Skip to content

Commit 084e16b

Browse files
bastelfreakbastelfreak
authored
Merge pull request #332 from bastelfreak/timer
Add systemd timer to update root.hints file
2 parents 70e36a7 + 26a15f7 commit 084e16b

File tree

7 files changed

+132
-41
lines changed

7 files changed

+132
-41
lines changed

‎.fixtures.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@ fixtures:
22
repositories:
33
concat: "https://github.com/puppetlabs/puppetlabs-concat.git"
44
stdlib: "https://github.com/puppetlabs/puppetlabs-stdlib.git"
5+
systemd: "https://github.com/voxpupuli/puppet-systemd.git"

‎REFERENCE.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
### Classes
88

9-
* [`unbound`](#unbound): Class: unbound Installs and configures Unbound, the caching DNS resolver from NLnet Labs
9+
* [`unbound`](#unbound): Installs and configures Unbound, the caching DNS resolver from NLnet Labs
1010
* [`unbound::remote`](#unbound--remote): Class: unbound::remote Configure remote control of the unbound daemon process === Parameters: [*enable*] (optional) The option is used t
1111

1212
### Defined types
@@ -36,8 +36,6 @@
3636

3737
### <a name="unbound"></a>`unbound`
3838

39-
Class: unbound
40-
4139
Installs and configures Unbound, the caching DNS resolver from NLnet Labs
4240

4341
#### Parameters
@@ -47,6 +45,7 @@ The following parameters are available in the `unbound` class:
4745
* [`hints_file`](#-unbound--hints_file)
4846
* [`hints_file_content`](#-unbound--hints_file_content)
4947
* [`unbound_version`](#-unbound--unbound_version)
48+
* [`update_root_hints`](#-unbound--update_root_hints)
5049
* [`manage_service`](#-unbound--manage_service)
5150
* [`verbosity`](#-unbound--verbosity)
5251
* [`statistics_interval`](#-unbound--statistics_interval)
@@ -274,6 +273,14 @@ the version of the installed unbound instance. defaults to the fact, but you can
274273

275274
Default value: `$facts['unbound_version']`
276275

276+
##### <a name="-unbound--update_root_hints"></a>`update_root_hints`
277+
278+
Data type: `Enum['absent','present','unmanaged']`
279+
280+
If set to true (and hints_file isn't set to 'builtin') a systemd timer will be configured to update the root hints file every month
281+
282+
Default value: `fact('systemd') ? { true => 'present', default => 'unmanaged'`
283+
277284
##### <a name="-unbound--manage_service"></a>`manage_service`
278285

279286
Data type: `Boolean`

‎files/roothints.timer‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# THIS FILE IS MANAGED BY PUPPET
2+
# BASED ON https://wiki.archlinux.org/title/Unbound#Roothints_systemd_timer
3+
[Unit]
4+
Description=Run root.hints monthly
5+
6+
[Timer]
7+
OnCalendar=monthly
8+
Persistent=true
9+
10+
[Install]
11+
WantedBy=timers.target

