sjat
078d1ad9d9
Gandi LiveDNS rejects the RFC-7505 null-MX value '0 .' ('invalid format for MX
record'), which failed the live apply. No MX + no apex A = no mail delivery, and
SPF -all + DMARC reject still prevent spoofing — so remove Gandi's seeded MX (add
@/MX to absent) rather than declare a null-MX present. Assert now requires an SPF
@/TXT record; tests + Molecule sample updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
---
|
|
- name: Assert public DNS data is sane
|
|
ansible.builtin.assert:
|
|
that:
|
|
- public_dns__domain | length > 0
|
|
- public_dns__records | selectattr('record', 'equalto', '@')
|
|
| selectattr('type', 'equalto', 'TXT') | list | length > 0
|
|
fail_msg: >-
|
|
public_dns__domain must be set and an SPF record (@/TXT) declared in
|
|
public_dns__records (group_vars/all/public_dns.yml).
|
|
run_once: true
|
|
|
|
- name: Ensure desired records are present (Gandi LiveDNS)
|
|
community.general.gandi_livedns:
|
|
domain: "{{ public_dns__domain }}"
|
|
record: "{{ item.record }}"
|
|
type: "{{ item.type }}"
|
|
values: "{{ item.values }}"
|
|
ttl: "{{ item.ttl | default(public_dns__default_ttl) }}"
|
|
state: present
|
|
personal_access_token: "{{ vault.gandi.pat }}"
|
|
loop: "{{ public_dns__records }}"
|
|
loop_control:
|
|
label: "{{ item.record }} {{ item.type }}"
|
|
run_once: true
|
|
when: public_dns__apply | bool
|
|
|
|
- name: Ensure unwanted records are absent (Gandi LiveDNS)
|
|
community.general.gandi_livedns:
|
|
domain: "{{ public_dns__domain }}"
|
|
record: "{{ item.record }}"
|
|
type: "{{ item.type }}"
|
|
state: absent
|
|
personal_access_token: "{{ vault.gandi.pat }}"
|
|
loop: "{{ public_dns__absent }}"
|
|
loop_control:
|
|
label: "{{ item.record }} {{ item.type }}"
|
|
run_once: true
|
|
when: public_dns__apply | bool
|