role_dns: add ACLs

roles/dns/defaults/main.yml

@@ -4,3 +4,4 @@ dns_secondary_zonefile_dir: /var/lib/bind
 dns_primary_zones: {}
 dns_primary_zonefile_dir: /etc/bind/zones
 dns_primary_ips: {}
+dns_acls: {}

roles/dns/tasks/main.yml

@@ -56,6 +56,13 @@
   notify:
     - reload bind
 
+- name: Create config file for ACLs
+  ansible.builtin.template:
+    src: named.conf.acl.j2
+    dest: "/etc/bind/named.conf.acl"
+  notify:
+    - reload bind
+
 - name: Ensure ansible managed config files are included
   ansible.builtin.blockinfile:
     marker: "// {mark} ANSIBLE MANAGED"
@@ -63,6 +70,7 @@
     block: |
       // Include TSIG first
       include "/etc/bind/named.conf.tsig";
+      include "/etc/bind/named.conf.acl";
       include "/etc/bind/named.conf.primary";
       include "/etc/bind/named.conf.secondary";
   notify:

roles/dns/templates/named.conf.acl.j2

+// WARNING Ansible managed, changes will be overwritten!
+
+{% for acl, aclline in dns_acls.items() %}
+acl "{{ acl }}" {
+{%   for line in aclline | default([]) %}
+        {{ line }}
+{%   endfor %}
+};
+{% endfor %}