‎manifests/init.pp‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
1-
# Class: unbound
21
#
3-
# Installs and configures Unbound, the caching DNS resolver from NLnet Labs
2+
# @summary Installs and configures Unbound, the caching DNS resolver from NLnet Labs
43
#
54
# @param hints_file
65
# File path to the root-hints. Set to 'builtin' to remove root-hint option from unbound.conf and use built-in hints.
76
# @param hints_file_content
87
# Contents of the root hints file, if it's not remotely fetched.
98
# @param unbound_version
109
# the version of the installed unbound instance. defaults to the fact, but you can overwrite it. this reduces the initial puppet runs from two to one
10+
# @param update_root_hints
11+
# If set to true (and hints_file isn't set to 'builtin') a systemd timer will be configured to update the root hints file every month
12+
#
1113
class unbound (
1214
Boolean $manage_service = true,
1315
Integer[0,5] $verbosity = 1,
@@ -135,7 +137,7 @@
135137
Optional[Integer] $key_cache_slabs = undef,
136138
Optional[Unbound::Size] $neg_cache_size = undef,
137139
Boolean $unblock_lan_zones = false,
138-
Boolean $insecure_lan_zones = false, # version 1.5.8
140+
Boolean $insecure_lan_zones = false, # version 1.5.8
139141
Unbound::Local_zone $local_zone = {},
140142
Array[String[1]] $local_data = [],
141143
Array[String[1]] $local_data_ptr = [],
@@ -212,6 +214,7 @@
212214
Integer[1] $redis_timeout = 100,
213215
Stdlib::Absolutepath $unbound_conf_d = "${confdir}/unbound.conf.d",
214216
Unbound::Hints_file $hints_file = "${confdir}/root.hints",
217+
Enum['absent','present','unmanaged'] $update_root_hints = fact('systemd') ? { true => 'present', default => 'unmanaged' },
215218
Optional[String[1]] $hints_file_content = undef,
216219
Hash[String[1], Unbound::Rpz] $rpzs = {},
217220
Optional[String[1]] $unbound_version = $facts['unbound_version'],
@@ -316,6 +319,19 @@
316319
mode => '0444',
317320
content => $hints_file_content,
318321
}
322+
if $update_root_hints == 'present' {
323+
systemd::timer { 'roothints.timer':
324+
timer_content => file("${module_name}/roothints.timer"),
325+
service_content => epp("${module_name}/roothints.service.epp", { 'hints_file' => $hints_file, 'root_hints_url' => $root_hints_url, 'fetch_client' => $fetch_client }),
326+
active => true,
327+
enable => true,
328+
}
329+
}
330+
}
331+
if $update_root_hints == 'absent' {
332+
systemd::timer { 'roothints.timer':
333+
ensure => 'absent',
334+
}
319335
}
320336

321337
# purge unmanaged files in configuration directory

‎metadata.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,10 @@
113113
{
114114
"name": "puppetlabs/stdlib",
115115
"version_requirement": ">= 4.25.0 < 10.0.0"
116+
},
117+
{
118+
"name": "puppet/systemd",
119+
"version_requirement": ">= 6.3.0 < 7.0.0"
116120
}
117121
]
118122
}

‎spec/classes/init_spec.rb‎

Lines changed: 78 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,6 @@
1818

1919
pidfile = nil
2020

21-
if facts.dig(:os, 'family').nil?
22-
if facts[:osfamily]
23-
puts "Skipping tests on on platform #{facts[:osfamily]} due to missing facts[:os][:family]"
24-
else
25-
puts "Skipping tests on on platform #{facts[:kernel]} due to missing facts[:os][:family]"
26-
end
27-
next
28-
end
29-
3021
case facts[:os]['family']
3122
when 'Debian'
3223
pidfile = '/run/unbound.pid'
@@ -67,6 +58,10 @@
6758
it { is_expected.to contain_file(keys_d_dir) }
6859
it { is_expected.to contain_file(hints_file) }
6960

61+
context 'on Linux', if: facts[:kernel] == 'Linux' do
62+
it { is_expected.to contain_systemd__timer('roothints.timer') }
63+
end
64+
7065
it do
7166
expect(subject).to contain_file(unbound_conf_d).with(
7267
'ensure' => 'directory',
@@ -1038,41 +1033,89 @@
10381033
end
10391034
end
10401035

1041-
context 'no root hints in config' do
1042-
let(:params) do
1043-
{
1044-
hints_file: 'builtin'
1045-
}
1036+
context 'roothints' do
1037+
context 'no root hints in config' do
1038+
let(:params) do
1039+
{
1040+
hints_file: 'builtin'
1041+
}
1042+
end
1043+
1044+
it do
1045+
expect(subject).to contain_concat__fragment(
1046+
'unbound-header'
1047+
).without_content(%r{root-hints})
1048+
end
1049+
1050+
it { is_expected.not_to contain_systemd__timer('roothints.timer') }
10461051
end
10471052

