playbook.yml

# Build all the DNS blocklist files for DoH and relay blocking
# example usage:
#   $ ansible-playbook -i inventory/ playbook.yml
---
- name: Build DNS blocklist files
  hosts: all
  connection: local
  gather_facts: false
  become: false

  tasks:

    - name: Generate README
      ansible.builtin.template:
        src: templates/README.md.j2
        dest: README.md
      tags: readme

    - name: Install dos2unix
      ansible.builtin.dnf:
        name: dos2unix
        state: present
      become_user: root
      become: true
      run_once: true

    - name: Ensure output files are cleared
      ansible.builtin.file:
        dest: "output/{{ item.0 }}"
        state: "{{ item.1 }}"
      loop: "{{ group_names | product(['absent', 'directory']) | list }}"

    - name: Ensure files are present locally
      ansible.builtin.file:
        state: "{{ item.1 }}"
        path: "lists/{{ item.0 }}/{{ item.2.type }}"
      with_nested:
        - "{{ group_names }}"
        - ['absent', 'directory']
        - "{{ dns_blocklists_lists }}"
      loop_control:
        label: "{{ item.0}}: {{ item.1 }}"

    - name: Download latest lists
      ansible.builtin.get_url:
        url: "{{ item.1.url }}"
        dest: "lists/{{ item.0 }}/{{ item.1.type }}/{{ item.1.name }}"
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"
      register: _dns_blocklists_download_lists
      retries: 5
      delay: 10
      until: _dns_blocklists_download_lists is succeeded
      when:
        - item.1.url is defined
        - not item.1.content is defined
      tags: jb

    - name: Create file with custom list content if defined
      ansible.builtin.copy:
        content: "{{ item.1.content }}"
        dest: "lists/{{ item.0 }}/{{ item.1.type }}/{{ item.1.name }}"
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"
      when:
        - item.1.content is defined
        - not item.1.url is defined
      tags: jb

    - name: Run dos2unix on all lists
      ansible.builtin.command:
        cmd: "dos2unix lists/{{ item.0 }}/{{ item.1.type }}/{{ item.1.name }}"
      args:
        warn: false
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"
      tags: dos2unix

    - name: Replace localhost and IP addresses in files
      ansible.builtin.replace:
        path: "lists/{{ item.0 }}/{{ item.1.type }}/{{ item.1.name }}"
        regexp: "{{ item.2 }}"
        replace: ''
      with_nested:
        - "{{ group_names }}"
        - "{{ dns_blocklists_lists }}"
        - "{{ dns_blocklists_replace_address }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Remove custom hosts localhost in files
      ansible.builtin.lineinfile:
        path: "lists/{{ item.0 }}/{{ item.1.type }}/{{ item.1.name }}"
        regexp: ' localhost'
        state: absent
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Remove comments from files
      ansible.builtin.lineinfile:
        path: "lists/{{ item.0 }}/{{ item.1.type }}/{{ item.1.name }}"
        regexp: '#'
        state: absent
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Combine files into output
      ansible.builtin.assemble:
        src: "lists/{{ item.0 }}/{{ item.1.type }}"
        dest: "output/{{ item.0 }}/{{ item.0 }}_{{ item.1.type }}.txt"
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Remove whitespace at start of lines
      ansible.builtin.replace:
        path: "output/{{ item.0 }}/{{ item.0 }}_{{ item.1.type }}.txt"
        regexp: '^ '
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    # Prevent out of zone errors caused by trailing periods
    - name: Remove full stops at the end of lines
      ansible.builtin.replace:
        path: "output/{{ item.0 }}/{{ item.0 }}_{{ item.1.type }}.txt"
        regexp: '\.$'
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Replace whitespace with new line
      ansible.builtin.replace:
        path: "output/{{ item.0 }}/{{ item.0 }}_{{ item.1.type }}.txt"
        regexp: ' '
        replace: '\n'
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Remove empty lines
      ansible.builtin.lineinfile:
        path: "output/{{ item.0 }}/{{ item.0 }}_{{ item.1.type }}.txt"
        regexp: '^\n'
        state: absent
      loop: "{{ group_names | product(dns_blocklists_lists) | list }}"
      loop_control:
        label: "{{ item.1.name }}"

    - name: Remove URLs in our whitelist
      ansible.builtin.lineinfile:
        path: "output/{{ item.0 }}/{{ item.0 }}_{{ item.1.type }}.txt"
        state: absent
        regexp: "{{ item.2 }}"
      loop: "{{ group_names | product(dns_blocklists_lists, dns_blocklists_exclude) | list }}"
      loop_control:
        label: "{{ item.2 }}"


- name: Build zonefiles
  hosts: all
  become: false
  tags: zonefile
  connection: local
  gather_facts: true

  tasks:

    - run_once: true
      delegate_to: localhost
      block:

        - name: Ensure bind-utils is installed
          ansible.builtin.dnf:
            name: bind-utils
            state: present
          become_user: root
          become: true
          when: ansible_distribution == 'Fedora'

        - name: Find output files
          ansible.builtin.find:
            paths: ./output
            recurse: true
            use_regex: true
            patterns: ".*.txt$"   # Find raw output files
            excludes: ".*.zone$"  # Ignore existing zonefiles
          register: _output_files

        - name: Read output files
          ansible.builtin.slurp:
            path: "{{ item }}"
          register: _output_files_slurp
          loop: "{{ _output_files.files | map(attribute='path') }}"

        - name: Generate zone files
          ansible.builtin.copy:
            content: |
              $TTL 3600
              ;namn   ttl     adr-    entry-  origin
              ;               klass   typ
              ;------------------------------------------------------------------------------
              @                       IN      SOA     rpz.mullvad.net.     support.mullvad.net. (
                                                      {{ now(fmt='%s') }}    ; serial
                                                      86400         ; refresh
                                                      7200          ; retry
                                                      2592000       ; expire
                                                      3600 )        ; ttl
                                      IN      NS      localhost.
              ;------------------------------------------------------------------------------
              {% for domain in _file_content.split('\n') %}
              {% if domain | length %}
              {{ domain }} IN CNAME .
              {% endif %}
              {% endfor %}
            dest: "{{ _output_path }}"
            validate: named-checkzone _ %s
          vars:
            _filename_full: "{{ item.source.split('/')[-1] }}"          # relay_adblock.txt
            _filename_short: "{{ _filename_full.split('.') | first }}"  # relay_adblock
            _directory: "{{ item.source.split('/')[:-1] | join('/') }}" # output/relay
            _output_path: "{{ _directory }}/{{ _filename_short }}.zone" # output/relay/relay_adblock.zone
            _file_content: "{{ item.content | b64decode }}"
          loop: "{{ _output_files_slurp.results }}"
          loop_control:
            label: "{{ _output_path }}"