bundlewrap/bundles/powerdns/metadata.py

209 lines
5.7 KiB
Python

from ipaddress import IPv4Address, IPv6Address, ip_address
from bundlewrap.metadata import atomic
defaults = {
'apt': {
'packages': {
'pdns-server': {},
'pdns-tools': {},
'pdns-backend-bind': {},
'pdns-backend-pgsql': {},
},
},
'icinga2_api': {
'powerdns': {
'services': {
'POWERDNS PROCESS': {
'command_on_monitored_host': '/usr/lib/nagios/plugins/check_procs -C pdns_server -c 1:',
'vars.notification.mail': True,
'vars.notification.sms': True,
},
},
},
},
'powerdns': {
'api_key': repo.vault.password_for('{} powerdns api'.format(node.name)),
},
'postgresql': {
'roles': {
'powerdns': {
'password': repo.vault.password_for('{} postgresql powerdns'.format(node.name)),
},
},
'databases': {
'powerdns': {
'owner': 'powerdns',
},
},
},
}
if node.has_bundle('telegraf'):
defaults['telegraf'] = {
'input_plugins': {
'builtin': {
'powerdns': [{
'unix_sockets': [
'/var/run/pdns/pdns.controlsocket',
],
}],
},
},
'additional_groups': {
'pdns',
},
}
@metadata_reactor.provides(
'icinga2_api/powerdns/services',
)
def monitoring_for_primary_nameserver(metadata):
if metadata.get('powerdns/is_secondary', False):
return {}
return {
'icinga2_api': {
'powerdns': {
'services': {
'POWERDNS WEB INTERFACE': {
'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_http_url_for_string http://localhost:8081/ "PowerDNS"',
},
},
},
},
}
@metadata_reactor.provides(
'powerdns/my_secondary_servers',
)
def get_ips_of_secondary_nameservers(metadata):
if metadata.get('powerdns/is_secondary', False):
return {}
ips = set()
for rnode in repo.nodes_in_group('dns'):
if rnode.metadata.get('powerdns/is_secondary', False):
if rnode.name == node.name:
raise BundleError(f'{node.name} cannot be its own secondary')
for _, found_ips in repo.libs.tools.resolve_identifier(repo, rnode.name).items():
ips.update({str(ip) for ip in found_ips})
return {
'powerdns': {
'my_secondary_servers': ips,
},
}
@metadata_reactor.provides(
'powerdns/my_primary_servers',
)
def get_ips_of_primary_nameservers(metadata):
if not metadata.get('powerdns/is_secondary', False):
return {}
ips = {}
for rnode in repo.nodes_in_group('dns'):
if not rnode.metadata.get('powerdns/is_secondary', False):
if rnode.name == node.name:
raise BundleError(f'{node.name} cannot be its own secondary')
hostname = rnode.metadata.get('hostname')
ips[hostname] = set()
for _, found_ips in repo.libs.tools.resolve_identifier(repo, rnode.name).items():
ips[hostname].update({str(ip) for ip in found_ips})
return {
'powerdns': {
'my_primary_servers': ips,
},
}
@metadata_reactor.provides(
'powerdns/bind-zones/kunbox.net/records',
)
def generate_dns_entries_for_nodes(metadata):
results = set()
for rnode in repo.nodes:
node_name_split = rnode.name.split('.')
node_name_split.reverse()
dns_name = '.'.join(node_name_split)
ip4 = None
ip6 = None
found_ips = repo.libs.tools.resolve_identifier(repo, rnode.name, only_physical=True)
for ip in sorted(found_ips['ipv4']):
if not ip4 and not ip.is_private:
ip4 = ip
for ip in sorted(found_ips['ipv6']):
if not ip6 and not ip.is_private:
ip6 = ip
if not ip4 and found_ips['ipv4']:
# do it again, but do not filter out private addresses
for ip in sorted(found_ips['ipv4']):
if not ip4:
ip4 = ip
if ip4:
results.add('{} IN A {}'.format(dns_name, ip4))
if ip6:
results.add('{} IN AAAA {}'.format(dns_name, ip6))
return {
'powerdns': {
'bind-zones': {
'kunbox.net': {
'records': results,
},
},
},
}
@metadata_reactor.provides(
'hosts/entries',
)
def hosts_entries_for_all_dns_servers(metadata):
entries = {}
for rnode in repo.nodes_in_group('dns'):
if rnode.name == node.name:
continue
found_ips = repo.libs.tools.resolve_identifier(repo, rnode.name)
for ip in sorted(found_ips['ipv4']):
if not ip.is_private:
entries[str(ip)] = {
rnode.metadata.get('hostname'),
rnode.name,
}
if rnode.metadata.get('powerdns/my_hostname', None):
entries[str(ip)].add(rnode.metadata.get('powerdns/my_hostname'))
return {
'hosts': {
'entries': entries,
},
}
@metadata_reactor.provides(
'firewall/port_rules',
)
def firewall(metadata):
return {
'firewall': {
'port_rules': {
'53': atomic(metadata.get('powerdns/restrict-to/dns', {'*'})),
'53/udp': atomic(metadata.get('powerdns/restrict-to/dns', {'*'})),
'8081': atomic(metadata.get('powerdns/restrict-to/api', set())),
},
},
}