use templates for snippets

defaults/main.yml

@@ -11,3 +11,20 @@ unbound_access_control:
   - 'access-control: ::1 allow'
 
 unbound__state: 'present'
+
+# snippets for dns rebinding protection
+unbount__dns_rebind_protection: true
+unbound__protect_rebind_localhost: true
+unbound__protect_rebind_rfc1918: true
+unbound__protect_rebind_carrier_grade_nat: true
+unbound__protect_rebind_v4_link_local: true
+unbound__protect_rebind_unique_local: true
+unbound__protect_rebind_v6_link_local: true
+unbound__protect_rebind_rfc4291: true
+
+# dns qname privacy
+unbount__dns_qname_minimisation: true
+
+# anchor file
+unbound__auto_trust_anchor: true
+unbound__auto_trust_anchor_file: "/var/lib/unbound/root.key"

tasks/configure.yml

@@ -1,23 +1,44 @@
 ---
-- name: Copy unbound configuration snippets
+- name: Copy snipet to protect for DNS rebinding
   become: true
-  ansible.builtin.copy:
+  ansible.builtin.template:
-    src: '{{ item }}'
+    src: 'templates/snippets/private-addresses.conf'
     dest: '/etc/unbound/unbound.conf.d/'
     owner: root
     group: root
-    mode: 'u=rwX,g=rX,o=rX'
+    mode: 'u=rw,g=r,o=r'
-  with_fileglob:
+  notify: 'Systemctl restart unbound'
-    - 'files/snippets/*.conf'
+  when: unbount__dns_rebind_protection | bool
-  notify: Systemctl restart unbound
 
-- name: Copy main unbound configuration
+- name: Copy snipet for qname privacy
   become: true
   ansible.builtin.template:
-    src: 'files/unbound.conf'
+    src: 'templates/snippets/qname-minimisation.conf'
+    dest: '/etc/unbound/unbound.conf.d/'
+    owner: root
+    group: root
+    mode: 'u=rw,g=r,o=r'
+  notify: 'Systemctl restart unbound'
+  when: unbount__dns_qname_minimisation | bool
+
+- name: Copy anchor snippet
+  become: true
+  ansible.builtin.template:
+    src: 'templates/snippets/root-auto-trust-anchor-file.conf'
+    dest: '/etc/unbound/unbound.conf.d/'
+    owner: root
+    group: root
+    mode: 'u=rw,g=r,o=r'
+  notify: 'Systemctl restart unbound'
+  when: unbound__auto_trust_anchor | bool
+
+- name: Transfer main unbound configuration
+  become: true
+  ansible.builtin.template:
+    src: 'templates/unbound.conf'
     dest: '/etc/unbound/unbound.conf'
     owner: root
     group: root
     mode: 'u=rw,g=r,o=r'
     validate: unbound-checkconf %s
-  notify: Systemctl restart unbound
+  notify: 'Systemctl restart unbound'

templates/snippets/private-addresses.conf

@@ -1,31 +1,44 @@
+{{ ansible_managed | comment }}
 server:
     # Give IPv4 of IPv6 addresses or classless subnets. These are addresses on your private network,
     # and are not allowed to be returned for public internet names.  Any occurrence of such addresses
     # are removed from DNS answers. Additionally, the  DNSSEC validator may mark the answers bogus.
     # This protects against so-called DNS Rebinding.
 
+    # Legacy IP
+{% if unbound__protect_rebind_localhost | bool %}
     # localhost
     private-address: 127.0.0.0/8
-
+{% endif %}
+{% if unbound__protect_rebind_rfc1918 | bool %}
     # private IPv4 address spaces (rfc 1918)
     private-address: 10.0.0.0/8
     private-address: 172.16.0.0/12
     private-address: 192.168.0.0/16
-
+{% endif %}
+{% if unbound__protect_rebind_carrier_grade_nat | bool %}
     # carrier-grade NAT (rfc 6598)
     private-address: 100.64.0.0/10
-
+{% endif %}
+{% if unbound__protect_rebind_v4_link_local | bool %}
     # link-local addresses
     private-address: 169.254.0.0/16
+{% endif %}
 
+    # IPv6
+{% if unbound__protect_rebind_localhost | bool %}
     # localhost
     private-address: ::/128
-
+{% endif %}
+{% if unbound__protect_rebind_unique_local | bool %}
     # unique local addresses (rfc 4193)
     private-address: fd00::/8
-
+{% endif %}
+{% if unbound__protect_rebind_v6_link_local | bool %}
     # link-local addresses (rfc 4862, 4291)
     private-address: fe80::/10
-
+{% endif %}
+{% if unbound__protect_rebind_rfc4291 | bool %}
     # IPv4-mapped addresses (rfc 4291)
     private-address: ::ffff:0:0/96
+{% endif %}

templates/snippets/qname-minimisation.conf

@@ -1,3 +1,4 @@
+{{ ansible_managed | comment }}
 server:
     # Send minimum amount of information to upstream servers to enhance
     # privacy. Only sends minimum required labels of the QNAME and sets

templates/snippets/root-auto-trust-anchor-file.conf

@@ -1,4 +1,5 @@
+{{ ansible_managed | comment }}
 server:
     # Perform cryptographic DNSSEC validation using the root trust anchor.
     # File with trust anchor for one zone, which is tracked with RFC5011 probes.
-    auto-trust-anchor-file: "/var/lib/unbound/root.key"
+    auto-trust-anchor-file: "{{ unbound__auto_trust_anchor_file }}"

templates/unbound.conf

@@ -1,3 +1,5 @@
+{{ ansible_managed | comment }}
+
 include: "/etc/unbound/unbound.conf.d/*.conf"
 
 remote-control:

vars/main.yml

@@ -1,3 +1,3 @@
 ---
-playbook_version_number: 69  # should be integer
+playbook_version_number: 70  # should be integer
 playbook_version_path: 'role-unbound_roles-ansible_github.com.version'