unkinben/puppet-bind
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tighten up the timing in db.empty

Browse Source 
stub and slave zones need to be overwritten with data from their master server
in a reasonable timeframe. Drop all of the intervals in the db.empty SOA down
to sub-minute values to speed convergence.
This commit is contained in:
Nate Riffe 2015-03-22 17:42:44 -05:00
parent 22caf612ba
commit f786420014
2 changed files with 33 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
files/db.empty
View File

@ -1,9 +1,9 @@
$TTL 86400 $TTL 86400
@ IN SOA localhost. root.localhost. ( @ IN SOA localhost. root.localhost. (
1 ; Serial 1 ; Serial
604800 ; Refresh 60 ; Refresh
86400 ; Retry 30 ; Retry
2419200 ; Expire 300 ; Expire
86400 ) ; Negative Cache TTL 10 ) ; Negative Cache TTL
; ;
@ IN NS localhost. @ IN NS localhost.

57
manifests/zone.pp
View File

@ -38,6 +38,7 @@ define bind::zone (
} else { } else {
$_source = 'puppet:///modules/bind/db.empty' $_source = 'puppet:///modules/bind/db.empty'
} }
file { "${cachedir}/${name}": file { "${cachedir}/${name}":
ensure => directory, ensure => directory,
owner => $bind::params::bind_user, owner => $bind::params::bind_user,
@ -46,37 +47,35 @@ define bind::zone (
require => Package['bind'], require => Package['bind'],
} }
unless $zone_type == 'stub' { file { "${cachedir}/${name}/${_domain}":
file { "${cachedir}/${name}/${_domain}": ensure => present,
ensure => present, owner => $bind::params::bind_user,
owner => $bind::params::bind_user, group => $bind::params::bind_group,
group => $bind::params::bind_group, mode => '0644',
mode => '0644', replace => false,
replace => false, source => $_source,
source => $_source, audit => [ content ],
audit => [ content ], }
if $dnssec {
exec { "dnssec-keygen-${name}":
command => "/usr/local/bin/dnssec-init '${cachedir}' '${name}'\
'${_domain}' '${key_directory}'",
cwd => $cachedir,
user => $bind::params::bind_user,
creates => "${cachedir}/${name}/${_domain}.signed",
timeout => 0, # crypto is hard
require => [
File['/usr/local/bin/dnssec-init'],
File["${cachedir}/${name}/${_domain}"]
],
} }
if $dnssec { file { "${cachedir}/${name}/${_domain}.signed":
exec { "dnssec-keygen-${name}": owner => $bind::params::bind_user,
command => "/usr/local/bin/dnssec-init '${cachedir}' '${name}'\ group => $bind::params::bind_group,
'${_domain}' '${key_directory}'", mode => '0644',
cwd => $cachedir, audit => [ content ],
user => $bind::params::bind_user,
creates => "${cachedir}/${name}/${_domain}.signed",
timeout => 0, # crypto is hard
require => [
File['/usr/local/bin/dnssec-init'],
File["${cachedir}/${name}/${_domain}"]
],
}
file { "${cachedir}/${name}/${_domain}.signed":
owner => $bind::params::bind_user,
group => $bind::params::bind_group,
mode => '0644',
audit => [ content ],
}
} }
} }
} }