---
- name: "Validate network_ipv*_dns params"
  ansible.builtin.fail:
    msg: "Pihole role cannot work when network_ipv4_dns or network_ipv6_dns are defined"
  when: network_ipv4_dns is defined or network_ipv6_dns is defined

- name: "Validate pihole_dhcp_* params"
  ansible.builtin.assert:
    that:
      - pihole_dhcp_start is defined
      - pihole_dhcp_end is defined
      - pihole_dhcp_router is defined
      - pihole_dhcp_lease_time is defined
      - pihole_dhcp_domain is defined
      - pihole_dhcp_hosts is defined
  when: pihole_dhcp_enabled

- name: "Crete Pi-hole user"
  become: true
  ansible.builtin.user:
    name: "pihole"
    system: true
    shell: "/usr/sbin/nologin"

- name: "Create Pi-hole directories"
  become: true
  ansible.builtin.file:
    path: "{{ item }}"
    state: "directory"
    owner: "pihole"
    group: "pihole"
    mode: "0755"
  loop:
    - "/etc/pihole"
    - "/var/log/pihole"

- name: "Create Pi-hole configuration file"
  become: true
  ansible.builtin.template:
    src: "pihole.toml.j2"
    dest: "/etc/pihole/pihole.toml"
    owner: "pihole"
    group: "pihole"
    mode: "0644"
  no_log: true
  # pihole.toml is being rewritten after successful setup
  # This is why this task is not idempotent and can't be.
  tags:
    - molecule-idempotence-notest

- name: "Check if pihole binary exists"
  ansible.builtin.stat:
    path: "/usr/local/bin/pihole"
  register: pihole_binary

- name: "Download Pi-hole installer"
  ansible.builtin.get_url:
    url: "https://install.pi-hole.net"
    dest: "/tmp/install_pihole.sh"
    mode: "0755"
  when: not pihole_binary.stat.exists

- name: "Run Pi-hole installer"
  become: true
  ansible.builtin.command:
    cmd: "/tmp/install_pihole.sh --unattended"
  register: pihole_install
  environment:
    PIHOLE_SKIP_OS_CHECK: "true"
  args:
    creates: "/usr/local/bin/pihole"
  when: not pihole_binary.stat.exists
  notify: "Show install output"

- name: "Ensure Pi-hole started/enabled"
  become: true
  ansible.builtin.systemd_service:
    name: "pihole-FTL"
    enabled: true
    state: "started"
    daemon_reload: true

- name: "Update Pi-hole blocklists"
  become: true
  ansible.builtin.command:
    cmd: "pihole -g"
  changed_when: false

- name: "Configure pihole as system DNS"
  become: true
  tags:
    # linking the systemd run files fails in molecule tests
    # This is not relevant to the testing itself, so it's safe to ignore
    # The other tasks override the network role configurations, this is
    # by design, and intentional, which conflicts with molecule-idempotent test
    # therefore it's safe and better to disable testing for these tasks
    # as these tasks also can't be tested without inspecting pihole logs to
    # verify that the DNS blocking is happening correctly
    - molecule-notest
  notify:
    - "Restart NetworkManager"
    - "Restart systemd-resolved"
  block:
    - name: "Configure NetworkManager to disable DNS management"
      ansible.builtin.copy:
        dest: "/etc/NetworkManager/NetworkManager.conf"
        owner: "root"
        group: "root"
        mode: "0644"
        content: |
          [main]
          dns=none

    - name: "Configure systemd-resolved for Pi-hole"
      ansible.builtin.copy:
        # NOTE: overwrites the network role's drop-in so DNSStubListener=no wins
        # (drop-ins beat /etc/systemd/resolved.conf, so writing here is required)
        dest: "/etc/systemd/resolved.conf.d/99-custom.conf"
        owner: "root"
        group: "root"
        mode: "0644"
        content: |
          [Resolve]
          DNS=127.0.0.1#53
          DNSStubListener=no
          MulticastDNS=yes
          LLMNR=no
          Cache=yes
          ReadEtcHosts=yes

    - name: "Configure system DNS"
      ansible.builtin.file:
        src: "/run/systemd/resolve/resolv.conf"
        dest: "/etc/resolv.conf"
        state: "link"
        force: true

- name: "Flush handlers before restarting pihole-FTL"
  # systemd-resolved must release port 53 before pihole-FTL binds it.
  # flush_handlers here makes that ordering a structural guarantee rather than
  # relying on handler definition order.
  ansible.builtin.meta: flush_handlers

- name: "Restart pihole-FTL"
  become: true
  ansible.builtin.systemd_service:
    name: "pihole-FTL"
    state: "restarted"
  tags:
    - molecule-idempotence-notest

- name: "Create pihole nginx vhost configuration"
  become: true
  when: proxy_type == "nginx" and pihole_hostname | length > 0
  ansible.builtin.template:
    src: "pihole.nginx.conf.j2"
    dest: "/etc/nginx/vhosts.d/pihole.conf"
    owner: "root"
    group: "root"
    mode: "0644"
    backup: true
    validate: >
      bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
        sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
  notify: "Restart proxy"

- name: "Create pihole caddy configuration"
  become: true
  when: proxy_type == "caddy" and pihole_hostname | length > 0
  ansible.builtin.template:
    src: "pihole.caddy.j2"
    dest: "/etc/caddy/sites/pihole.caddy"
    owner: "root"
    group: "caddy"
    mode: "0640"
  notify: "Restart proxy"