---

# User and group for bind
bind9_user: bind
bind9_group: bind

# Run bind as a DNS recursor?
bind9_recursor: yes

# Run bind as authoritative nameserver?
bind9_authoritative: yes

# run bind with forwarding?
bind9_forward: yes

# Setup DNSSEC for recursor and zones?
bind9_dnssec: no

# set QNAME minimization behavior in the BIND resolver; atm bind9 default is relaxed
bind9_qname_minimization: "relaxed"

# DNSSEC validation mode (yes/no/auto)
bind9_dnssec_validation: "auto"

# Run bind as a hidden master (i.e. limit queries to our_networks)
bind9_hidden_master: no

# Only notify nameservers from also-notify, not from the zone NS records.
# Necessary to keep traffic between nameservers in private network.
bind9_notify_explicit: no

# Default zone type
bind9_zone_type: master

# Permitted hosts/networks for recursion (when configured as recursor)
bind9_our_networks:
  - localhost
  - localnets

# Permitted hosts/networks for zone transfers
bind9_our_neighbors:
  - localhost
  - localnets

# Install custom rndc.key
bind9_rndc_algorithm: hmac-md5
# bind9_rndc_key:

# Global primaries for all zones (if configured as secondary)
# bind9_masters:
#  - name: ns-primary
#    addresses:
#      - 1.2.3.4

# Primaries for particular zones (if configured as secondary)
# bind9_masters_extra:
#  - name: ns-primary
#    addresses:
#      - 1.2.3.4

# Global secondaries for all zones (if configured as primary)
# bind9_slaves:
#  - 1.2.3.4

# Enable BIND's XML statistics-channels (for monitoring purposes)
bind9_statistics_enabled: False

# DNS zones
# bind9_zone_dynamic: zone files created from template (see
#         `templates/bind/zones/db.template.j2` for yaml structure)
# bind9_zone_static:  zone files copied from `files/bind/zones/`
bind9_zones_dynamic: []
bind9_zones_static: []

# Authoritative include files
bind9_authoritative_includes: []

# DNSSEC is activated for all DNS zones per default
bind9_dnssec_zones_default_enabled: true

# Send DNSSEC KSK in DNSKEY and DS format over XMPP after it got created
bind9_dnssec_notify_xmpp: no
bind9_dnssec_notify_xmpp_user: user@jabber.example.org
bind9_dnssec_notify_xmpp_password: insecure
bind9_dnssec_notify_xmpp_rcpt: admin@jabber.example.org
bind9_dnssec_notify_xmpp_host: "{{ ansible_jabber_host | default('localhost') }}"

# Send DNSSEC KSK in DNSKEY and DS format over matrix webhook after it got created
bind9_dnssec_notify_matrix: no
bind9_matrix_notifier_url: ""

bind9_matrix_notifier_format: plain
bind9_matrix_notifier_text: ""
bind9_matrix_notifier_display_name: Ansible
bind9_matrix_notifier_avatar_url: https://cdn.icon-icons.com/icons2/2389/PNG/512/ansible_logo_icon_145495.png

bind9_matrix_notifier_body:
  text: "{{ bind9_matrix_notifier_text }}"
  format: "{{ bind9_matrix_notifier_format }}"
  displayName: "{{ bind9_matrix_notifier_display_name }}"
  avatarUrl: "{{ bind9_matrix_notifier_avatar_url }}"


# Install monit file for bind9 named
bind9_monit_enabled: no

bind9_packages:
  - bind9
  - dnsutils

# Directory for bind9 files templates
bind9_templates: ""
# The default value takes templates form the {{ role_path }}/templates/ directory of the role
# You can set your own templates, for example with:
# bind9_templates: "{{ playbook_dir }}/host_vars/<my_host>/templates/"

# Logging
bind9_named_logging: False
bind9_log_path: /var/log/bind
bind9_log_severity: warning  # critical | error | warning | notice | info | debug [ level ] | dynamic
bind9_log_versions: 3
bind9_log_size: 60m           # Time units

bind9_log_categories:
  - name: default
    destination: bind_log
  - name: update
    destination: bind_log
  - name: update-security
    destination: bind_log
  - name: security
    destination: default_syslog
  - name: queries
    destination: bind_log
  - name: lame-servers
    destination: 'null'

bind9_generate_ddns_key: true
bind9_zonedir: /etc/bind/zones
bind9_keydir: /etc/bind/keys
bind9_local_keydir: files/bind/zones
