93bb1d549e
Per [1] ansible_date_time is NOT actually the date/time -- it is the time cached from the facts. It seems this can not be changed because, of course, things have started depending on this behaviour. This is particuarly incorrect if you're using this as a serial number for DNS and it is not incrementing across runs, and thus bind is refusing to load the new entries in the acme.opendev.org zone during letsencrypt runs, and the TXT authentication fails. Use the suggested work-around in the issue which is an external call to date. [1] https://github.com/ansible/ansible/issues/22561 Change-Id: Ic3f12f52e8fbb87a7cd673c37c6c4280c56c2b0f
18 lines
755 B
Django/Jinja
18 lines
755 B
Django/Jinja
; -*- mode: zone -*-
|
|
$ORIGIN acme.opendev.org.
|
|
$TTL 1m
|
|
@ IN SOA adns1.opendev.org. hostmaster.opendev.org. (
|
|
{{ lookup('pipe', 'date +%s') }} ; serial number unixtime
|
|
1h ; refresh (secondary checks for updates)
|
|
10m ; retry (secondary retries failed axfr)
|
|
10d ; expire (secondary ends serving old data)
|
|
5m ) ; min ttl (cache time for failed lookups)
|
|
@ IN NS ns1.opendev.org.
|
|
@ IN NS ns2.opendev.org.
|
|
|
|
; NOTE: DO NOT HAND EDIT. THESE KEYS ARE MANAGED BY ANSIBLE
|
|
|
|
{% for key in acme_txt_keys %}
|
|
@ IN TXT "{{key[1]}}"
|
|
{% endfor %}
|