ansible-role-bind9/tasks/main.yaml

---

- name: Include OS-specific variables
  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
  vars:
    params:
      files:
      - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
      - "{{ ansible_facts['distribution'] }}.yaml"
      - "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
      - "{{ ansible_facts['os_family'] }}.yaml"
      - main.yaml
      paths:
      - vars

- name: Install bind and dependencies
  ansible.builtin.package:
    name: "{{ item }}"
    state: present
  with_items: "{{ bind9_package_names }}"

- name: Create logging directory
  ansible.builtin.file:
    path: "{{ bind9_log_directory }}"
    owner: "{{ bind9_unix_user }}"
    group: "{{ bind9_unix_group }}"
    mode: "0755"
    state: directory
    recurse: true

- name: Create config directory
  ansible.builtin.file:
    path: "{{ bind9_config_directory }}"
    owner: "{{ bind9_unix_user }}"
    group: "{{ bind9_unix_group }}"
    mode: "0755"
    state: directory
    recurse: true

- name: Remove existing journal files
  block:
  - name: Find existing journal files
    ansible.builtin.find:
      path: "{{ bind9_config_directory }}"
      recurse: true
      patterns: "*.jnl"
    register: files_to_delete
  - name: Delete existing journal files
    ansible.builtin.file:
      path: "{{ item.path }}"
      state: absent
    with_items: "{{ files_to_delete.files }}"

- name: Remove existing signed zone files
  block:
  - name: Find existing signed zone files
    ansible.builtin.find:
      path: "{{ bind9_config_directory }}"
      recurse: true
      patterns: "*.signed"
    register: files_to_delete
  - name: Delete existing signed zone files
    ansible.builtin.file:
      path: "{{ item.path }}"
      state: absent
    with_items: "{{ files_to_delete.files }}"

- name: Remove existing DNSSEC key directory
  block:
  - name: Check if DNSSEC key directory exists
    ansible.builtin.stat:
      path: "{{ bind9_options.key_directory }}"
    register: _stat_bind9_options_key_directory
  - name: Remove DNSSEC key directory
    ansible.builtin.file:
      path: "{{ bind9_options.key_directory }}"
      state: "absent"
    when: _stat_bind9_options_key_directory.stat.exists

- name: Create DNSSEC key directory
  ansible.builtin.file:
    path: "{{ bind9_options.key_directory }}"
    owner: "{{ bind9_unix_user }}"
    group: "{{ bind9_unix_group }}"
    mode: "0700"
    state: directory

- name: Create DNSSEC files
  ansible.builtin.include_tasks: create_dnssec_files.yaml
  with_items: "{{ bind9_dnssec_keys }}"
  no_log: true
  loop_control:
    loop_var: bind9_dnssec_key

- name: Create DNS-Zone files
  ansible.builtin.include_tasks: template_zone_files.yaml
  with_items:
  - "{{ bind9_views }}"
  loop_control:
    loop_var: view

- name: Create main configuration file
  ansible.builtin.template:
    src: "etc/named.conf.j2"
    dest: "{{ bind9_main_config }}"
    owner: "{{ bind9_unix_user }}"
    group: "{{ bind9_unix_group }}"
    mode: "0644"
  notify: Restart named

- name: Create excluded configuration files
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "{{ item | replace('etc/named', bind9_config_directory) }}"
    owner: "{{ bind9_unix_user }}"
    group: "{{ bind9_unix_group }}"
    mode: "0644"
  with_items:
  - etc/named.conf
  - etc/named/named.conf.acl
  - etc/named/named.conf.logging
  - etc/named/named.conf.options
  - etc/named/named.conf.tsigkeys
  - etc/named/named.conf.views
  notify: Restart named

- name: Create systemd drop-in
  when: bind9_systemd_dropin | default('', true) | length > 0
  block:
  - name: Create systemd drop-in directory
    ansible.builtin.file:
      path: "{{ bind9_systemd_dropin_dir }}"
      owner: "root"
      group: "root"
      mode: "0755"
      state: "directory"
  - name: Template systemd drop-in
    ansible.builtin.template:
      src: etc/systemd/system/named.service.d/override.conf.j2
      dest: "{{ bind9_systemd_dropin_dir }}/override.conf"
      owner: "root"
      group: "root"
      mode: "0644"
    register: _bind9_systemd_drop_in
  - name: Systemd reload  # noqa: no-handler
    ansible.builtin.systemd:
      daemon_reload: true
    when: _bind9_systemd_drop_in.changed

- name: Remove systemd drop-in
  when: bind9_systemd_dropin | default('', true) | length == 0
  block:
  - name: Remove systemd drop-in file
    ansible.builtin.file:
      path: "{{ bind9_systemd_dropin_dir }}/override.conf"
      state: "absent"
    register: _bind9_systemd_drop_in
  - name: Systemd reload  # noqa: no-handler
    ansible.builtin.systemd:
      daemon_reload: true
    when: _bind9_systemd_drop_in.changed

- name: Start and enabled named
  ansible.builtin.systemd:
    name: "{{ bind9_service_name }}"
    state: started
    enabled: true

- name: Create rndc.key
  ansible.builtin.template:
    src: etc/rndc.key.j2
    dest: /etc/rndc.key
    owner: "{{ bind9_unix_user }}"
    group: "{{ bind9_unix_group }}"
    mode: "0600"
  when: bind9_rndc_key.name | length > 0 and
        bind9_rndc_key.algorithm | length > 0 and
        bind9_rndc_key.secret | length > 0