Fix DDNS keyfile creation, configuration and writeable zone location

[0xMattijs]

Problem

This Ansible role writes zone files to a hard coded /etc/bind/zones directory, which causes problems on systems with mandatory access control such as Apparmor. The profile for Apparmor does not allow the BIND process to create the necessary journal files and update the zone files under /etc/bind/zones.

Solution

Parameterize the zone directory and default to /var/lib/bind/zones, for which write access is allowed by the Apparmor profile.

PR

This PR parameterises the location for storing the zone files. It also includes code to generate DDNS keys using tsig-keygen if a configured update_keyfile does not exist already. Since tsig-keygen generates a full key configuration section, the named.conf.options.j2 template has been adjusted accordingly.

[doobry-systemli]

Dear @0xMattijs, thanks for your contribution!

After a first look I have two comments:

1. I'd prefer to keep the default path for keys at /etc/bind/keys to not break backwards-compability. Since you make it configurable anyway, I think that should be fine.
2. The tasks to optionally create a DDNS key result in changes in your local playbook. While I see the advantage of providing code to do so, I don't like this being executed per default. Most setups I know have their Ansible playbook in a Git repository and altering that while deploying is unexecpted behaviour in my eyes. Maybe instead it would be an option to run the tasks only if a variable is set to true (e.g. with ansible-playbook ... -e 'bind9_generate_ddns_key=true') and document that behaviour in README.md? What do you think about that approach?

[0xMattijs]

Hi @doobry-systemli . Totally makes sense. I have processed your suggestions in the PR:

• Make generating keys optional with bind9_generate_ddns_key
• Adjusted the default zone DB location back to /etc/bind/zones
• Adjusted the default key storage location to files/bind/zones within the playbook (the location where the role expects them when provided by the user)
• Updated the README

[doobry-systemli]

Thanks a lot for adressing my comments @0xMattijs. Sorry for the delay with my response. The PR looks good to be merged now - just a minor comment.