mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-09-14 06:17:14 +02:00
Kevin Veen-Birkenbach
a552ea175d
Introduce sys-svc-dns to bootstrap Cloudflare DNS prerequisites. Validates CLOUDFLARE_API_TOKEN, (optionally) manages CAA for base SLDs, and delegates parent record creation to sys-dns-parent-hosts. Wired into sys-stk-front-pure. sys-dns-parent-hosts: new parent_dns filter builds A/AAAA for each parent host and wildcard children (*.parent). Supports dict/list inputs for CURRENT_PLAY_DOMAINS, optional IPv6, proxied flag, and optional *.apex. Exposes a single parent_build_records entry point. Let’s Encrypt role cleanup: remove DNS/C AA management from sys-svc-letsencrypt; it now focuses on webroot challenge config and renew timer. Fixed path joins and run_once guards. Tests: update unit tests to allow wildcard outputs and dict-based CURRENT_PLAY_DOMAINS. Add generate_base_sld_domains filter. Documentation updates for both roles. Conversation: https://chatgpt.com/share/68c342f7-d20c-800f-b61f-cefeebcf1cd8
32 lines
1003 B
YAML
32 lines
1003 B
YAML
---
|
||
- name: "Validate CLOUDFLARE_API_TOKEN"
|
||
fail:
|
||
msg: >
|
||
The variable "CLOUDFLARE_API_TOKEN" must be defined and cannot be empty!
|
||
when: (CLOUDFLARE_API_TOKEN | default('') | trim) == ''
|
||
|
||
- name: "Ensure all CAA records are present"
|
||
community.general.cloudflare_dns:
|
||
api_token: "{{ CLOUDFLARE_API_TOKEN }}"
|
||
zone: "{{ item.0 }}"
|
||
record: "@"
|
||
type: CAA
|
||
flag: 0
|
||
tag: "{{ item.1.tag }}"
|
||
value: "{{ item.1.value }}"
|
||
ttl: 1
|
||
state: present
|
||
loop: "{{ base_sld_domains | product(caa_entries) | list }}"
|
||
loop_control:
|
||
label: "{{ item.0 }} → {{ item.1.tag }}"
|
||
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
||
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
|
||
|
||
- name: "Ensure parent DNS (apex + parent FQDNs) exists"
|
||
include_role:
|
||
name: sys-dns-parent-hosts
|
||
vars:
|
||
parent_dns_proxied: false
|
||
when: run_once_sys_dns_parent_hosts is not defined
|
||
|
||
- include_tasks: utils/run_once.yml |