Open Dialgatrainer02 opened 4 days ago
blocky seems to be working
dig @192.168.0.201 google.com
; <<>> DiG 9.20.3 <<>> @192.168.0.201 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34233
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 300 IN A 142.250.200.14
;; Query time: 33 msec
;; SERVER: 192.168.0.201#53(192.168.0.201) (UDP)
;; WHEN: Wed Nov 13 17:02:50 GMT 2024
;; MSG SIZE rcvd: 55
it correctly resolves google.com so im unsure why ansible is failing
i can run the same dig command while ansible still seems to think its not working
domain must be prefixed with '.', please read the comment in the readme and defaults file.
it is i just removed it as i didnt want to leak my domain
blocky logs, don't help much. what version of ansible-role-blocky-dns is it? 0.2.1? Did you configure it to listen to the IP 127.0.0.1? why? which task is it failing? does the /opt/blocky/config.yaml look like expected? custom dns part?
i told ansible galaxy to install of main no vars have been changed apart from the ones i showed before the last task in the role "Ensure blocky is ready"
cat /opt/blocky/config.yaml
# Ansible managed
upstream:
default:
- 9.9.9.9
- 149.112.112.112
- 1.1.1.1
- 1.0.0.1
blocking:
blockTTL: 10s
blackLists:
ads:
- https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
- https://raw.githubusercontent.com/notracking/hosts-blocklists/master/hostnames.txt
- https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
- https://blocklistproject.github.io/Lists/ads.txt
- https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/pro.txt
malware:
- https://blocklistproject.github.io/Lists/malware.txt
- https://blocklistproject.github.io/Lists/ransomware.txt
- https://blocklistproject.github.io/Lists/scam.txt
- https://blocklistproject.github.io/Lists/phishing.txt
clientGroupsBlock:
default:
- ads
- malware
whiteLists:
ads:
- https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt
ports:
dns: 53
http: 4000
logLevel: info
caching:
minTime: 5m
maxTime: 60m
prefetching: true
customDNS:
customTTL: 60m
filterUnmappedTypes: true
rewrite:
mapping:
{}
conditional:
fallbackUpstream: false
mapping:
{}
prometheus:
enable: true
path: /metrics
this is the config and it doesnt look as expected as the custom dns for hosts havent applied
this is thee template file from my ansiblehome/roles direcotry
# {{ ansible_managed }}
{% if blocky__hosts_dns_enabled -%}
# Added to blocky__custom_dns from inventory due to blocky__hosts_dns_enabled=true
{% for host in groups[blocky__hosts_dns_invenory_group] -%}
{% set fqdn = host + blocky__hosts_dns_domain %}
{% if (hostvars[host]["blocky__hosts_dns_ignore"] is undefined or not hostvars[host]["blocky__hosts_dns_ignore"])
and fqdn not in blocky__custom_dns
and hostvars[host][blocky__hosts_dns_host_ip_var] is defined
and host != "localhost" %}
{% set _ = blocky__custom_dns.update({ fqdn: hostvars[host][blocky__hosts_dns_host_ip_var] }) -%}
{% else -%}
# Skipping {{ host }}
{% endif -%}
{% endfor -%}
{% endif -%}
upstream:
{{ blocky__upstreams | to_nice_yaml(indent=2) | trim | indent(2) }}
blocking:
blockTTL: 10s
blackLists:
{{ blocky__blocking_blacklists | to_nice_yaml(indent=2) | trim | indent(4) }}
clientGroupsBlock:
{{ blocky__blocking_client_groups_block | to_nice_yaml(indent=2) | trim | indent(4) }}
whiteLists:
{{ blocky__blocking_whitelists | to_nice_yaml(indent=2) | trim | indent(4) }}
ports:
dns: {{ blocky__ports_dns | to_nice_yaml(indent=2) | trim | indent(2) }}
http: {{ blocky__ports_http | to_nice_yaml(indent=2) | trim | indent(2) }}
logLevel: {{ blocky__log_level | to_yaml }}
caching:
minTime: 5m
maxTime: 60m
prefetching: true
customDNS:
customTTL: 60m
filterUnmappedTypes: true
rewrite:
mapping:
{{ blocky__custom_dns | to_nice_yaml(indent=2) | trim | indent(4) }}
conditional:
fallbackUpstream: false
mapping:
{{ blocky__custom_domain | to_nice_yaml(indent=2) | trim | indent(4) }}
prometheus:
enable: true
path: /metrics
Thanks, so did you add a ansible_host=...
variable with an IP then in the host_vars/inventory for your hosts?
ahhh!! its blocky__hosts_dns_enabled
not blocky_hosts_dns_enabled
I've updated the config to add the second underscore
custom dns works and i can dig it to get the correct result however for some reason the playbook still fails at https://github.com/ngine-io/ansible-role-blocky-dns/blob/d257d6e0fffd61ac9f95ac1322a384df55d9ef06/tasks/main.yml#L96C1-L99C13
Hi @Dialgatrainer02 I can not reproduce. Could you share the value of blocky__ports_dns
in your setup? Did you set this variable in your project? or is it still the default value of the role?
It is the default variable the only specified card are use host DNS and the host DNS domain. the DNS server is listening on port 53 I can confirm using dig. Blocky is running in an unprivileged lxc on proxmox just in case that nessecary
My code is at https://github.com/Dialgatrainer02/home-lab/tree/main/playbooks/dns.yml
I also use lxc on proxmox:
can you confirm, that in your blocky lxc:
# ss -ltpn | grep 53
LISTEN 0 4096 *:53 *:* users:(("blocky",pid=121,fd=10))
When I get home I'll.be able to I'll.update you then
I forgot I destroyed my home lab yesterday so I rebuilt it ran the playbook and it's working now??
it came back i ran it twice consecutively first run it worked no problem this time it failed
fatal: [dns1]: FAILED! => {"changed": false, "elapsed": 301, "msg": "Timeout when waiting for 127.0.0.1:53"}
fatal: [dns2]: FAILED! => {"changed": false, "elapsed": 301, "msg": "Timeout when waiting for 127.0.0.1:53"}
same message as before
i was ssh'ed in while it was running ss -ltpn | grep 53
LISTEN 0 4096 *:53 *:* users:(("blocky",pid=7361,fd=8))
even when this was showing the port was in use it failed on both machines i changed my vars to add 2 custom dns rules but i can dig them correctly so thats not the issue
can not reproduce, but added an option in #5 to disable the readiness check.
use blocky__readiness_check_enabled=false
to disable readiness check
Thank you I have no clue why it's doing it tho
the ansible error while running the role
this playbook snippet including my vars
journalctl output from blocky