boma/roles/public_dns/molecule/default/converge.yml

---
- name: Converge
  hosts: all
  gather_facts: true
  vars:
    public_dns__apply: false          # never call the Gandi API from a container
    public_dns__domain: example.test
    public_dns__records:
      - {record: "@", type: TXT, values: ['"v=spf1 -all"'], ttl: 3600}
    public_dns__absent:
      - {record: www, type: CNAME}
      - {record: "@", type: MX}
  roles:
    - role: public_dns
scaffold(public_dns): empty role structure Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 10:30:02 +02:00			`---`
			`- name: Converge`
			`hosts: all`
			`gather_facts: true`
test(public_dns): Molecule scenario (apply disabled, no live API) Converge runs in CI; the no-op apply=false scenario adds no local signal over the pytest, and the test image is on an unreachable registry. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 10:36:40 +02:00			`vars:`
			`public_dns__apply: false # never call the Gandi API from a container`
			`public_dns__domain: example.test`
			`public_dns__records:`
			`- {record: "@", type: TXT, values: ['"v=spf1 -all"'], ttl: 3600}`
			`public_dns__absent:`
			`- {record: www, type: CNAME}`
fix(public_dns): drop null-MX (Gandi rejects '0 .'); remove MX instead Gandi LiveDNS rejects the RFC-7505 null-MX value '0 .' ('invalid format for MX record'), which failed the live apply. No MX + no apex A = no mail delivery, and SPF -all + DMARC reject still prevent spoofing — so remove Gandi's seeded MX (add @/MX to absent) rather than declare a null-MX present. Assert now requires an SPF @/TXT record; tests + Molecule sample updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 10:53:54 +02:00			`- {record: "@", type: MX}`
scaffold(public_dns): empty role structure Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 10:30:02 +02:00			`roles:`
			`- role: public_dns`