---
- name: Assert public DNS data is sane
  ansible.builtin.assert:
    that:
      - public_dns__domain | length > 0
      - public_dns__records | selectattr('type', 'equalto', 'MX') | list | length > 0
    fail_msg: >-
      public_dns__domain must be set and a null-MX anti-spoof record declared in
      public_dns__records (group_vars/all/public_dns.yml).
  run_once: true

- name: Ensure desired records are present (Gandi LiveDNS)
  community.general.gandi_livedns:
    domain: "{{ public_dns__domain }}"
    record: "{{ item.record }}"
    type: "{{ item.type }}"
    values: "{{ item.values }}"
    ttl: "{{ item.ttl | default(public_dns__default_ttl) }}"
    state: present
    personal_access_token: "{{ vault.gandi.pat }}"
  loop: "{{ public_dns__records }}"
  loop_control:
    label: "{{ item.record }} {{ item.type }}"
  run_once: true
  when: public_dns__apply | bool

- name: Ensure unwanted records are absent (Gandi LiveDNS)
  community.general.gandi_livedns:
    domain: "{{ public_dns__domain }}"
    record: "{{ item.record }}"
    type: "{{ item.type }}"
    state: absent
    personal_access_token: "{{ vault.gandi.pat }}"
  loop: "{{ public_dns__absent }}"
  loop_control:
    label: "{{ item.record }} {{ item.type }}"
  run_once: true
  when: public_dns__apply | bool