4224254d36a6b61b6073952415bc32642166f4ed
[mirror/dsa-puppet.git] / modules / named / templates / named.conf.options.erb
1 //
2 // THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
3 // USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
4 //
5
6 acl Nagios {
7 <%=
8   str = ''
9   scope.lookupvar('site::localinfo').keys.sort.each do |node|
10       if scope.lookupvar('site::localinfo')[node]['nagiosmaster']
11           scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
12               str += "\t" + ip + "/32;\n"
13           end
14       end
15   end
16   str-%>
17 };
18
19 options {
20         directory "/var/cache/bind";
21
22         auth-nxdomain no;    # conform to RFC1035
23 <% if classes.include?("named::recursor") -%>
24         listen-on-v6 { any; };
25 <% else -%>
26         listen-on { ! 127.0.0.1; any; };
27         listen-on-v6 { ! ::1; any; };
28 <% end -%>
29
30         allow-transfer { none; };
31         allow-update { none; };
32 <% if classes.include?("named::geodns") -%>
33         blackhole { 192.168.0.0/16; 10.0.0.0/8; 172.16.0.0/12; };
34 <% end -%>
35
36 <%=
37   allowed='Nagios; '
38   if classes.include?('named::recursor')
39     allowed += 'localnets; '
40   end
41
42   str =  "\tallow-recursion { " + allowed + " };\n"
43   str += "\tallow-query { " + allowed + " };\n"
44
45   str
46 -%>
47
48 <% if classes.include?('named::authoritative') or classes.include?('named::geodns') -%>
49         dnssec-enable yes;
50         dnssec-validation yes;
51 <% end -%>
52 };
53
54 logging {
55
56         channel queries {
57 <% if classes.include?('named::geodns') -%>
58                 file "/var/log/bind9/geoip-query.log" versions 4 size 40m;
59 <% else -%>
60                 file "/var/log/bind9/named-query.log" versions 4 size 40m;
61 <% end -%>
62                 print-time yes;
63                 print-category yes;
64         };
65         category queries { queries; };
66         category lame-servers { null; };
67 };
68
69