ansible: disable dnssec validation

On at least one internet connection (Proximus DSL) we've seen failures to
resolve kosmos.sigsegv.be. Disabling DNSSec makes it work again (despite dnssec
being correct on the domain).

diff --git a/ansible/roles/domotica/tasks/main.yaml b/ansible/roles/domotica/tasks/main.yaml
index 130a21d..fa9b923 100644 (file)
--- a/ansible/roles/domotica/tasks/main.yaml
+++ b/ansible/roles/domotica/tasks/main.yaml
@@ -26,6 +26,14 @@
     mode: 0644
   become: true
   notify: "restart pf"
+- name: disable unbound dnssec validation
+  template:
+    src: disable_dnssec_validation.conf
+    dest: "/etc/unbound/conf.d/disable_dnssec_validation.conf"
+    owner: root
+    group: wheel
+    mode: 0644
+  become: true
 - name: unbound enable
   community.general.sysrc:
     name: local_unbound_enable

diff --git a/ansible/roles/domotica/templates/disable_dnssec_validation.conf b/ansible/roles/domotica/templates/disable_dnssec_validation.conf
new file mode 100644 (file)
index 0000000..9ca4352
--- /dev/null
+++ b/ansible/roles/domotica/templates/disable_dnssec_validation.conf
@@ -0,0 +1,2 @@
+server:
+       val-permissive-mode: yes