---
# Pi-hole native installation (no Docker)

- name: Install Pi-hole prerequisites
  apt:
    name:
      - curl
      - git
      - iproute2
      - whiptail
      - ca-certificates
      - cron
    state: present
    update_cache: true

- name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
  service:
    name: systemd-resolved
    state: stopped
    enabled: false
  failed_when: false

- name: Set DNS fallback for installation
  copy:
    dest: /etc/resolv.conf
    content: |
      nameserver 9.9.9.9
      nameserver 1.1.1.1
    mode: "0644"

- name: Create Pi-hole config directory
  file:
    path: /etc/pihole
    state: directory
    mode: "0755"

- name: Deploy setupVars.conf for unattended install
  copy:
    dest: /etc/pihole/setupVars.conf
    content: |
      PIHOLE_INTERFACE={{ ansible_default_ipv4.interface | default('eth0') }}
      PIHOLE_DNS_1={{ pihole_upstream.split(';')[0] | default('9.9.9.9') }}
      PIHOLE_DNS_2={{ pihole_upstream.split(';')[1] | default('149.112.112.112') }}
      QUERY_LOGGING=false
      INSTALL_WEB_SERVER=true
      INSTALL_WEB_INTERFACE=true
      LIGHTTPD_ENABLED=false
      CACHE_SIZE=10000
      DNS_FQDN_REQUIRED=true
      DNS_BOGUS_PRIV=true
      DNSSEC=true
      BLOCKING_ENABLED=true
      WEBPASSWORD=
    mode: "0644"

- name: Clone Pi-hole repository
  git:
    repo: https://github.com/pi-hole/pi-hole.git
    dest: /opt/pihole-install
    version: master
    depth: 1

- name: Run Pi-hole installer (unattended)
  command: bash /opt/pihole-install/automated\ install/basic-install.sh --unattended
  args:
    creates: /usr/local/bin/pihole
  environment:
    PIHOLE_SKIP_OS_CHECK: "true"

- name: Allow DNS through UFW
  ufw:
    rule: allow
    port: "{{ item.port }}"
    proto: "{{ item.proto }}"
  loop:
    - { port: "53", proto: "tcp" }
    - { port: "53", proto: "udp" }

- name: Allow Pi-hole admin from private networks only
  ufw:
    rule: allow
    port: "80"
    proto: tcp
    from_ip: "{{ item }}"
  loop:
    - "10.0.0.0/8"
    - "172.16.0.0/12"
    - "192.168.0.0/16"