init

.ansible-lint

@@ -0,0 +1,3 @@
+---
+skip_list:
+  - experimental

.github/dependabot.yml

@@ -0,0 +1,8 @@
+# Set update schedule for GitHub Actions
+---
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,75 @@
+---
+name: CI
+"on":
+  pull_request:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+
+defaults:
+  run:
+    working-directory: ngine_io.blocky_dns
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: ngine_io.blocky_dns
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.x
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint ansible ansible-lint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+      - name: Lint code.
+        run: |
+          ansible-lint .
+
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - distro: debian12
+            playbook: converge.yml
+          - distro: rockylinux8
+            playbook: converge.yml
+          - distro: rockylinux9
+            playbook: converge.yml
+#         - distro: ubuntu2204
+#         playbook: converge.yml
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: ngine_io.blocky_dns
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.x"
+
+      - name: Install test dependencies.
+        run: pip3 install ansible molecule molecule-docker docker
+
+      - name: Run Molecule tests.
+        run: molecule test
+        env:
+          PY_COLORS: "1"
+          ANSIBLE_FORCE_COLOR: "1"
+          MOLECULE_DISTRO: ${{ matrix.distro }}
+          MOLECULE_PLAYBOOK: ${{ matrix.playbook }}

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+---
+# This workflow requires a GALAXY_API_KEY secret present in the GitHub
+# repository or organization.
+
+name: Release
+"on":
+  release:
+    types: [created]
+
+defaults:
+  run:
+    working-directory: ngine_io.blocky_dns
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: ngine_io.blocky_dns
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.x
+
+      - name: Install Ansible.
+        run: pip3 install ansible-core
+
+      - name: Trigger a new import on Galaxy.
+        env:
+          ANSIBLE_GALAXY_API_KEY: ${{ secrets.ANSIBLE_GALAXY_API_KEY }}
+        run: >-
+          ansible-galaxy role import
+          --token "$ANSIBLE_GALAXY_API_KEY"
+          --role-name blocky_dns
+          ngine_io
+          $(echo ${{ github.repository }} | cut -d/ -f2)

.gitignore

@@ -0,0 +1 @@
+dev

.yamllint

@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length:
+    max: 180
+    level: warning

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 René Moser
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,47 @@
+[![CI](https://github.com/ngine-io/ansible-role-blocky-dns/actions/workflows/ci.yml/badge.svg)](https://github.com/ngine-io/ansible-role-blocky-dns/actions/workflows/ci.yml)
+
+# Ansible Role: Blocky DNS
+
+Installs and manages [Blocky DNS](https://0xerr0r.github.io/blocky).
+
+## Requirements
+
+None.
+
+## Installation
+
+Via `requirements.yml`:
+
+```yaml
+---
+# file: requirements.yml
+roles:
+  - name: ngine_io.blocky_dns
+    version: v0.1.0
+```
+
+To install:
+
+```
+ansible-galaxy install -r requirements.yml
+```
+
+## Dependencies
+
+None.
+
+## Example Playbook
+
+```yaml
+- hosts: dns
+  roles:
+    - role: ngine_io.blocky_dns
+```
+
+## License
+
+MIT / Apache2
+
+## Author Information
+
+This role was created in 2024 by [René Moser](https://renemoser.net).

defaults/main.yml

@@ -0,0 +1,51 @@
+---
+blocky__version: v0.22
+blocky__arch: "{{ ansible_machine }}"
+blocky__system: "{{ ansible_system }}"
+blocky__base_url: https://github.com/0xERR0R/blocky/releases/download
+blocky__download_url: "{{ blocky__base_url }}/{{ blocky__version }}/blocky_{{ blocky__version }}_{{ blocky__system }}_{{ blocky__arch }}.tar.gz"
+blocky__checksum_url: "{{ blocky__base_url }}/{{ blocky__version }}/blocky_checksums.txt"
+blocky__download_path: /tmp
+blocky__install_path: /opt/blocky
+
+blocky__blocking_client_groups_block:
+  default:
+    - ads
+    - malware
+
+blocky__blocking_blacklists:
+  ads:
+    - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
+    - https://raw.githubusercontent.com/notracking/hosts-blocklists/master/hostnames.txt
+    - https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
+    - https://blocklistproject.github.io/Lists/ads.txt
+    - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/pro.txt
+  malware:
+    - https://blocklistproject.github.io/Lists/malware.txt
+    - https://blocklistproject.github.io/Lists/ransomware.txt
+    - https://blocklistproject.github.io/Lists/scam.txt
+    - https://blocklistproject.github.io/Lists/phishing.txt
+
+blocky__blocking_whitelists:
+  ads:
+    - https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt
+#   - |
+#     www.googleadservices.com
+
+blocky__ports_dns: 53
+blocky__ports_http: 4000
+
+blocky__log_level: info
+
+blocky__upstreams:
+  default:
+    - 9.9.9.9
+    - 149.112.112.112
+    - 1.1.1.1
+    - 1.0.0.1
+
+blocky__custom_dns: {}
+# web1.example.com: 10.100.1.2
+
+blocky__custom_domain: {}
+# lan: 10.100.1.1

handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart blocky
+  ansible.builtin.systemd:
+    name: blocky
+    state: restarted

meta/main.yml

@@ -0,0 +1,28 @@
+---
+galaxy_info:
+  role_name: blocky_dns
+  namespace: ngine_io
+  author: René Moser
+  company: renemoser.net / ngine.io
+  description: Brocky DNS
+  license: "license (Apache2, MIT)"
+  min_ansible_version: "2.9"
+  platforms:
+    - name: EL
+      versions:
+        - "8"
+        - "9"
+    - name: Debian
+      versions:
+        - bookworm
+    - name: Ubuntu
+      versions:
+        - focal
+        - jammy
+  galaxy_tags:
+    - dns
+    - dnsproxy
+    - adblock
+    - blocklist
+    - dnsblocklist
+    - blocky

molecule/default/converge.yml

@@ -0,0 +1,13 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+  pre_tasks:
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 600
+      when: ansible_os_family == "Debian"
+      changed_when: false
+  roles:
+    - role: ngine_io.blocky_dns

molecule/default/molecule.yml

@@ -0,0 +1,18 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-debian12}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-converge.yml}