3.5. Using an Ansible playbook to ensure the presence of a primary DNS zone in IdM with multiple variables

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

2. Make a copy of the dnszone-all-params.yml Ansible playbook file. For example:

   $ cp dnszone-all-params.yml dnszone-all-params-copy.yml

3. Open the dnszone-all-params-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnszone task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the zone_name variable to zone.idm.example.com.
   • Set the allow_sync_ptr variable to true if you want to allow the synchronization of forward and reverse records, that is the synchronization of A and AAAA records with PTR records.
   • Set the dynamic_update variable to true to enable IdM client machines to add or update their IP addresses.
   • Set the dnssec variable to true to allow inline DNSSEC signing of records in the zone.
   • Set the allow_transfer variable to the IP addresses of secondary name servers in the zone.
   • Set the allow_query variable to the IP addresses or networks that are allowed to issue queries.
   • Set the forwarders variable to the IP addresses of global forwarders.
   • Set the serial variable to the SOA record serial number.
   • Define the refresh, retry, expire, minimum, ttl, and default_ttl values for DNS records in the zone.
   • Define the NSEC3PARAM record for the zone using the nsec3param_rec variable.
   • Set the skip_overlap_check variable to true to force DNS creation even if it overlaps with an existing zone.

   • Set the skip_nameserver_check to true to force DNS zone creation even if the nameserver is not resolvable.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       freeipa.ansible_freeipa.ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         allow_sync_ptr: true
         dynamic_update: true
         dnssec: true
         allow_transfer:
           - 1.1.1.1
           - 2.2.2.2
         allow_query:
           - 1.1.1.1
           - 2.2.2.2
         forwarders:
           - ip_address: 8.8.8.8
           - ip_address: 8.8.4.4
             port: 52
         serial: 1234
         refresh: 3600
         retry: 900
         expire: 1209600
         minimum: 3600
         ttl: 60
         default_ttl: 90
         name_server: server.idm.example.com.
         admin_email: admin.admin@idm.example.com
         nsec3param_rec: "1 7 100 0123456789abcdef"
         skip_overlap_check: true
         skip_nameserver_check: true
         state: present

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnszone.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-all-params-copy.yml