---
- name: Installer PowerDNS Authoritative
  ansible.builtin.apt:
    name: "{{ serveur_powerdns_packages }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Créer le répertoire des zones PowerDNS
  ansible.builtin.file:
    path: "{{ serveur_powerdns_zone_directory }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Déployer la configuration du backend BIND
  ansible.builtin.template:
    src: setops-bind.conf.j2
    dest: /etc/powerdns/pdns.d/setops-bind.conf
    owner: root
    group: root
    mode: "0644"
  notify: Validate and reload PowerDNS

- name: Déployer l'index des zones PowerDNS
  ansible.builtin.template:
    src: bindbackend.conf.j2
    dest: "{{ serveur_powerdns_bind_config }}"
    owner: root
    group: root
    mode: "0644"
  notify: Validate and reload PowerDNS

- name: Charger les registres applications et domaines (expositions)
  ansible.builtin.include_vars:
    file: "{{ item }}"
  loop:
    - "{{ setops_plan_dir }}/applications.yml"
    - "{{ setops_plan_dir }}/domaines.yml"
  when: serveur_powerdns_publier_expositions | bool

- name: Dériver les A d'exposition (FQDN publics -> edge qui les sert)
  ansible.builtin.set_fact:
    serveur_powerdns_expositions: >-
      {{ {'applications': applications | default({})}
         | expositions_des_applications({'domaines_publics': domaines_publics | default({})}) }}
  when: serveur_powerdns_publier_expositions | bool

- name: Générer la zone DNS interne depuis l'inventaire
  ansible.builtin.template:
    src: zone.db.j2
    dest: "{{ serveur_powerdns_zone_directory }}/{{ serveur_powerdns_zone }}.zone"
    owner: root
    group: root
    mode: "0644"
  notify: Validate and reload PowerDNS

- name: Activer et démarrer PowerDNS
  ansible.builtin.systemd:
    name: "{{ serveur_powerdns_service_name }}"
    enabled: true
    state: started
  # Dry-run (--check) : le paquet n'est pas reellement installe, donc le service
  # n'existe pas encore et systemd echouerait. On saute en mode check seulement ;
  # en vrai deploiement, la tache s'execute normalement.
  when: not ansible_check_mode