08_dns-records.yml

---
- name: "✅ Assert the DMARC aggregate report address reaches a Mailu mailbox or alias"
  ansible.builtin.assert:
    that:
      - >-
        'mailbox' in lookup('users', MAILU_DMARC_RUA_USER).accounts
        or (
          lookup('users', MAILU_DMARC_RUA_USER).forward | length > 0
          and 'mailbox' in lookup('users', lookup('users', MAILU_DMARC_RUA_USER).forward).accounts
          and lookup('users', lookup('users', MAILU_DMARC_RUA_USER).forward).email
            == lookup('users', lookup('users', MAILU_DMARC_RUA_USER).forward).username ~ '@' ~ MAILU_DOMAIN
        )
    fail_msg: >-
      services.mailu.dmarc.rua_user '{{ MAILU_DMARC_RUA_USER }}' carries
      neither a mailbox account nor a forward to a user with one whose email
      is that mailbox (<username>@{{ MAILU_DOMAIN }}), so {{ MAILU_DMARC_RUA }}
      reaches no Mailu mailbox and DMARC aggregate reports bounce or leave
      the server.
    quiet: true

- name: "🌐 DNS (Cloudflare) for Mailu"
  include_role:
    name: sys-dns-cloudflare-records
  when: DNS_PROVIDER | lower == 'cloudflare'
  vars:
    cloudflare_no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
    cloudflare_records:
      - type: A
        zone: "{{ MAILU_HOSTNAME_DNS_ZONE }}"
        name: "{{ MAILU_HOSTNAME }}"
        solo: true
        content: "{{ MAILU_IP4_PUBLIC }}"
        proxied: false
      - type: CNAME
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "autoconfig.{{ MAILU_DOMAIN_DNS_ZONE }}"
        solo: true
        value: "{{ MAILU_HOSTNAME }}"
      - { type: MX, zone: "{{ MAILU_DOMAIN_DNS_ZONE }}", name: "{{ MAILU_DOMAIN }}", solo: true, value: "{{ MAILU_HOSTNAME }}", priority: 10 }
      - { type: TXT, zone: "{{ MAILU_DOMAIN_DNS_ZONE }}", name: "{{ MAILU_DOMAIN }}", solo: true, value: '"v=spf1 mx a:{{ MAILU_HOSTNAME }} ~all"' }
      - type: TXT
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "_dmarc.{{ MAILU_DOMAIN_DNS_ZONE }}"
        solo: true
        value: '"v=DMARC1; p=reject; rua=mailto:{{ MAILU_DMARC_RUA }}; ruf=mailto:{{ MAILU_DMARC_RUF }}; adkim=s; aspf=s"'
      - type: TXT
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "dkim._domainkey.{{ MAILU_DOMAIN_DNS_ZONE }}"
        solo: true
        value: '"{{ mailu_dkim_public_key }}"'
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_submission"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 587
        value: "{{ MAILU_HOSTNAME }}"
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_submissions"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 465
        value: "{{ MAILU_HOSTNAME }}"
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_imaps"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 993
        value: "{{ MAILU_HOSTNAME }}"
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_imap"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 143
        value: "{{ MAILU_HOSTNAME }}"
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_pop3s"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 995
        value: "{{ MAILU_HOSTNAME }}"
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_pop3"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 110
        value: "{{ MAILU_HOSTNAME }}"
      - type: SRV
        zone: "{{ MAILU_DOMAIN_DNS_ZONE }}"
        name: "{{ MAILU_DOMAIN }}"
        solo: true
        service: "_autodiscover"
        proto: "_tcp"
        priority: 20
        weight: 1
        port: 443
        value: "{{ MAILU_HOSTNAME }}"

- name: "🌐 rDNS (Hetzner Cloud) for Mailu"
  include_role:
    name: sys-dns-hetzner-rdns
  when: HOSTING_PROVIDER | lower == 'hetzner'
  vars:
    rdns_records:
      - { resource: "server", ip_address: "{{ MAILU_IP4_PUBLIC }}", dns_ptr: "{{ MAILU_HOSTNAME }}" }