# Alliance Boréale - PowerDNS Firewall & Validation
# Date: 2025-10-31

---
# ==========================================
# FIREWALL.YML
# ==========================================
- name: "🔥 Ensure nftables rules include DNS"
  ansible.builtin.blockinfile:
    path: /etc/nftables.conf
    marker: "# {mark} ANSIBLE MANAGED - PowerDNS"
    insertbefore: "# Log dropped packets"
    block: |
      # PowerDNS - DNS queries
      udp dport 53 accept comment "DNS queries (UDP)"
      tcp dport 53 accept comment "DNS queries (TCP)"
      
      # PowerDNS - API (internal only)
      ip saddr {{ network.internal_subnet | default('10.0.0.0/8') }} tcp dport 8081 accept comment "PowerDNS API"
  notify: reload nftables

# ==========================================
# VALIDATE.YML
# ==========================================
- name: "🧪 Wait for PowerDNS to be ready"
  ansible.builtin.wait_for:
    port: 53
    host: "{{ ansible_host }}"
    timeout: 30

- name: "🧪 Test DNS resolution (localhost)"
  ansible.builtin.command:
    cmd: "dig @127.0.0.1 {{ dns_zones[0].name }} SOA +short"
  register: dns_test_local
  changed_when: false
  failed_when: dns_test_local.rc != 0

- name: "🧪 Display DNS test result"
  ansible.builtin.debug:
    msg: "✅ DNS resolution working: {{ dns_test_local.stdout }}"

- name: "🧪 Check PowerDNS API (if enabled)"
  ansible.builtin.uri:
    url: "http://127.0.0.1:8081/api/v1/servers/localhost"
    headers:
      X-API-Key: "{{ powerdns.api.key }}"
    return_content: true
  register: api_test
  when: powerdns.api.enabled | default(true)
  failed_when: false

- name: "🧪 Display PowerDNS version"
  ansible.builtin.debug:
    msg: "✅ PowerDNS API responding: {{ api_test.json.version | default('N/A') }}"
  when: 
    - powerdns.api.enabled | default(true)
    - api_test.status == 200