Skip to content

Commit 2b35b8d

Browse files
jsf9kjsf9k
committed
Allow user to disable the systemd-resolved stub DNS resolver
Also add a Molecule scenario that tests this functionality.
1 parent e501e5c commit 2b35b8d

File tree

16 files changed

+180
-4
lines changed

16 files changed

+180
-4
lines changed

‎.github/workflows/build.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,7 @@ jobs:
176176
matrix:
177177
scenario:
178178
- default
179+
- disable_stub_resolver
179180
- specify_resolv_conf_target
180181
steps:
181182
- id: harden-runner

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ repos:
126126
hooks:
127127
- id: bandit
128128
# Bandit complains about the use of assert() in tests
129-
exclude: molecule/(default|specify_resolv_conf_target)/tests
129+
exclude: molecule/(default|disable_stub_resolver|specify_resolv_conf_target)/tests
130130
args:
131131
- --config=.bandit.yml
132132
- repo: https://github.com/psf/black-pre-commit-mirror

‎README.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ It performs the following actions:
1010
- Installs `systemd-resolved` and ensures that `resolvconf` is not
1111
installed.
1212
- Creates an `/etc/resolv.conf` symlink.
13+
- Optionally disables the `systemd-resolved` stub DNS resolver that
14+
listens at `127.0.0.53`.
1315

1416
## Requirements ##
1517

@@ -19,7 +21,8 @@ None.
1921

2022
| Variable | Description | Default | Required |
2123
|----------|-------------|---------|----------|
22-
| systemd_resolved_resolv_conf_filename | The location of the target to which /etc/resolv.conf will be symlinked. Note that `dynamic_resolv_conf_target_dir` and `static_resolv_conf_target_dir` are role vars that are available for use when defining this variable. See [here](https://man.archlinux.org/man/systemd-resolved.8#/ETC/RESOLV.CONF) for more information. | `"{{ dynamic_resolv_conf_target_dir }}/stub-resolv.conf"` | No |
24+
| systemd_resolved_dns_stub_listener | The value to use for the DNSStubListener value in the `systemd-resolved` configuration file. Must be `tcp`, `udp`, or a boolean value. See [here](https://man.archlinux.org/man/resolved.conf.5.en) for more information. | `"yes"` | No |
25+
| systemd_resolved_resolv_conf_filename | The location of the target to which `/etc/resolv.conf` will be symlinked. Note that `dynamic_resolv_conf_target_dir` and `static_resolv_conf_target_dir` are role vars that are available for use when defining this variable. See [here](https://man.archlinux.org/man/systemd-resolved.8#/ETC/RESOLV.CONF) for more information. | `"{{ dynamic_resolv_conf_target_dir }}/stub-resolv.conf"` | No |
2326
<!--
2427
| required_variable | Describe its purpose. | n/a | Yes |
2528
-->

‎defaults/main.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
---
2+
# The value to use for the DNSStubListener value in the
3+
# systemd-resolved configuration file. Must be tcp, udp, or a boolean
4+
# value.
5+
#
6+
# See here for more information:
7+
# https://man.archlinux.org/man/resolved.conf.5.en
8+
systemd_resolved_dns_stub_listener: true
9+
210
# The location of the file to which /etc/resolv.conf will be
311
# symlinked. The symlink target should normally be one of the
412
# following files provided by systemd-resolved:

‎molecule/default/prepare.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,14 @@
1010
- name: Unmount /etc/resolv.conf
1111
ansible.builtin.import_playbook: unmount.yml
1212

13-
# We require dig for one of our Molecule tests
13+
# We require dig and netstat for our Molecule tests
1414
- name: Install dig
1515
hosts: all
1616
become: true
1717
become_method: ansible.builtin.sudo
1818
tasks:
19-
- name: Install dig
19+
- name: Install some tools that are required for testing
2020
ansible.builtin.package:
2121
name:
2222
- dnsutils
23+
- net-tools

‎molecule/disable_stub_resolver/INSTALL.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../default/INSTALL.rst

