---
# ==========================================================
# Install and configure Technitium DNS Server
# ==========================================================

- name: Ensure Technitium install directory exists
  ansible.builtin.file:
    path: "{{ technitium_install_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Ensure Technitium data directory exists
  ansible.builtin.file:
    path: "{{ technitium_data_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Ensure Technitium TLS directory exists
  ansible.builtin.file:
    path: "{{ technitium_certs_dir }}"
    state: directory
    owner: vault
    group: vault
    mode: "0700"

# ==========================================================
# Install Technitium if not already installed
# ==========================================================
- name: Install Technitium DNS Server
  ansible.builtin.command: bash install.sh
  args:
    chdir: /tmp
    creates: "{{ technitium_install_dir }}/start.sh"
  environment:
    INSTALL_URL: "https://download.technitium.com/dns/install.sh"
  register: technitium_install_result
  ignore_errors: true
  changed_when: technitium_install_result.rc == 0

# ==========================================================
# SELinux setup (idempotent)
# ==========================================================
- name: Apply SELinux context for Technitium certs
  ansible.builtin.command: semanage fcontext -a -t etc_t '{{ technitium_certs_dir }}(/.*)?'
  register: selinux_ctx
  changed_when: selinux_ctx.rc == 0
  ignore_errors: true

- name: Restore SELinux context for Technitium certs
  ansible.builtin.command: restorecon -Rv "{{ technitium_certs_dir }}"
  changed_when: false

# ==========================================================
# Firewalld setup
# ==========================================================
- name: Ensure firewalld is running
  ansible.builtin.systemd:
    name: firewalld
    enabled: true
    state: started

- name: Open Technitium DNS and admin ports
  ansible.posix.firewalld:
    port: "{{ item.port }}/{{ item.proto }}"
    permanent: true
    state: enabled
    immediate: true
  loop:
    - { port: 53, proto: "udp" }
    - { port: 53, proto: "tcp" }
    - { port: 853, proto: "tcp" }
    - { port: 443, proto: "tcp" }
    - { port: 5380, proto: "tcp" }

# ==========================================================
# Systemd service deployment
# ==========================================================
- name: Deploy Technitium systemd unit
  ansible.builtin.template:
    src: "technitium.service.j2"
    dest: "/etc/systemd/system/technitium.service"
    owner: root
    group: root
    mode: "0644"
  notify:
    - Reload systemd
    - Restart technitium

- name: Wait for Vault-Agent to render certificates
  ansible.builtin.wait_for:
    path: "{{ cert_path }}"
    state: present
    timeout: 60
  loop:
    - "{{ technitium_crt_path }}"
    - "{{ technitium_key_path }}"
    - "{{ technitium_ca_path }}"
  loop_control:
    loop_var: cert_path

- name: Fix ownership and permissions for Technitium certs
  ansible.builtin.file:
    path: "{{ cert.path }}"
    owner: vault
    group: vault
    mode: "{{ cert.mode }}"
  loop:
    - { path: "{{ technitium_crt_path }}", mode: "0644" }
    - { path: "{{ technitium_key_path }}", mode: "0600" }
    - { path: "{{ technitium_ca_path }}", mode: "0644" }
  loop_control:
    loop_var: cert

# ==========================================================
# Start and enable service
# ==========================================================
- name: Ensure Technitium DNS service is running
  ansible.builtin.systemd:
    name: technitium
    enabled: true
    state: started