effectivelywild.technitium_dns.technitium_dns_sign_zone module – Sign a DNS zone

Note

This module is part of the effectivelywild.technitium_dns collection (version 0.4.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install effectivelywild.technitium_dns.

To use it in a playbook, specify: effectivelywild.technitium_dns.technitium_dns_sign_zone.

New in effectivelywild.technitium_dns 0.1.0

Synopsis

  • Signs a primary DNS zone using the Technitium DNS API.

  • Will not update DNSSEC properties once intially signed.

Parameters

Parameter

Comments

algorithm

string / required

The algorithm to use for signing

Choices:

  • "RSA"

  • "ECDSA"

  • "EDDSA"

api_port

integer

Port for the Technitium DNS API. Defaults to 5380

Default: 5380

api_token

string / required

API token for authentication

api_url

string / required

Base URL for the Technitium DNS API

curve

string

The name of the curve to be used when using ECDSA or EDDSA algorithm

Use P256 or P384 for ECDSA algorithm

Use ED25519 or ED448 for EDDSA algorithm

Choices:

  • "P256"

  • "P384"

  • "ED25519"

  • "ED448"

dnsKeyTtl

integer

TTL for DNSKEY records

hashAlgorithm

string

The hash algorithm to be used when using RSA algorithm

Choices:

  • "MD5"

  • "SHA1"

  • "SHA256"

  • "SHA512"

iterations

integer

NSEC3 iterations

kskKeySize

integer

The size of the Key Signing Key (KSK) in bits to be used when using RSA algorithm

nxProof

string

Proof of non-existence

Choices:

  • "NSEC"

  • "NSEC3"

pemKskPrivateKey

string

PEM private key for KSK

When this parameter is specified, the private key specified is used instead of automatically generating it.

pemZskPrivateKey

string

PEM private key for ZSK

When this parameter is specified, the private key specified is used instead of automatically generating it.

saltLength

integer

NSEC3 salt length

validate_certs

boolean

Whether to validate SSL certificates when making API requests.

Choices:

  • false

  • true ← (default)

zone

string / required

The name of the primary zone to sign

zskKeySize

integer

The size of the Zone Signing Key (ZSK) in bits to be used when using RSA algorithm

zskRolloverDays

integer

ZSK rollover frequency in days

See Also

See also

effectivelywild.technitium_dns.technitium_dns_unsign_zone

Unsign a zone with DNSSEC

effectivelywild.technitium_dns.technitium_dns_convert_to_nsec

Convert signed zone from NSEC to NSEC3

effectivelywild.technitium_dns.technitium_dns_convert_to_nsec3

Convert signed zone from NSEC3 to NSEC

effectivelywild.technitium_dns.technitium_dns_get_dnssec_properties

Get dnssec properties for a zone

Examples

- name: Sign a primary zone with ECDSA
  technitium_dns_sign_zone:
    api_url: "http://localhost:5380"
    api_token: "{{ technitium_api_token }}"
    zone: "example.com"
    algorithm: "ECDSA"
    curve: "P256"
    dnsKeyTtl: 86400
    zskRolloverDays: 30
    nxProof: "NSEC3"
    iterations: 0
    saltLength: 0

- name: Sign a zone with RSA algorithm and custom key sizes
  technitium_dns_sign_zone:
    api_url: "http://localhost:5380"
    api_token: "{{ technitium_api_token }}"
    zone: "secure.example.com"
    algorithm: "RSA"
    hashAlgorithm: "SHA256"
    kskKeySize: 2048
    zskKeySize: 1024
    dnsKeyTtl: 3600
    zskRolloverDays: 90
    nxProof: "NSEC"

- name: Sign a zone with EDDSA and custom NSEC3 parameters
  technitium_dns_sign_zone:
    api_url: "http://localhost:5380"
    api_token: "{{ technitium_api_token }}"
    zone: "modern.example.com"
    algorithm: "EDDSA"
    curve: "ED25519"
    dnsKeyTtl: 172800
    zskRolloverDays: 60
    nxProof: "NSEC3"
    iterations: 10
    saltLength: 8

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

api_response

dictionary

Complete raw API response from Technitium DNS

Returned: always

response

dictionary

The API response payload (empty dict for successful sign operations)

Returned: always

Sample: {}

status

string

API response status

Returned: always

Sample: "ok"

changed

boolean

Whether the module made changes

Returned: always

Sample: true

failed

boolean

Whether the module failed

Returned: always

Sample: false

msg

string

Human readable message describing the result

Returned: always

Sample: "Zone 'demo.test.local' signed."

Authors

  • Frank Muise (@effectivelywild)