# Alliance Boréale - Rôle PowerDNS Authoritative
# Couche: C2 (Réseau & DNS)
# Objectif: Déployer PowerDNS autoritaire (MASTER ou SLAVE)
# Date: 2025-10-31

---
- name: "🔍 Determine PowerDNS role (master/slave)"
  ansible.builtin.set_fact:
    pdns_is_master: "{{ inventory_hostname in groups['dns_masters'] }}"
    pdns_is_slave: "{{ inventory_hostname in groups['dns_slaves'] }}"
  tags: always

- name: "📦 Add PowerDNS repository"
  ansible.builtin.import_tasks: repo.yml
  tags: powerdns

- name: "📦 Install PowerDNS packages"
  ansible.builtin.apt:
    name:
      - pdns-server
      - pdns-backend-pgsql
      - pdns-tools
    state: present
    update_cache: true
  tags: powerdns

- name: "⚙️ Configure PowerDNS"
  ansible.builtin.template:
    src: pdns.conf.j2
    dest: /etc/powerdns/pdns.conf
    owner: root
    group: pdns
    mode: '0640'
  notify: restart powerdns
  tags: powerdns

- name: "⚙️ Configure PowerDNS PostgreSQL backend"
  ansible.builtin.template:
    src: pdns.d/pdns.local.gpgsql.conf.j2
    dest: /etc/powerdns/pdns.d/pdns.local.gpgsql.conf
    owner: root
    group: pdns
    mode: '0640'
  notify: restart powerdns
  tags: powerdns

- name: "🗄️ Import PowerDNS PostgreSQL schema"
  ansible.builtin.import_tasks: schema.yml
  when: pdns_is_master
  tags: powerdns

- name: "🌐 Configure DNS zones (MASTER only)"
  ansible.builtin.import_tasks: zones.yml
  when: pdns_is_master
  tags: powerdns

- name: "🔁 Configure AXFR (SLAVE only)"
  ansible.builtin.import_tasks: slave.yml
  when: pdns_is_slave
  tags: powerdns

- name: "🔐 Configure DNSSEC"
  ansible.builtin.import_tasks: dnssec.yml
  when: 
    - pdns_is_master
    - powerdns.dnssec.enabled | default(true)
  tags: powerdns

- name: "🔥 Configure firewall for DNS"
  ansible.builtin.import_tasks: firewall.yml
  tags: powerdns

- name: "✅ Start and enable PowerDNS"
  ansible.builtin.systemd:
    name: pdns
    state: started
    enabled: true
  tags: powerdns

- name: "🧪 Validate PowerDNS configuration"
  ansible.builtin.import_tasks: validate.yml
  tags: powerdns

- name: "✅ PowerDNS role completed"
  ansible.builtin.debug:
    msg: |
      ✅ PowerDNS configured on {{ inventory_hostname }}
      Role: {{ 'MASTER' if pdns_is_master else 'SLAVE' }}
      Zones: {{ dns_zones | map(attribute='name') | list if pdns_is_master else 'N/A' }}
  tags: powerdns