‎molecule/disable_stub_resolver/converge.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
- name: Converge
3+
hosts: all
4+
tasks:
5+
- name: Include ansible-role-systemd-resolved
6+
ansible.builtin.include_role:
7+
name: ansible-role-systemd-resolved
8+
vars:
9+
systemd_resolved_dns_stub_listener: false

‎molecule/disable_stub_resolver/molecule.yml

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
driver:
5+
name: docker
6+
platforms:
7+
- cgroupns_mode: host
8+
command: /lib/systemd/systemd
9+
image: docker.io/geerlingguy/docker-amazonlinux2023-ansible:latest
10+
name: amazonlinux2023-systemd
11+
platform: amd64
12+
pre_build_image: true
13+
privileged: true
14+
volumes:
15+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
16+
# These platforms do not provide systemd-resolved.
17+
# - cgroupns_mode: host
18+
# command: /lib/systemd/systemd
19+
# image: docker.io/geerlingguy/docker-debian10-ansible:latest
20+
# name: debian10-systemd
21+
# platform: amd64
22+
# pre_build_image: true
23+
# privileged: true
24+
# volumes:
25+
# - /sys/fs/cgroup:/sys/fs/cgroup:rw
26+
# - cgroupns_mode: host
27+
# command: /lib/systemd/systemd
28+
# image: docker.io/geerlingguy/docker-debian11-ansible:latest
29+
# name: debian11-systemd
30+
# platform: amd64
31+
# pre_build_image: true
32+
# privileged: true
33+
# volumes:
34+
# - /sys/fs/cgroup:/sys/fs/cgroup:rw
35+
- cgroupns_mode: host
36+
command: /lib/systemd/systemd
37+
image: docker.io/geerlingguy/docker-debian12-ansible:latest
38+
name: debian12-systemd
39+
platform: amd64
40+
pre_build_image: true
41+
privileged: true
42+
volumes:
43+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
44+
- cgroupns_mode: host
45+
command: /lib/systemd/systemd
46+
image: docker.io/cisagov/docker-debian13-ansible:latest
47+
name: debian13-systemd
48+
platform: amd64
49+
pre_build_image: true
50+
privileged: true
51+
volumes:
52+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
53+
- cgroupns_mode: host
54+
command: /lib/systemd/systemd
55+
image: docker.io/cisagov/docker-kali-ansible:latest
56+
name: kali-systemd
57+
platform: amd64
58+
pre_build_image: true
59+
privileged: true
60+
volumes:
61+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
62+
- cgroupns_mode: host
63+
command: /lib/systemd/systemd
64+
image: docker.io/geerlingguy/docker-fedora38-ansible:latest
65+
name: fedora38-systemd
66+
platform: amd64
67+
pre_build_image: true
68+
privileged: true
69+
volumes:
70+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
71+
- cgroupns_mode: host
72+
command: /lib/systemd/systemd
73+
image: docker.io/geerlingguy/docker-fedora39-ansible:latest
74+
name: fedora39-systemd
75+
platform: amd64
76+
pre_build_image: true
77+
privileged: true
78+
volumes:
79+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
80+
# These platforms do not provide systemd-resolved.
81+
# - cgroupns_mode: host
82+
# command: /lib/systemd/systemd
83+
# image: docker.io/geerlingguy/docker-ubuntu2004-ansible:latest
84+
# name: ubuntu-20-systemd
85+
# platform: amd64
86+
# pre_build_image: true
87+
# privileged: true
88+
# volumes:
89+
# - /sys/fs/cgroup:/sys/fs/cgroup:rw
90+
# - cgroupns_mode: host
91+
# command: /lib/systemd/systemd
92+
# image: docker.io/geerlingguy/docker-ubuntu2204-ansible:latest
93+
# name: ubuntu-22-systemd
94+
# platform: amd64
95+
# pre_build_image: true
96+
# privileged: true
97+
# volumes:
98+
# - /sys/fs/cgroup:/sys/fs/cgroup:rw
99+
scenario:
100+
name: disable_stub_resolver
101+
verifier:
102+
name: testinfra

‎molecule/disable_stub_resolver/prepare.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../default/prepare.yml

‎molecule/disable_stub_resolver/requirements.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../default/requirements.yml

0 commit comments

Comments
 (0)