# Alliance Boréale - Playbook Phase 1
# Déploiement DNS Fédéré (Couches C1-C2)
# Membre: Chezlepro Inc.
# Date: 2025-10-31

---
- name: "🌲 Phase 1 - Préparation des VMs (Common)"
  hosts: all
  become: true
  gather_facts: true
  
  pre_tasks:
    - name: "🔍 Vérifier connectivité SSH"
      ansible.builtin.ping:
      tags: always
    
    - name: "📋 Afficher informations hôte"
      ansible.builtin.debug:
        msg: |
          Hôte: {{ inventory_hostname }}
          IP: {{ ansible_host }}
          VMID: {{ vmid | default('N/A') }}
          Rôle DNS: {{ dns_role | default('N/A') }}
      tags: always
  
  roles:
    - role: common
      tags: common
  
  post_tasks:
    - name: "✅ Common role terminé"
      ansible.builtin.debug:
        msg: "✅ Hardening complété sur {{ inventory_hostname }}"
      tags: always

# ============================================
- name: "🗄️ Phase 1 - PostgreSQL pour DNS"
  hosts: dns_servers
  become: true
  gather_facts: true
  
  roles:
    - role: postgresql
      tags: postgresql
  
  post_tasks:
    - name: "✅ PostgreSQL terminé"
      ansible.builtin.debug:
        msg: "✅ PostgreSQL {{ postgresql.version }} configuré sur {{ inventory_hostname }}"
      tags: always

# ============================================
- name: "🌐 Phase 1 - PowerDNS Master"
  hosts: dns_masters
  become: true
  gather_facts: true
  serial: 1  # Un à la fois pour éviter race conditions
  
  roles:
    - role: powerdns-authoritative
      tags: powerdns
  
  post_tasks:
    - name: "✅ PowerDNS Master terminé"
      ansible.builtin.debug:
        msg: "✅ PowerDNS MASTER configuré sur {{ inventory_hostname }}"
      tags: always

# ============================================
- name: "🌐 Phase 1 - PowerDNS Slave"
  hosts: dns_slaves
  become: true
  gather_facts: true
  
  roles:
    - role: powerdns-authoritative
      tags: powerdns
  
  post_tasks:
    - name: "✅ PowerDNS Slave terminé"
      ansible.builtin.debug:
        msg: "✅ PowerDNS SLAVE configuré sur {{ inventory_hostname }}"
      tags: always

# ============================================
- name: "🧪 Phase 1 - Tests de validation"
  hosts: dns_masters
  become: false
  gather_facts: false
  
  tasks:
    - name: "🧪 Test résolution DNS (zone primaire)"
      ansible.builtin.command:
        cmd: "dig @{{ ansible_host }} {{ member.domain_primary }} SOA +short"
      delegate_to: localhost
      register: dns_test
      changed_when: false
    
    - name: "✅ Résultat test DNS"
      ansible.builtin.debug:
        msg: "✅ DNS fonctionne: {{ dns_test.stdout }}"
    
    - name: "🧪 Test AXFR (zone transfer)"
      ansible.builtin.command:
        cmd: "dig @{{ ansible_host }} {{ member.domain_primary }} AXFR +short"
      delegate_to: localhost
      register: axfr_test
      changed_when: false
      failed_when: false
    
    - name: "✅ Résultat AXFR"
      ansible.builtin.debug:
        msg: |
          {% if axfr_test.rc == 0 %}
          ✅ AXFR fonctionne ({{ axfr_test.stdout_lines | length }} lignes)
          {% else %}
          ⚠️ AXFR refusé (normal si ACL strictes configurées)
          {% endif %}

# ============================================
- name: "📋 Phase 1 - Récapitulatif"
  hosts: localhost
  gather_facts: false
  
  tasks:
    - name: "🎉 Phase 1 terminée avec succès!"
      ansible.builtin.debug:
        msg: |
          
          ═══════════════════════════════════════════════
          🌲 PHASE 1 - DNS FÉDÉRÉ DÉPLOYÉ
          ═══════════════════════════════════════════════
          
          ✅ Serveurs DNS configurés:
          {% for host in groups['dns_servers'] %}
            - {{ host }} ({{ hostvars[host]['dns_role'] | upper }})
          {% endfor %}
          
          🌐 Zone primaire: {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }}
          
          📋 Prochaines étapes:
          
          1. Tester résolution DNS:
             dig @{{ hostvars[groups['dns_masters'][0]]['ansible_host'] }} {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }} SOA
          
          2. Exporter DS records pour DNSSEC:
             ssh {{ hostvars[groups['dns_masters'][0]]['ansible_user'] }}@{{ hostvars[groups['dns_masters'][0]]['ansible_host'] }}
             sudo pdnsutil show-zone {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }} | grep DS
          
          3. Ajouter DS records chez votre registraire de domaine
          
          4. Valider DNSSEC:
             dig +dnssec {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }} @8.8.8.8
             
          5. Mettre à jour Registraire YAML:
             registraire/membres/m001-chezlepro.yml
          
          6. Passer à Phase 2 (Keycloak + Forgejo)
          
          ═══════════════════════════════════════════════
      tags: always