,10 +12,10 @@ direction: in comment: "Allow dnsmasq to serve DNS queries on the given interface" - - role: genlab.dnsmasq - iface: lo - domain: adm.local - dns_port: 5300 - nodes: + - role: genlab.common.dnsmasq + dnsmasq_iface: lo + dnsmasq_domain: adm.local + dnsmasq_dns_port: 5300 + dnsmasq_nodes: - name: hub ip: 127.0.0.1 diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml index 3a4ca5f..8eaf15a 100644 --- a/roles/dnsmasq/molecule/default/verify.yml +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -13,7 +13,7 @@ tasks: - name: "Test the output of the `dig` command" changed_when: false - register: dig + register: dnsmasq_dig failed_when: 'dig.stdout != "127.0.0.1"' ansible.builtin.command: cmd: "dig @127.0.0.1 -p 5353 hub.adm.vpn +short" diff --git a/roles/dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml index 6f7d0ec..ff29987 100644 --- a/roles/dnsmasq/tasks/main.yml +++ b/roles/dnsmasq/tasks/main.yml @@ -9,29 +9,29 @@ - name: "Create interface-specific configuration file" notify: "Restart dnsmasq" ansible.builtin.blockinfile: - path: /etc/dnsmasq.d/{{ domain }}.conf + path: /etc/dnsmasq.d/{{ dnsmasq_domain }}.conf create: true owner: root group: root mode: "0660" block: | - interface="{{ iface }}" - port="{{ dns_port }}" - cache-size="{{ cache_size }}" + interface="{{ dnsmasq_iface }}" + port="{{ dnsmasq_dns_port }}" + cache-size="{{ dnsmasq_cache_size }}" log-queries server=1.1.1.1 # Cloudflare DNS server=8.8.8.8 # Google DNS server=8.8.4.4 # Google DNS (secondary) -- name: "Add nodes to the configuration file" +- name: "Add dnsmasq_nodes to the configuration file" notify: "Restart dnsmasq" - loop: "{{ nodes }}" + loop: "{{ dnsmasq_nodes }}" ansible.builtin.blockinfile: - path: /etc/dnsmasq.d/{{ domain }}.conf - marker: "# {mark} ANSIBLE MANAGED: {{ item.name }}.{{ domain }}" + path: /etc/dnsmasq.d/{{ dnsmasq_domain }}.conf + marker: "# {mark} ANSIBLE MANAGED: {{ item.name }}.{{ dnsmasq_domain }}" block: | - address=/{{ item.name }}.{{ domain }}/{{ item.ip }} + address=/{{ item.name }}.{{ dnsmasq_domain }}/{{ item.ip }} - name: "Flush handlers" From a1323ea97a709cf37156b59a130870e616d7d2d2 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Fri, 12 Dec 2025 10:32:30 +0300 Subject: [PATCH 3/4] fix verify task --- roles/dnsmasq/molecule/default/verify.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml index 8eaf15a..f9182a5 100644 --- a/roles/dnsmasq/molecule/default/verify.yml +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -16,4 +16,4 @@ register: dnsmasq_dig failed_when: 'dig.stdout != "127.0.0.1"' ansible.builtin.command: - cmd: "dig @127.0.0.1 -p 5353 hub.adm.vpn +short" + cmd: "dig @127.0.0.1 -p 5300 hub.adm.local +short" From 640c26279be9eafffdf9dae4c689a7946837f4b6 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Fri, 12 Dec 2025 10:37:51 +0300 Subject: [PATCH 4/4] fix verify error --- roles/dnsmasq/molecule/default/verify.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml index f9182a5..9a45b9e 100644 --- a/roles/dnsmasq/molecule/default/verify.yml +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -14,6 +14,6 @@ - name: "Test the output of the `dig` command" changed_when: false register: dnsmasq_dig - failed_when: 'dig.stdout != "127.0.0.1"' + failed_when: 'dnsmasq_dig.stdout != "127.0.0.1"' ansible.builtin.command: cmd: "dig @127.0.0.1 -p 5300 hub.adm.local +short"