Fix DDNS keyfile creation, configuration and writeable zone location

README.md

@@ -109,6 +109,30 @@ And similarly `zone_my_reverse_inaddr_arpa` and `zone_my_reverse_ip6_arpa` for I
 
 * deploy role to your servers
 
+### DDNS updates
+
+## Key generation
+
+If you want to have your DDNS keys created by this role configure `bind9_generate_ddns_key`:
+
+```yaml
+-  bind9_generate_ddns_key: true
+```
+
+Keys will by default be stored to `files/bind/zones` withinin your playbook location, but you can customize this with `bind9_local_keydir`
+
+```yaml
+-  bind9_local_keydir: true
+```
+
+## Zone database
+
+Please note that for DDNS updates to work, the location of the zone files needs to be writable by the BIND process.
+Linux distros with Mandatory Access Control (Apparmor, SELinux) ususally don't allow writing to the default `/etc/bind/zones` path. In order to circumvent this you may want to change the zone files location to `/var/lib/bind/zones` instead:
+
+```yaml
+-  bind9_zonedir: /var/lib/bind/zones
+```
 
 ## Dependencies
 

defaults/main.yml

@@ -138,4 +138,6 @@ bind9_log_categories:
   - name: lame-servers
     destination: 'null'
 
-bind9_zonedir: /var/lib/bind/zones
+bind9_generate_ddns_key: true
+bind9_zonedir: /etc/bind/zones
+bind9_local_keydir: files/bind/zones

tasks/create_ddns_keys.yml

@@ -2,7 +2,7 @@
   become: false
   delegate_to: localhost
   stat:
-    path: bind/zones/{{ item.update_keyfile }}.private
+    path: "{{ bind9_local_keydir }}/{{ item.update_keyfile }}.private"
   register: update_keyfile_tmp
   when: item.update_keyfile is defined
 
@@ -16,14 +16,14 @@
 - name: copy DDNS key to control host
   fetch:
     src: "/etc/bind/keys/{{ item.update_keyfile }}.private"
-    dest: bind/zones/{{ item.update_keyfile }}.private
+    dest: "{{ bind9_local_keydir }}/{{ item.update_keyfile }}.private"
     flat: true
   when: ddns_key.changed
 
 - name: create dummy DDNS public key file on control host
   become: false
   delegate_to: localhost
   file:
-    path: bind/zones/{{ item.update_keyfile }}.key
+    path: "{{ bind9_local_keydir }}/{{ item.update_keyfile }}.key"
     state: touch
   when: ddns_key.changed

tasks/main.yml

@@ -38,6 +38,7 @@
 - include_tasks: create_ddns_keys.yml
   with_items:
     - "{{ bind9_zones_static + bind9_zones_dynamic }}"
+  when: bind9_generate_ddns_key | bool
 
 - name: Configure bind9 named.conf files
   template: