---
- name: "✅ Ensure A @ for {{ base_domain }}"
  community.general.cloudflare_dns:
    api_token: "{{ lookup('api', 'cloudflare.api_token') }}"
    zone: "{{ base_domain }}"
    type: A
    name: "@"
    content: "{{ networks.internet.ip4 }}"
    proxied: false
    ttl: 1
    state: present
  # rationale: async; no register and no notify, the sibling AAAA and CAA write other record types
  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
  poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

- name: "✅ AAAA @ for {{ base_domain }} = {{ networks.internet.ip6 | default('None') }}"
  community.general.cloudflare_dns:
    api_token: "{{ lookup('api', 'cloudflare.api_token') }}"
    zone: "{{ base_domain }}"
    type: AAAA
    name: "@"
    content: "{{ networks.internet.ip6 }}"
    proxied: false
    ttl: 1
    state: present
  when:
    - (networks.internet.ip6 | default('') | trim) != ''
  # rationale: async; last task of the file, no register and no notify, nothing reads AAAA back
  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
  poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"