update role with saner defaults

roles/bind/handlers/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Restart bind
   ansible.builtin.service:
-    name: bind
+    name: named
     enabled: true
     state: restarted

roles/bind/tasks/main.yml

@@ -5,6 +5,7 @@
     name:
       - bind9
       - prometheus-bind-exporter
+      - bind9-dnsutils
     state: present
     update_cache: true
   notify:

roles/bind/templates/named.conf.j2

@@ -9,13 +9,35 @@
 options {
         directory "/var/cache/bind";
         dnssec-validation auto;
-        listen-on-v6 { ::1; };
-        listen-on { 127.0.0.1; };
+        recursion no;
+        allow-transfer { none; };
+
+        auth-nxdomain no;    // conform to RFC1035
+        listen-on-v6 { any; };
+        listen-on { any; };
+
+        // Rate Limiting: https://kb.isc.org/docs/bind-best-practices-authoritative
+
+        rate-limit {
+        slip 2; // Every other response truncated
+        window 15; // Seconds to bucket
+        responses-per-second 5;// # of good responses per prefix-length/sec
+        referrals-per-second 5; // referral responses
+        nodata-per-second 5; // nodata responses
+        nxdomains-per-second 5; // nxdomain responses
+        errors-per-second 5; // error responses
+        all-per-second 20; // When we drop all
+        log-only yes; // Debugging mode
+        qps-scale 250; // x / 1000 * per-second
+        // = new drop limit
+        exempt-clients { 127.0.0.1; };
+        ipv4-prefix-length 24; // Define the IPv4 block size
+        ipv6-prefix-length 56; // Define the IPv6 block size
+        max-table-size 20000; // 40 bytes * this number = max memory
+        min-table-size 500; // pre-allocate to speed startup
+        };
 };
 
-//
-// Do any local configuration here
-//
 
 
 // prime the server with knowledge of the root servers