---
- name: Playbook to install SuperDNS PDNS on alma8
  hosts: all
  gather_facts: false
  tasks:
    - name: Add firewall rules
      ansible.builtin.shell: |
        set -o pipefail
        iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
        iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
        iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
        iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
        iptables -A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 8081 -j ACCEPT
      args:
        executable: /bin/bash
      changed_when: false

    - name: Install prerequisite packages
      ansible.builtin.dnf:
        name:
          - epel-release
          - vim
          - wget
          - net-tools
          - bind-utils
        state: latest

    - name: Install MariaDB
      ansible.builtin.shell: |
        set -o pipefail
        dnf -y module reset mariadb
        dnf -y module install mariadb:10.11
        systemctl restart mariadb; systemctl enable mariadb
      args:
        executable: /bin/bash
      changed_when: false

    - name: Secure MariaDB installation
      ansible.builtin.shell: |
        set -o pipefail
        my_root_pass=$(pwgen -s 20 | head -1)
        cat > /root/mysql_secure_install.sql << EOF
        ALTER USER 'root'@'localhost' IDENTIFIED BY '$my_root_pass';
        DELETE FROM mysql.user WHERE User='';
        DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
        DROP DATABASE IF EXISTS test;
        DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
        FLUSH PRIVILEGES;
        EOF
        mysql -sfu root < /root/mysql_secure_install.sql; rm -f /root/mysql_secure_install.sql
        echo -e "[mysql]\nuser=\"root\"\npassword=\"$my_root_pass\"\n" > /root/.my.cnf
      args:
        executable: /bin/bash
      changed_when: false

    - name: Install pdns packages
      ansible.builtin.dnf:
        name:
          - pdns
          - pdns-backend-mysql
          - pdns-tools
        state: latest
    - name: Create powertdns database
      ansible.builtin.shell: |
        set -o pipefail
        pwgen -s 20 | head -1 > /root/pdns_pass.txt
        mysql -e "CREATE DATABASE powerdns"
        mysql -e "CREATE USER 'powerdns'@'localhost' IDENTIFIED BY '$(cat /root/pdns_pass.txt)'"
        mysql -e "GRANT ALL PRIVILEGES ON powerdns.* TO 'powerdns'@'localhost'"
        mysql -e "flush privileges"
        mysql powerdns < /usr/share/doc/pdns-backend-mysql/schema.mysql.sql
        echo -e "database=\"powerdns\"" >> /root/.my.cnf
      args:
        executable: /bin/bash
      changed_when: false

    - name: Ensure bind-address is set in MariaDB configuration
      ansible.builtin.lineinfile:
        path: /etc/my.cnf.d/mariadb-server.cnf
        regexp: '^bind-address'
        line: 'bind-address = 127.0.0.1'
        insertafter: '[mysqld]'
        state: present
        backup: true

    - name: Restart MariaDB service
      ansible.builtin.systemd:
        name: mariadb
        state: restarted

    - name: Backup the default PowerDNS config
      ansible.builtin.command: mv /etc/pdns/pdns.conf /etc/pdns/pdns.conf_orig
      args:
        creates: /etc/pdns/pdns.conf_orig

    - name: Grab generated pdns pass
      ansible.builtin.set_fact:
        pdnspass: "{{ lookup('file', '/root/pdns_pass.txt') }}"

    - name: Configure PowerDNS with the DB credentials
      when: pdnspass is defined
      ansible.builtin.copy:
        dest: /etc/pdns/pdns.conf
        content: |
          launch=gmysql
          gmysql-host=localhost
          gmysql-user=powerdns
          gmysql-dbname=powerdns
          gmysql-password={{ pdnspass }}
          allow-axfr-ips={{ master_ip }}/32
          allow-dnsupdate-from={{ master_ip }}/32
          allow-notify-from={{ master_ip }}/32
          daemon=yes
          disable-axfr=no
          dnsupdate=yes
          guardian=no
          local-port=53
          log-dns-queries=yes
          log-timestamp=yes
          loglevel=9
          setgid=pdns
          setuid=pdns
          secondary=yes
          autosecondary=yes
        mode: '0644'

    - name: Restart and enable PowerDNS service
      ansible.builtin.systemd:
        name: pdns
        state: restarted
        enabled: true

    - name: Check the status of PowerDNS service
      ansible.builtin.systemd:
        name: pdns
        state: started