13 file { '/var/lib/unbound':
17 require => Package['unbound'],
20 file { '/var/lib/unbound/root.key':
26 source => 'puppet:///modules/unbound/root.key'
28 file { '/var/lib/unbound/debian.org.key':
34 source => 'puppet:///modules/unbound/debian.org.key'
36 file { '/etc/unbound/unbound.conf':
37 content => template('unbound/unbound.conf.erb'),
40 File['/var/lib/unbound/root.key'],
41 File['/var/lib/unbound/debian.org.key']
43 notify => Service['unbound']
46 if getfromhash($site::nodeinfo, 'misc', 'resolver-recursive') {
47 if getfromhash($site::nodeinfo, 'hoster', 'allow_dns_query') {
48 @ferm::rule { 'dsa-dns':
50 description => 'Allow nameserver access',
51 rule => sprintf('&TCP_UDP_SERVICE_RANGE(53, (%s))', join_spc(filter_ipv4(getfromhash($site::nodeinfo, 'hoster', 'allow_dns_query')))),
53 @ferm::rule { 'dsa-dns6':
55 description => 'Allow nameserver access',
56 rule => sprintf('&TCP_UDP_SERVICE_RANGE(53, (%s))', join_spc(filter_ipv6(getfromhash($site::nodeinfo, 'hoster', 'allow_dns_query')))),