Use systemd-resolved stub resolver for nginx resolver

This ensures that nginx queries follow the same path as everything
else and are subject to DNSSEC validation as well as allowing us to
simplify the tests that use nginx.

diff --git a/.kitchen.yml b/.kitchen.yml
index e9350cc01b0f22c686a0abcbf2947a663af8b7b2..f46a4d1f8b3e7947187adaac124c50c25ab91c38 100644 (file)
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -123,10 +123,6 @@ suites:
   - name: nginx
     run_list:
       - recipe[nginx::default]
   - name: nginx
     run_list:
       - recipe[nginx::default]

-    attributes:
-      networking:
-        nameservers:
-          - 127.0.0.1

   - name: nodejs
     run_list:
       - recipe[nodejs::default]
   - name: nodejs
     run_list:
       - recipe[nodejs::default]


@@ -175,10 +171,6 @@ suites:
   - name: tilecache
     run_list:
       - recipe[tilecache::default]
   - name: tilecache
     run_list:
       - recipe[tilecache::default]

-    attributes:
-      networking:
-        nameservers:
-          - 127.0.0.1

   - name: tools
     run_list:
       - recipe[tools::default]
   - name: tools
     run_list:
       - recipe[tools::default]

diff --git a/cookbooks/nginx/recipes/default.rb b/cookbooks/nginx/recipes/default.rb
index 94754546c257168b12a16a807d560a3066e21058..a55dc14bef92ed851f264b3689083ff668ec644e 100644 (file)
--- a/cookbooks/nginx/recipes/default.rb
+++ b/cookbooks/nginx/recipes/default.rb
@@ -22,16 +22,11 @@ include_recipe "munin"
 
 package "nginx"
 
 
 package "nginx"
 

-resolvers = node[:networking][:nameservers].map do |resolver|
-  IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver
-end
-

 template "/etc/nginx/nginx.conf" do
   source "nginx.conf.erb"
   owner "root"
   group "root"
   mode 0o644
 template "/etc/nginx/nginx.conf" do
   source "nginx.conf.erb"
   owner "root"
   group "root"
   mode 0o644

-  variables :resolvers => resolvers

 end
 
 directory node[:nginx][:cache][:fastcgi][:directory] do
 end
 
 directory node[:nginx][:cache][:fastcgi][:directory] do

diff --git a/cookbooks/nginx/templates/default/nginx.conf.erb b/cookbooks/nginx/templates/default/nginx.conf.erb
index a3f6b241181d74bff40632564f228d204665ed65..5e09d846b049f2a93f0eed902c6ca49dc5fb682e 100644 (file)
--- a/cookbooks/nginx/templates/default/nginx.conf.erb
+++ b/cookbooks/nginx/templates/default/nginx.conf.erb
@@ -47,7 +47,7 @@ http {
     ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
 
     ssl_dhparam /etc/ssl/certs/dhparam.pem;
     ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
 
     ssl_dhparam /etc/ssl/certs/dhparam.pem;

-    resolver <%= @resolvers.join(" ") %>;
+    resolver 127.0.0.53;

     resolver_timeout 5s;
 
     <% if node['nginx']['cache']['fastcgi']['enable'] -%>
     resolver_timeout 5s;
 
     <% if node['nginx']['cache']['fastcgi']['enable'] -%>