---
- name: "✅ Assert correct context"
ansible.builtin.assert:
that:
- application_id == 'svc-dns-unbound'
- database_consumer_id != 'svc-dns-unbound'
- name: "⏳ UNBOUND | Wait for resolver before handing to {{ database_consumer_id }}"
ansible.builtin.shell: >
container exec {{ UNBOUND_CONTAINER_ADDRESS }} sh -lc
'drill -p 53 localhost @127.0.0.1 >/dev/null 2>&1 || nslookup -port=53 localhost 127.0.0.1 >/dev/null 2>&1'
register: unbound_consumer_ready
retries: 30
delay: 5
until: unbound_consumer_ready.rc == 0
changed_when: false
- name: "🚫 UNBOUND | No per-consumer provisioning (isolation: none)"
ansible.builtin.debug:
msg: >-
svc-dns-unbound is a shared recursive/forwarding DNSSEC resolver; consumer
'{{ database_consumer_id }}' reaches it at the static IP {{ UNBOUND_RESOLVER_IP }}
on the '{{ UNBOUND_NETWORK_NAME }}' network. No isolated slice is created.
