DNSmasq with puppet

05 March 2015 updated 05 March 2015

Puppet is a server and client management system where agents retrieve configuration from a catalog server. This covers using Lex’s dnsmasq module from Puppet Forge to manage DHCP and DNS for a home network.

Before running the dnsmasq class, bootstrap each new Puppet node with:

nano /etc/default/puppet
# Set: START=yes

nano /etc/puppet/puppet.conf
# Set: pluginsync=true

Then register the node:

puppet agent -t --server puppet.local --waitforcert 60

Introductions

Lex’s dnsmasq module has excellent documentation on Puppet Forge. The configurations below come from a working home network setup.

Configurations

Define the main dnsmasq class with your network domain and resolver settings:

class { 'dnsmasq':
  domain        => 'kirk',
  domain_needed => 'true',
  port          => '53',
  expand_hosts  => true,
  bogus_priv    => true,
  cache_size    => 1000,
  restart       => true,
  resolv_file   => '/etc/resolv.conf',
}

The domain_needed flag blocks forwarding of A and AAAA queries with plain names (no dot) to upstream resolvers. bogus_priv returns “no such domain” for reverse lookups on private IPs that have no entry in /etc/hosts. resolv_file points dnsmasq at your upstream name servers.

DHCP IP range and lease time

dnsmasq::dhcp { 'dhcp':
  paramset   => 'kirk',
  dhcp_start => '192.168.20.100',
  dhcp_end   => '192.168.20.200',
  netmask    => '255.255.255.0',
  lease_time => '24h',
}

paramset tags this DHCP range with the kirk label for use in dhcp-option and dhcp-host directives.

Default gateway setup

dnsmasq::dhcpoption { 'option:router':
  content => '192.168.20.1',
}

Static DHCP setup

dnsmasq::dhcpstatic { 'apt-proxy':
  mac => 'AE:85:DE:71:61:2C',
  ip  => '192.168.20.3',
}

dnsmasq::dhcpstatic { 'puppet':
  mac => '06:6b:38:70:85:1d',
  ip  => '192.168.20.4',
}

Resolv.conf file

Create /etc/resolv.conf if absent and point it at the local dnsmasq instance and Google as a fallback. The notify triggers a dnsmasq service restart when the file changes:

file { 'resolv.conf':
  path    => '/etc/resolv.conf',
  ensure  => present,
  mode    => 0644,
  content => "nameserver 192.168.20.2\nnameserver 8.8.8.8",
  notify  => Service["dnsmasq"],
}

Proxy setting

Configure apt on all nodes to route package downloads through the apt-cacher-ng proxy at the static IP assigned above:

file { '02proxy':
  path    => '/etc/apt/apt.conf.d/02proxy',
  ensure  => present,
  mode    => 0644,
  content => 'Acquire::http { Proxy "http://192.168.20.3:3142"; };',
}

DNSMASQ Conf file

The resulting dnsmasq.conf generated by Puppet and the lex/dnsmasq module:

# MAIN CONFIG START
domain-needed
bogus-priv
strict-order
port=53
expand-hosts
domain=kirk
resolv-file=/etc/resolv.conf
cache-size=1000
conf-dir=/etc/dnsmasq.d
#MAIN CONFIG END
# EXTENDED CONFIG
# EXTENDED CONFIG END
dhcp-range=set:kirk,192.168.20.100,192.168.20.200,255.255.255.0,24h
dhcp-option=option:router,192.168.20.1
dhcp-host=AE:85:DE:71:61:2C,192.168.20.3,apt-proxy
dhcp-host=06:6b:38:70:85:1d,192.168.20.4,puppet