1048-
it do
1049-
expect(subject).to contain_concat__fragment(
1050-
'unbound-header'
1051-
).without_content(%r{root-hints})
1053+
context 'no root hints in config and update_root_hints=unmanaged' do
1054+
let(:params) do
1055+
{
1056+
hints_file: 'builtin',
1057+
update_root_hints: 'unmanaged'
1058+
}
1059+
end
1060+
1061+
it do
1062+
expect(subject).to contain_concat__fragment(
1063+
'unbound-header'
1064+
).without_content(%r{root-hints})
1065+
end
1066+
1067+
it { is_expected.not_to contain_systemd__timer('roothints.timer') }
10521068
end
1053-
end
10541069

1055-
context 'hieradata root hints' do
1056-
let(:params) do
1057-
{
1058-
skip_roothints_download: true,
1059-
hints_file_content: File.read('spec/classes/expected/hieradata-root-hint.conf'),
1060-
}
1070+
context 'no root hints in config and update_root_hints=absent' do
1071+
let(:params) do
1072+
{
1073+
hints_file: 'builtin',
1074+
update_root_hints: 'absent'
1075+
}
1076+
end
1077+
1078+
it do
1079+
expect(subject).to contain_concat__fragment(
1080+
'unbound-header'
1081+
).without_content(%r{root-hints})
1082+
end
1083+
1084+
it { is_expected.to contain_systemd__timer('roothints.timer').with_ensure('absent') }
10611085
end
10621086

1063-
it do
1064-
expect(subject).to contain_file(hints_file).with(
1065-
'ensure' => 'file',
1066-
'mode' => '0444',
1067-
'content' => File.read('spec/classes/expected/hieradata-root-hint.conf')
1068-
)
1087+
context 'update_root_hints=absent' do
1088+
let(:params) do
1089+
{
1090+
update_root_hints: 'absent'
1091+
}
1092+
end
1093+
1094+
it { is_expected.to contain_systemd__timer('roothints.timer').with_ensure('absent') }
10691095
end
1070-
end
10711096

1072-
context 'with File defaults' do
1073-
let(:pre_condition) { "File { mode => '0644', owner => 'root', group => 'root' }" }
1097+
context 'hieradata root hints' do
1098+
let(:params) do
1099+
{
1100+
skip_roothints_download: true,
1101+
hints_file_content: File.read('spec/classes/expected/hieradata-root-hint.conf'),
1102+
}
1103+
end
10741104

1075-
it { is_expected.to compile.with_all_deps }
1105+
it do
1106+
expect(subject).to contain_file(hints_file).with(
1107+
'ensure' => 'file',
1108+
'mode' => '0444',
1109+
'content' => File.read('spec/classes/expected/hieradata-root-hint.conf')
1110+
)
1111+
end
1112+
end
1113+
1114+
context 'with File defaults' do
1115+
let(:pre_condition) { "File { mode => '0644', owner => 'root', group => 'root' }" }
1116+
1117+
it { is_expected.to compile.with_all_deps }
1118+
end
10761119
end
10771120

10781121
context 'RPZs config' do

‎templates/roothints.service.epp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<%- | Stdlib::Absolutepath $hints_file, Stdlib::HTTPSUrl $root_hints_url, String[1] $fetch_client | -%>
2+
# THIS FILE IS MANAGED BY PUPPET
3+
# BASED ON https://wiki.archlinux.org/title/Unbound#Roothints_systemd_timer
4+
[Unit]
5+
Description=Update root hints for unbound
6+
After=network.target
7+
8+
[Service]
9+
ExecStart=<%= $fetch_client %> <%= $hints_file %> <%= $root_hints_url %>

0 commit comments

Comments
 (0)