add experimental automatic dns ddos mitigation

cozybear-dev · Jun 28, 2023 · 80c732f · 80c732f
1 parent e02482f
commit 80c732f
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/roles/setup-dns/tasks/files/dns-ddos.sh b/roles/setup-dns/tasks/files/dns-ddos.sh
@@ -0,0 +1,5 @@
+#! /bin/bash
+(( usage = $(top -b -n 10 -d 1 -p $(pgrep -x unbound) | tail -1 | awk '{print $9}') ))
+if (( usage > 35 )); then
+  service unbound restart
+fi
diff --git a/roles/setup-dns/tasks/main.yml b/roles/setup-dns/tasks/main.yml
@@ -54,6 +54,26 @@
   when:
     - ipv6_enabled | bool
 
+- name: Create dns-ddos.sh DNS (unbound) DDOS mitigation 
+  become: yes
+  ansible.builtin.copy:
+    src: ../files/dns-ddos.sh
+    dest: /bin/dns-ddos.sh
+    owner: root
+    group: root
+    mode: '0555'
+  when:
+    - ipv6_enabled | bool
+
+- name: Create cronjob DNS (unbound) DDOS mitigation 
+  become: yes
+  ansible.builtin.cron:
+    name: "Restart Unbound in case of DDOS"
+    minute: "1"
+    job: "/bin/dns-ddos.sh"
+  when:
+    - ipv6_enabled | bool
+
 - name: Configure systemd-resolved
   become: yes
   ansible.builtin.copy: