# Alliance Boréale - PowerDNS Schema Import
# Date: 2025-10-31

---
# Ce fichier contient: schema.yml, zones.yml, slave.yml, dnssec.yml

# ==========================================
# SCHEMA.YML - Import PostgreSQL schema
# ==========================================
- name: "🗄️ Check if PowerDNS schema exists"
  community.postgresql.postgresql_query:
    db: powerdns
    query: "SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'domains');"
  become: true
  become_user: postgres
  register: pdns_schema_check
  changed_when: false

- name: "🗄️ Download PowerDNS schema"
  ansible.builtin.get_url:
    url: https://raw.githubusercontent.com/PowerDNS/pdns/rel/auth-4.8.x/modules/gpgsqlbackend/schema.pgsql.sql
    dest: /tmp/pdns-schema.sql
    mode: '0644'
  when: not pdns_schema_check.query_result[0].exists

- name: "🗄️ Import PowerDNS schema"
  community.postgresql.postgresql_db:
    db: powerdns
    state: restore
    target: /tmp/pdns-schema.sql
  become: true
  become_user: postgres
  when: not pdns_schema_check.query_result[0].exists

# ==========================================
# ZONES.YML - Create DNS zones (MASTER)
# ==========================================
- name: "🌐 Create DNS zones"
  ansible.builtin.command:
    cmd: "pdnsutil create-zone {{ item.name }}"
  loop: "{{ dns_zones }}"
  register: zone_create
  changed_when: "'created' in zone_create.stdout"
  failed_when: 
    - zone_create.rc != 0
    - "'already exists' not in zone_create.stderr"

- name: "🌐 Set zone kind to NATIVE"
  ansible.builtin.command:
    cmd: "pdnsutil set-kind {{ item.name }} NATIVE"
  loop: "{{ dns_zones }}"
  changed_when: false

- name: "🌐 Configure SOA records"
  ansible.builtin.command:
    cmd: >
      pdnsutil replace-rrset {{ item.name }} @ SOA 
      "{{ item.soa.nameserver }} {{ item.soa.email }} 
      {{ item.soa.serial }} {{ item.soa.refresh }} {{ item.soa.retry }} 
      {{ item.soa.expire }} {{ item.soa.minimum }}"
  loop: "{{ dns_zones }}"
  changed_when: false

- name: "🌐 Add NS records"
  ansible.builtin.command:
    cmd: "pdnsutil add-record {{ item.0.name }} @ NS {{ item.1 }}"
  loop: "{{ dns_zones | subelements('ns_records') }}"
  register: ns_add
  changed_when: false
  failed_when:
    - ns_add.rc != 0
    - "'already exists' not in ns_add.stderr"

- name: "🌐 Add A/AAAA records"
  ansible.builtin.command:
    cmd: "pdnsutil add-record {{ item.0.name }} {{ item.1.name }} {{ item.1.type }} {{ item.1.content }} {{ item.1.ttl | default(3600) }}"
  loop: "{{ dns_zones | subelements('records', skip_missing=True) }}"
  register: record_add
  changed_when: false
  failed_when:
    - record_add.rc != 0
    - "'already exists' not in record_add.stderr"

- name: "🌐 Rectify zones"
  ansible.builtin.command:
    cmd: "pdnsutil rectify-zone {{ item.name }}"
  loop: "{{ dns_zones }}"
  changed_when: false

# ==========================================
# SLAVE.YML - Configure AXFR for slaves
# ==========================================
- name: "🔁 Configure supermaster for AXFR"
  community.postgresql.postgresql_query:
    db: powerdns
    query: >
      INSERT INTO supermasters (ip, nameserver, account)
      VALUES ('{{ hostvars[groups['dns_masters'][0]]['ansible_host'] }}', 
              '{{ inventory_hostname }}', 
              'default')
      ON CONFLICT DO NOTHING;
  become: true
  become_user: postgres

- name: "🔁 Enable slave mode in PowerDNS"
  ansible.builtin.lineinfile:
    path: /etc/powerdns/pdns.conf
    regexp: '^slave='
    line: 'slave=yes'
  notify: restart powerdns

# ==========================================
# DNSSEC.YML - Configure DNSSEC
# ==========================================
- name: "🔐 Enable DNSSEC for zones"
  ansible.builtin.command:
    cmd: "pdnsutil secure-zone {{ item.name }}"
  loop: "{{ dns_zones }}"
  register: dnssec_secure
  changed_when: "'secured' in dnssec_secure.stdout"
  failed_when:
    - dnssec_secure.rc != 0
    - "'already' not in dnssec_secure.stderr"

- name: "🔐 Configure NSEC3"
  ansible.builtin.command:
    cmd: "pdnsutil set-nsec3 {{ item.name }} '1 0 10 ab' narrow"
  loop: "{{ dns_zones }}"
  changed_when: false

- name: "🔐 Rectify zones after DNSSEC"
  ansible.builtin.command:
    cmd: "pdnsutil rectify-zone {{ item.name }}"
  loop: "{{ dns_zones }}"
  changed_when: false

- name: "🔐 Export DS records"
  ansible.builtin.command:
    cmd: "pdnsutil show-zone {{ item.name }}"
  loop: "{{ dns_zones }}"
  register: ds_records
  changed_when: false

- name: "🔐 Display DS records for parent zone"
  ansible.builtin.debug:
    msg: |
      ⚠️ IMPORTANT: Add these DS records to your domain registrar:
      {{ ds_records.results | map(attribute='stdout') | join('\n') }}
  when: ds_records.results | length > 0