29.10. Using Ansible to install an IdM client configured to use eDNS

Procedure

1. On the controller, create a playbook named install-client-edns.yml that includes a task to install an IdM client with eDNS enabled:

   ---
   - name: Playbook to configure an IdM client with eDNS enabled
     hosts: ipaclients
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipaclient_domain=idm.example.com
       ipaclient_dns_over_tls=true
   
     roles:
     - role: freeipa.ansible_freeipa.ipaclient

   If DNSSEC validation is turned off on the IdM server that the client is communicating with, you must also disable it on the client by setting ipaclient_no_dnssec_validation = true in the vars section of the playbook. Otherwise, DNS over TLS will not function correctly for the client.

2. Run the Ansible playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-client-edns.yml

Verification

1. On the IdM client, review /etc/unbound/unbound.conf:

   $ cat /etc/unbound/unbound.conf

2. Verify that the configuration contains the IP address and host name of the IdM server.

Troubleshooting

1. On the IdM client, run a DNS query to trigger traffic:

   $ dig <domain_name>

2. Review the logs on the IdM server to verify that the query was routed through DoT.