Update constraints on dns-server role in the right place

We moved the constraints to the model.