from ipaddress import IPv4Address, IPv6Address, ip_address from bundlewrap.metadata import atomic defaults = { 'apt': { 'packages': { 'pdns-server': {}, 'pdns-tools': {}, 'pdns-backend-bind': {}, 'pdns-backend-pgsql': {}, }, }, 'icinga2_api': { 'powerdns': { 'services': { 'POWERDNS PROCESS': { 'command_on_monitored_host': '/usr/lib/nagios/plugins/check_procs -C pdns_server -c 1:', 'vars.notification.mail': True, 'vars.notification.sms': True, }, }, }, }, 'powerdns': { 'api_key': repo.vault.password_for('{} powerdns api'.format(node.name)), }, 'postgresql': { 'roles': { 'powerdns': { 'password': repo.vault.password_for('{} postgresql powerdns'.format(node.name)), }, }, 'databases': { 'powerdns': { 'owner': 'powerdns', }, }, }, } if node.has_bundle('telegraf'): defaults['telegraf'] = { 'input_plugins': { 'builtin': { 'powerdns': [{ 'unix_sockets': [ '/var/run/pdns/pdns.controlsocket', ], }], }, }, 'additional_groups': { 'pdns', }, } @metadata_reactor.provides( 'icinga2_api/powerdns/services', ) def monitoring_for_primary_nameserver(metadata): if metadata.get('powerdns/is_secondary', False): return {} return { 'icinga2_api': { 'powerdns': { 'services': { 'POWERDNS WEB INTERFACE': { 'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_http_url_for_string http://localhost:8081/ "PowerDNS"', }, }, }, }, } @metadata_reactor.provides( 'powerdns/my_secondary_servers', ) def get_ips_of_secondary_nameservers(metadata): if metadata.get('powerdns/is_secondary', False): return {} ips = set() for rnode in repo.nodes_in_group('dns'): if rnode.metadata.get('powerdns/is_secondary', False): if rnode.name == node.name: raise BundleError(f'{node.name} cannot be its own secondary') for _, found_ips in repo.libs.tools.resolve_identifier(repo, rnode.name).items(): ips.update({str(ip) for ip in found_ips}) return { 'powerdns': { 'my_secondary_servers': ips, }, } @metadata_reactor.provides( 'powerdns/my_primary_servers', ) def get_ips_of_primary_nameservers(metadata): if not metadata.get('powerdns/is_secondary', False): return {} ips = {} for rnode in repo.nodes_in_group('dns'): if not rnode.metadata.get('powerdns/is_secondary', False): if rnode.name == node.name: raise BundleError(f'{node.name} cannot be its own secondary') hostname = rnode.metadata.get('hostname') ips[hostname] = set() for _, found_ips in repo.libs.tools.resolve_identifier(repo, rnode.name).items(): ips[hostname].update({str(ip) for ip in found_ips}) return { 'powerdns': { 'my_primary_servers': ips, }, } @metadata_reactor.provides( 'powerdns/bind-zones/kunbox.net/records', ) def generate_dns_entries_for_nodes(metadata): results = set() for rnode in repo.nodes: node_name_split = rnode.name.split('.') node_name_split.reverse() dns_name = '.'.join(node_name_split) ip4 = None ip6 = None found_ips = repo.libs.tools.resolve_identifier(repo, rnode.name, only_physical=True) for ip in sorted(found_ips['ipv4']): if not ip4 and not ip.is_private: ip4 = ip for ip in sorted(found_ips['ipv6']): if not ip6 and not ip.is_private: ip6 = ip if not (ip4 or ip6) and found_ips['ipv4']: # do it again, but do not filter out private addresses for ip in sorted(found_ips['ipv4']): if not ip4: ip4 = ip if ip4: results.add('{} IN A {}'.format(dns_name, ip4)) if ip6: results.add('{} IN AAAA {}'.format(dns_name, ip6)) return { 'powerdns': { 'bind-zones': { 'kunbox.net': { 'records': results, }, }, }, } @metadata_reactor.provides( 'hosts/entries', ) def hosts_entries_for_all_dns_servers(metadata): entries = {} for rnode in repo.nodes_in_group('dns'): if rnode.name == node.name: continue found_ips = repo.libs.tools.resolve_identifier(repo, rnode.name) for ip in sorted(found_ips['ipv4']): if not ip.is_private: entries[str(ip)] = { rnode.metadata.get('hostname'), rnode.name, } if rnode.metadata.get('powerdns/my_hostname', None): entries[str(ip)].add(rnode.metadata.get('powerdns/my_hostname')) return { 'hosts': { 'entries': entries, }, } @metadata_reactor.provides( 'firewall/port_rules', ) def firewall(metadata): return { 'firewall': { 'port_rules': { '53/tcp': atomic(metadata.get('powerdns/restrict-to/dns', {'*'})), '53/udp': atomic(metadata.get('powerdns/restrict-to/dns', {'*'})), '8081/tcp': atomic(metadata.get('powerdns/restrict-to/api', set())), }, }, }