Timotej Lazar
7907b6f0e5
This reverts commit 554bf1f711.
Turns out ISC dhcrelay will relay even unicast packets from clients. So
the DHCP server got both the routed and the relayed query.
This tells dnsmasq to tell clients to send everything through the relay.
Since everything now comes from the relay we can drop access from client
networks.
42 lines
816 B
YAML
42 lines
816 B
YAML
- name: Install packages
|
|
package:
|
|
name:
|
|
- dnsmasq
|
|
- bind-tools
|
|
- krb5
|
|
- py3-pexpect
|
|
|
|
- name: Configure kerberos
|
|
template:
|
|
dest: /etc/krb5.conf
|
|
src: krb5.conf.j2
|
|
|
|
- name: Init kerberos keytab
|
|
expect:
|
|
command: ktutil
|
|
responses:
|
|
'.*:':
|
|
- 'add_entry -password -p {{ password.ldap_user }} -k 1 -e aes256-cts-hmac-sha1-96'
|
|
- '{{ password.ldap_pass }}'
|
|
- 'write_kt /etc/krb5.keytab'
|
|
- 'exit'
|
|
args:
|
|
creates: /etc/krb5.keytab
|
|
|
|
- name: Copy DNS updater script
|
|
template:
|
|
dest: "/usr/local/bin/dns-update"
|
|
src: "dns-update.j2"
|
|
mode: 0700
|
|
|
|
- name: Configure dnsmasq
|
|
template:
|
|
dest: '/etc/dnsmasq.d/{{ item }}'
|
|
src: '{{ item }}.j2'
|
|
loop:
|
|
- 00-options.conf
|
|
- 10-ranges.conf
|
|
notify: restart dnsmasq
|
|
|
|
# TODO netboot config
|