CoreDNS Authoritative On Loopback:53, Proven By dig

coredns

CoreDNS from the upstream release (sha256-verified), as a hardened system service answering authoritatively for your zones on 127.0.0.1:53, with forwarding for everything else only when you name upstreams. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no coredns; CoreDNS ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by coredns_version.

A service account, a hardened unit, a loopback listener. coredns is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:53 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Port 53 without root. The service runs as the coredns user; the unit grants it CAP_NET_BIND_SERVICE through AmbientCapabilities (and nothing else through CapabilityBoundingSet), which is what lets a system user bind a privileged port under NoNewPrivileges. The health plugin on 127.0.0.1:8053 is the readiness endpoint.

Authoritative, and nothing else by default. Each zone in coredns_zones is a server block reading its zone file; with coredns_forwarders empty there is no catch-all block, so a name outside the zones is REFUSED. The live test proves all three answers with dig: the example zone's A record with the aa flag, NXDOMAIN for a name the zone does not hold, REFUSED for a name outside every zone. Name upstreams and the catch-all block forwards with a cache. CoreDNS has no config checker; a bad Corefile fails at start, which the live test's readiness wait catches.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.