---
- name: Ensure dnsmasq.d exists
  ansible.builtin.file:
    path: /etc/dnsmasq.d
    state: directory
    mode: "0755"

- name: Configure dns-forward-max
  ansible.builtin.template:
    src: 99-dns-forward-max.conf.j2
    dest: /etc/dnsmasq.d/99-dns-forward-max.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart pihole-FTL

- name: Configure Pi-hole forwarding for Samba AD + reverse zone
  ansible.builtin.template:
    src: 05-samba-ad.conf.j2
    dest: /etc/dnsmasq.d/05-samba-ad.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart pihole-FTL

- name: Configure knoe.dev GKE service records (dnsmasq fallback)
  ansible.builtin.template:
    src: 06-knoe-dev.conf.j2
    dest: /etc/dnsmasq.d/06-knoe-dev.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart pihole-FTL

- name: Register knoe.dev GKE records in Pi-hole 6 dns.hosts (native override)
  # Pi-hole 6 uses pihole-FTL's internal dns.hosts for local records.
  # dnsmasq address= directives work for some domains but Pi-hole 6 may
  # serve cached upstream answers over them; dns.hosts always wins.
  ansible.builtin.shell: |
    # Build the hosts array: preserve existing non-knoe entries + add ours
    CURRENT=$(pihole-FTL --config dns.hosts 2>/dev/null | tr -d '[]' | tr ',' '\n' | grep -v '0.knoe.dev' | grep -v '^$' | sed 's/^ *//' | sed 's/ *$//')
    NEW_ENTRIES="{% for r in knoe_dev_dns_records %}{{ r.ip }} {{ r.name }}{% if not loop.last %}\n{% endif %}{% endfor %}"
    ALL=$(printf '%s\n%s' "$CURRENT" "$(printf '%b' "$NEW_ENTRIES")" | grep -v '^$' | sort -u)
    JSON=$(echo "$ALL" | awk '{print "\"" $0 "\""}' | paste -sd ',' | sed 's/^/[/;s/$/]/')
    pihole-FTL --config dns.hosts "$JSON"
    pihole reloaddns
  register: pihole_hosts_result
  changed_when: true

- name: Read current Pi-hole FTL DB journal mode (WAL?)
  ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode;"
  register: pihole_journal
  changed_when: false
  failed_when: false

- name: Parse current journal mode (safe default)
  ansible.builtin.set_fact:
    pihole_journal_mode: "{{ (pihole_journal.stdout | default('') | trim | lower) }}"

- name: Determine whether WAL update is needed
  ansible.builtin.set_fact:
    pihole_need_wal: "{{ (pihole_journal.rc | default(1) == 0) and (pihole_journal_mode != 'wal') }}"

# Only stop/start FTL if we are actually changing the journal mode.
- name: Enable WAL mode on Pi-hole FTL DB (one-time)
  block:
    - name: Stop pihole-FTL before switching SQLite journal mode
      ansible.builtin.service:
        name: pihole-FTL
        state: stopped

    - name: Set SQLite journal_mode=WAL
      ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode=WAL;"

    - name: Start pihole-FTL after switching SQLite journal mode
      ansible.builtin.service:
        name: pihole-FTL
        state: started
  when: pihole_need_wal