From a9be647f848a6778b64fcf85220b4fb0e19dd8c7 Mon Sep 17 00:00:00 2001 From: s3lph Date: Wed, 29 Sep 2021 23:17:38 +0200 Subject: [PATCH] Add support for configuring ZSK and KSK rollovers, including submission checks --- roles/knot/defaults/main.yml | 7 ++++++- roles/knot/templates/etc/knot/knot.conf.j2 | 18 +++++++++++++++++- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/roles/knot/defaults/main.yml b/roles/knot/defaults/main.yml index 8fb282a..de7fb2b 100644 --- a/roles/knot/defaults/main.yml +++ b/roles/knot/defaults/main.yml @@ -21,7 +21,12 @@ knot_zone_dnssec_signing: 'on' knot_dnssec_policy_algorithm: ecdsap384sha384 knot_dnssec_policy_nsec3: 'on' -knot_dnssec_policy_ksk_shared: 'on' +knot_dnssec_policy_ksk_shared: 'off' knot_dnssec_policy_ksk_size: 384 knot_dnssec_policy_zsk_size: 384 +knot_dnssec_policy_zsk_lifetime: 30d +knot_dnssec_policy_ksk_lifetime: 0 knot_dnssec_policy_cds_publish: 'double-ds' + +knot_dnssec_submission_check_interval: 1h +knot_dnssec_submission_timeout: 0 diff --git a/roles/knot/templates/etc/knot/knot.conf.j2 b/roles/knot/templates/etc/knot/knot.conf.j2 index 4977766..70e4fd8 100644 --- a/roles/knot/templates/etc/knot/knot.conf.j2 +++ b/roles/knot/templates/etc/knot/knot.conf.j2 @@ -35,7 +35,7 @@ key: remote: -{% for remote in ( (zones | map(attribute='replicas') ) + (zones | map(attribute='masters') ) ) | flatten | unique %} +{% for remote in ( (zones | map(attribute='replicas') ) + (zones | map(attribute='masters') ) + (zones | map(attribute='parents') | select('defined') ) ) | flatten | unique %} - id: remote-{{ remote }} {% if knot_tsig_key is defined and 'knot_tsig_key' in hostvars[remote] %} @@ -84,6 +84,18 @@ acl: # MASTER ZONES # +submission: +{% for zone in zones %} + + - id: submission: {{ zone.name }} + check-interval: {{ knot_dnssec_submission_check_interval }} + timeout: {{ knot_dnssec_submission_timeout }} + parent: +{% for parent in zone.parents | default([]) %} + - {{ parent }} +{% endfor %} +{% endfor %} + policy: {% for zone in zones %} {% if inventory_hostname in zone.masters %} @@ -93,6 +105,10 @@ policy: nsec3: {{ knot_dnssec_policy_nsec3 }} ksk-size: {{ knot_dnssec_policy_ksk_size }} zsk-size: {{ knot_dnssec_policy_zsk_size }} + zsk-size: {{ knot_dnssec_policy_zsk_size }} + zsk-lifetime: {{ zone.zsk_lifetime | default(knot_dnssec_policy_zsk_lifetime) }} + ksk-lifetime: {{ zone.ksk_lifetime | default(knot_dnssec_policy_ksk_lifetime) }} + ksk-submission: submission-{{ zone.name }} ksk-shared: {{ knot_dnssec_policy_ksk_shared }} cds-cdnskey-publish: {{ knot_dnssec_policy_cds_publish }} {% endif %}