---
- name: Déterminer les serveurs DNS internes depuis l'inventaire
  ansible.builtin.set_fact:
    clients_dns_effective_nameservers: >-
      {{
        clients_dns_nameservers
        if (clients_dns_nameservers | length > 0)
        else (
          groups.get('serveurs_powerdns', [])
          | map('extract', hostvars, 'ansible_host')
          | select('defined')
          | list
        )
      }}

- name: Vérifier qu'au moins un serveur DNS interne est connu
  ansible.builtin.assert:
    that:
      - clients_dns_effective_nameservers | length > 0
    fail_msg: "Aucun serveur DNS interne disponible pour clients_dns."

- name: Installer les outils de diagnostic DNS
  ansible.builtin.apt:
    name: dnsutils
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Valider la zone DNS interne sur le serveur primaire
  ansible.builtin.command:
    cmd: "dig @{{ clients_dns_effective_nameservers[0] }} {{ clients_dns_zone }} SOA +short"
  register: clients_dns_soa_check
  changed_when: false
  failed_when: clients_dns_soa_check.stdout | trim == ""

- name: Refuser la modification DNS sans confirmation explicite
  ansible.builtin.assert:
    that:
      - clients_dns_confirm | bool
    fail_msg: "Modification DNS refusee: definir clients_dns_confirm=true pour modifier le resolver."
  when: clients_dns_apply | bool

- name: Configurer le resolver client
  ansible.builtin.template:
    src: resolv.conf.j2
    dest: "{{ clients_dns_resolv_conf_path }}"
    owner: root
    group: root
    mode: "0644"
    backup: true
  when:
    - clients_dns_apply | bool
    - clients_dns_confirm | bool

- name: Valider la résolution du nom local dans la zone interne
  ansible.builtin.command:
    cmd: "dig @{{ clients_dns_effective_nameservers[0] }} {{ inventory_hostname }}.{{ clients_dns_zone }} A +short"
  register: clients_dns_host_check
  changed_when: false
  failed_when: clients_dns_host_check.stdout | trim == ""
  when: ansible_host is defined