- Add support for ED25519 & ED448 keys to the dnssec_key type.
- Add support for Debian-12, Ubuntu-22.04 and Ubuntu-24.04
- Drop support for Puppet 6
- Require Stdlib 9.x
- Add support for Puppet 8
- Add support for Concat 9.x
- Add support for Concat 8.x
- The directory for DNSSEC keys managed internally by Bind (e.g. using inline-signing) has been changed from
/etc/bind/keys
to/var/lib/bind/keys
. This is necessary to manage the keys when Bind is running on a host where AppArmor is enabled. Copy all keys managed by Bind from/etc/bind/keys
to/var/lib/bind/keys
before updating this module!
- The defined type
bind::logging::channel_file
has a new parametermode
to set the file mode of the log file. The default value for the parameter is0640
. - A new boolean parameter
append_view
has been added to the defined typesbind::zone::primary
andbind::zone::secondary
. The file name of the zone file includes the view name if you set this parameter totrue
. Enable this if you have the same zone in different views to prevent zones in different views to reference the same zone file.
- The defined type parameter
dnssec
has been renamed todnssec_enable
to match the main class parameter. - All DNSSEC related zone parameters have been made optional. The config parameter
dnssec-enable
has been made obsolete with Bind 9.16 so that is no longer a prerequisite to activate other config options in the template. Make sure your Puppet code defines all parameters for your DNSSEC enabled primary zones. - A primary zone using dynamic updates can now have a
content
orsource
parameter. The content of the zone file is created if the file does not exist. Subsequent puppet runs will not update the zone file as long as dynamic updates are used and the parameterupdate_policy
is set for the zone.
- A syntax error with the in-view option has been fixed.
- The path to the
named-checkzone
binary is a class option now.
- The default for
root_hints_enable
has been changed fromtrue
tofalse
. Normally a root hints file is no longer used since Bind includes an internal list of root name servers.
- Fix path of options file on Debian-11.
- The class
bind::rate_limit
has been removed. All rate limit settings can be configured using the main classbind
.
- Implement
update-policy
for primary zones to manage dynamic zones.
- Drop Debian 9 support
- Add defined type
bind::dnssec_policy
.
- Add explicit class parameter
dnssec_lookaside
. - Add explicit class parameter
dnssec_validation
. - The parameters
dnssec_enable
anddnssec_lookaside
are obsolete with Bind 9.16.0 or later. They will be removed from the configuration file when a applicable Bind version is detected.
- Allow stdlib 8.0.0
- Implement
custom_options
parameter to set unusual configuration options that are not implemented in the main class.
- Implement
purge
,prepublish
,revoke
andretire
parameters fordnssec_key
type. - Implement user defined logfile mode for defined type
bind::logging::channel_file
.
Initial release