WIP

roles/unbound/defaults/main.yml

@@ -0,0 +1,14 @@
+unbound_listen_interfaces:
+  - "0.0.0.0"
+
+unbound_access_control:
+  - "0.0.0.0/0 allow"
+
+unbound_forward_zones:
+  - name: "."
+    forward_to: "8.8.8.8"
+
+unbound_stub_zones: []
+# - name: <string>
+#   stub_to: <string>
+#   no_cache: no (default yes)

roles/unbound/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: Restart unbound
+  ansible.builtin.service:
+    name: "unbound"
+    state: "restarted"

roles/unbound/tasks/main.yml

@@ -0,0 +1,14 @@
+- name: Install Unbound
+  ansible.builtin.apt:
+    name:
+      - "unbound"
+  notify:
+    - "Restart unbound"
+
+- name: Deploy unbounf config file
+  ansible.builtin.template:
+    src: "templates/unbound.conf"
+    dest: "/etc/unbound/unbound.conf.d/unbound.conf"
+    mode: "0644"
+  notify:
+    - "Restart unbound"

roles/unbound/templates/unbound.conf

@@ -0,0 +1,21 @@
+server:
+  do-not-query-localhost: no
+{% for interface in unbound_listen_interfaces %}
+  interface: {{ interface }}
+{% endfor %}
+{% for access in unbound_access_control %}
+  access-control: {{ access }}
+{% endfor %}
+{% for zone in unbound_stub_zones %}
+
+stub-zone:
+  name: "{{ zone.name }}"
+  stub-addr: {{ zone.stub_to }}
+  stub-no-cache: {{ zone.no_cache | default('yes') }}
+{% endfor %}
+{% for zone in unbound_forward_zones %}
+
+forward-zone:
+  name: "{{ zone.name }}"
+  forward-addr: {{ zone.forward_to }}
+{% endfor %}