---
- name: "Validate network_ipv*_dns params"
  ansible.builtin.fail:
    msg: "Pihole role cannot work when network_ipv4_dns or network_ipv6_dns are defined"
  when: network_ipv4_dns is defined or network_ipv6_dns is defined

- name: "Validate pihole_dhcp_* params"
  ansible.builtin.assert:
    that:
      - pihole_dhcp_start is defined
      - pihole_dhcp_end is defined
      - pihole_dhcp_router is defined
      - pihole_dhcp_lease_time is defined
      - pihole_dhcp_domain is defined
      - pihole_dhcp_hosts is defined
  when: pihole_dhcp_enabled

- name: "Crete Pi-hole user"
  become: true
  ansible.builtin.user:
    name: "pihole"
    system: true
    shell: "/usr/sbin/nologin"

- name: "Create Pi-hole directories"
  become: true
  ansible.builtin.file:
    path: "{{ item }}"
    state: "directory"
    owner: "pihole"
    group: "pihole"
    mode: "0755"
  loop:
    - "/etc/pihole"
    - "/var/log/pihole"

- name: "Create Pi-hole configuration file"
  become: true
  ansible.builtin.template:
    src: "pihole.toml.j2"
    dest: "/etc/pihole/pihole.toml"
    owner: "pihole"
    group: "pihole"
    mode: "0644"
  notify: "Restart pihole"
  no_log: true
  # pihole.toml is being rewritten after successful setup
  # This is why this task is not idempotent and can't be.
  tags:
    - molecule-idempotence-notest

- name: "Check if pihole binary exists"
  ansible.builtin.stat:
    path: "/usr/local/bin/pihole"
  register: pihole_binary

- name: "Download Pi-hole installer"
  ansible.builtin.get_url:
    url: "https://install.pi-hole.net"
    dest: "/tmp/install_pihole.sh"
    mode: "0755"
  when: not pihole_binary.stat.exists

- name: "Run Pi-hole installer"
  become: true
  ansible.builtin.command:
    cmd: "/tmp/install_pihole.sh --unattended"
  register: pihole_install
  environment:
    PIHOLE_SKIP_OS_CHECK: "true"
  args:
    creates: "/usr/local/bin/pihole"
  when: not pihole_binary.stat.exists
  notify: "Show install output"

- name: "Ensure Pi-hole started/enabled"
  become: true
  ansible.builtin.systemd_service:
    name: "pihole-FTL"
    enabled: true
    state: "started"
    daemon_reload: true

- name: "Update Pi-hole blocklists"
  become: true
  ansible.builtin.command:
    cmd: "pihole -g"
  changed_when: false

- name: "Configure pihole as system DNS"
  become: true
  tags:
    # linking the systemd run files fails in molecule tests
    # This is not relevant to the testing itself, so it's safe to ignore
    # The other tasks override the network role configurations, this is
    # by design, and intentional, which conflicts with molecule-idempotent test
    # therefore it's safe and better to disable testing for these tasks
    # as these tasks also can't be tested without inspecting pihole logs to
    # verify that the DNS blocking is happening correctly
    - molecule-notest
  notify:
    - "Restart NetworkManager"
    - "Restart systemd-resolved"
  block:
    - name: "Configure NetworkManager to disable DNS management"
      ansible.builtin.copy:
        dest: "/etc/NetworkManager/NetworkManager.conf"
        owner: "root"
        group: "root"
        mode: "0644"
        content: |
          [main]
          dns=none

    - name: "Configure systemd-resolved for Pi-hole"
      ansible.builtin.copy:
        dest: "/etc/systemd/resolved.conf"
        owner: "root"
        group: "root"
        mode: "0644"
        content: |
          [Resolve]
          DNS=127.0.0.1#53
          DNSStubListener=no

    - name: "Configure system DNS"
      ansible.builtin.file:
        src: "/run/systemd/resolve/resolv.conf"
        dest: "/etc/resolv.conf"
        state: "link"
        force: true

- name: "Create pihole nginx configurations"
  become: true
  when: pihole_by_nginx is defined and pihole_by_nginx != ""
  ansible.builtin.copy:
    content: |
      location /admin/ {
        proxy_pass http://127.0.0.1:{{ pihole_port }}/admin/;
      }
      location /api/ {
        proxy_pass http://127.0.0.1:{{ pihole_port }}/api/;
      }
    dest: "/etc/nginx/conf.d/pihole.conf"
    owner: "root"
    group: "root"
    mode: "0644"
    backup: true
    # workaround issue: https://github.com/ansible/ansible/issues/9112
    # ref: https://serverfault.com/a/811520
    validate: >
      bash -c 'echo "events { worker_connections 2; } http { server { include %s; } }" > /tmp/nginx.conf;
        sudo nginx -T -c /tmp/nginx.conf; ec=$?; rm -f /tmp/nginx.conf; exit $ec'
  notify: "Restart nginx"