0746dc187b
Logs show that the nameservers are being notified via ipv6 and rejecting the request: nsd[18851]: notify for acme.opendev.org. \ from 2001:4800:7819:104:be76:4eff:fe04:43d0 refused, no acl matches. Modify the nsd ACL to allow the ipv6 of the master to trigger updates. This is important for the letsencrypt process, where we need the acme.opendev.org domain updated in a timely fashion so that TXT authentication works. Change-Id: I785f9636dd05e15b8ffd211845f439be7e8344a3
42 lines
1.1 KiB
Django/Jinja
42 lines
1.1 KiB
Django/Jinja
server:
|
|
{% if 'address' in ansible_facts.default_ipv4 %}
|
|
ip-address: {{ ansible_facts.default_ipv4.address }}
|
|
{% endif %}
|
|
{% if 'address' in ansible_facts.default_ipv6 %}
|
|
ip-address: {{ ansible_facts.default_ipv6.address }}
|
|
{% endif %}
|
|
ip-transparent: no
|
|
debug-mode: no
|
|
database: /var/lib/nsd/nsd.db
|
|
identity: {{ inventory_hostname }}
|
|
server-count: 1
|
|
tcp-count: 250
|
|
tcp-query-count: 0
|
|
ipv4-edns-size: 4096
|
|
ipv6-edns-size: 4096
|
|
pidfile: /run/nsd/nsd.pid
|
|
port: 53
|
|
username: nsd
|
|
zonesdir: /var/lib/nsd
|
|
xfrdfile: /var/lib/nsd/xfrd.state
|
|
xfrd-reload-timeout: 1
|
|
verbosity: 0
|
|
hide-version: no
|
|
rrl-size: 1000000
|
|
rrl-ratelimit: 200
|
|
rrl-slip: 2
|
|
rrl-ipv4-prefix-length: 24
|
|
rrl-ipv6-prefix-length: 64
|
|
rrl-whitelist-ratelimit: 4000
|
|
key:
|
|
name: tsig
|
|
algorithm: {{ tsig_key.algorithm }}
|
|
secret: {{ tsig_key.secret }}
|
|
{% for zone in dns_zones %}
|
|
zone:
|
|
name: {{ zone.name }}
|
|
allow-notify: {{ dns_master_ipv4 }} NOKEY
|
|
allow-notify: {{ dns_master_ipv6 }} NOKEY
|
|
request-xfr: AXFR {{ dns_master_ipv4 }} tsig
|
|
{% endfor %}
|