---
- name: Exiger l'IP de l'autoritatif interne (PowerDNS)
  ansible.builtin.assert:
    that:
      - client_unbound_dns_autoritatif | length > 0
    fail_msg: "client_unbound_dns_autoritatif requis (aucun hôte serveur_powerdns actif ?)."

- name: Installer Unbound
  ansible.builtin.apt:
    name: "{{ client_unbound_paquets }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Déployer la configuration Unbound (stub-zone interne + récursion)
  ansible.builtin.template:
    src: setops.conf.j2
    dest: /etc/unbound/unbound.conf.d/setops.conf
    owner: root
    group: root
    mode: "0644"
  notify: Redémarrer unbound

- name: Valider la configuration Unbound
  ansible.builtin.command: unbound-checkconf
  changed_when: false
  when: not ansible_check_mode

- name: Activer et démarrer Unbound
  ansible.builtin.systemd:
    name: "{{ client_unbound_service }}"
    enabled: true
    state: started
  when: not ansible_check_mode

- name: Appliquer les redémarrages Unbound avant toute validation/bascule
  ansible.builtin.meta: flush_handlers

# --- Bascule du resolver : PROTÉGÉE + validée (ne casse jamais un nœud) ---
- name: Refuser la bascule du resolver sans confirmation explicite
  ansible.builtin.assert:
    that:
      - client_unbound_confirm | bool
    fail_msg: "Bascule refusée : définir client_unbound_confirm=true (avec client_unbound_apply=true)."
  when: client_unbound_apply | bool

- name: Valider qu'Unbound résout AVANT de basculer (interne + Internet)
  ansible.builtin.command: "dig @127.0.0.1 {{ item.nom }} {{ item.type }} +short"
  register: client_unbound_validation
  changed_when: false
  failed_when: client_unbound_validation.stdout | trim == ''
  loop:
    - { nom: "{{ client_unbound_zone_interne }}", type: "SOA" }
    - { nom: "deb.debian.org", type: "A" }
  loop_control:
    label: "{{ item.nom }} {{ item.type }}"
  when:
    - client_unbound_apply | bool
    - client_unbound_confirm | bool
    - not ansible_check_mode

- name: Basculer /etc/resolv.conf vers Unbound local (127.0.0.1)
  ansible.builtin.copy:
    dest: "{{ client_unbound_resolv_conf }}"
    content: |
      # Généré par Set-OPS (rôle client_unbound). Résolveur local Unbound.
      search {{ client_unbound_zone_interne }}
      nameserver 127.0.0.1
    owner: root
    group: root
    mode: "0644"
  when:
    - client_unbound_apply | bool
    - client_unbound_confirm | bool
    - not ansible_check_mode