wip

bundles/bind/files/named.conf

@@ -1,3 +1,2 @@
 include "/etc/bind/named.conf.options";
 include "/etc/bind/named.conf.local";
-include "/etc/bind/named.conf.default-zones";

bundles/bind/files/named.conf.local

@@ -1,8 +1,13 @@
+% for view in views:
+view "${view['name']}" {
+  match-clients {${' '.join(f'{e}; ' for e in view['acl'])}};
   % for zone in zones:
   zone "${zone}" {
     type master;
-        file "/var/lib/bind/db.${zone}";
+    file "/var/lib/bind/${view['name']}/db.${zone}";
   };
   % endfor
-
+  include "/etc/bind/named.conf.default-zones";
   include "/etc/bind/zones.rfc1918";
+};
+% endfor

bundles/bind/items.py

@@ -1,4 +1,6 @@
-directories['/var/lib/bind'] = {
+from ipaddress import ip_address
+
+directories[f'/var/lib/bind'] = {
     'purge': True,
     'needed_by': [
         'svc_systemd:bind9',
@@ -38,9 +40,28 @@ files['/etc/bind/named.conf.options'] = {
         'svc_systemd:bind9:restart',
     ],
 }
+
+views = [
+    {
+        'name': 'internal',
+        'is_internal': True,
+        'acl': [
+            '10.0.0.0/16',
+        ]
+    },
+    {
+        'name': 'external', 
+        'is_internal': False,
+        'acl': [
+            'any',
+        ]
+    },
+]
+
 files['/etc/bind/named.conf.local'] = {
     'content_type': 'mako',
     'context': {
+        'views': views,
         'zones': sorted(node.metadata.get('bind/zones')),
     },
     'owner': 'root',
@@ -53,14 +74,50 @@ files['/etc/bind/named.conf.local'] = {
     ],
 }
 
+def use_record(record, records, view):
+    if record['type'] in ['A', 'AAAA']:
+        if view == 'external':
+            # no internal addresses in external view
+            if ip_address(record['value']).is_private:
+                return False
+        elif view == 'internal':
+            # external addresses in internal view only, if no internal exists
+            if ip_address(record['value']).is_global:
+                for other_record in records:
+                    if (
+                        record['name'] == other_record['name'] and
+                        record['type'] == other_record['type'] and
+                        ip_address(other_record['value']).is_private
+                    ):
+                        return False
+    return True
+    
+for view in views:
+    directories[f"/var/lib/bind/{view['name']}"] = {
+        'purge': True,
+        'needed_by': [
+            'svc_systemd:bind9',
+        ],
+        'triggers': [
+            'svc_systemd:bind9:restart',
+        ],
+    }
+
     for zone, records in node.metadata.get('bind/zones').items():
-    files[f'/var/lib/bind/db.{zone}'] = {
+        files[f"/var/lib/bind/{view['name']}/db.{zone}"] = {
             'group': 'bind',
             'source': 'db',
             'content_type': 'mako',
             'context': {
-            'records': records,
+                'view': view['name'],
+                'records': list(filter(
+                    lambda record: use_record(record, records, view['name']),
+                    records
+                )),
             },
+            'needs': [
+                f"directory:/var/lib/bind/{view['name']}",
+            ],
             'needed_by': [
                 'svc_systemd:bind9',
             ],