09_dns-records.yml

---
- name: "✅ Assert the DMARC aggregate report address reaches a Stalwart mailbox"
  ansible.builtin.assert:
    that:
      - "'mailbox' in lookup('users', STALWART_DMARC_RUA_USER).accounts"
    fail_msg: >-
      services.stalwart.dmarc.rua_user '{{ STALWART_DMARC_RUA_USER }}' carries
      no mailbox account, so Stalwart provisions no recipient for
      {{ STALWART_DMARC_RUA }} and every DMARC aggregate report bounces.
    quiet: true

- name: "🔧 DNS (Cloudflare) for Stalwart"
  when: DNS_PROVIDER | lower == 'cloudflare'
  block:
    - name: "🔧 Base records (Cloudflare) for Stalwart"
      include_role:
        name: sys-dns-cloudflare-records
      vars:
        cloudflare_no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
        cloudflare_records:
          - type: A
            zone: "{{ STALWART_HOSTNAME_DNS_ZONE }}"
            name: "{{ STALWART_HOSTNAME }}"
            solo: true
            content: "{{ STALWART_IP4_PUBLIC }}"
            proxied: false
          - type: CNAME
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "autoconfig.{{ STALWART_DOMAIN_DNS_ZONE }}"
            solo: true
            value: "{{ STALWART_HOSTNAME }}"
          - type: MX
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ STALWART_DOMAIN }}"
            solo: true
            value: "{{ STALWART_HOSTNAME }}"
            priority: 10
          - type: TXT
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ STALWART_DOMAIN }}"
            solo: true
            value: '"v=spf1 mx a:{{ STALWART_HOSTNAME }} ~all"'
          - type: TXT
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "_dmarc.{{ STALWART_DOMAIN_DNS_ZONE }}"
            solo: true
            value: '"v=DMARC1; p=reject; rua=mailto:{{ STALWART_DMARC_RUA }}; ruf=mailto:{{ STALWART_DMARC_RUF }}; adkim=s; aspf=s"'
          - type: TXT
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ stalwart_dkim_selector }}._domainkey.{{ STALWART_DOMAIN_DNS_ZONE }}"
            solo: true
            value: '"{{ stalwart_dkim_public_key }}"'
          - type: SRV
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ STALWART_DOMAIN }}"
            solo: true
            service: "_submissions"
            proto: "_tcp"
            priority: 20
            weight: 1
            port: 465
            value: "{{ STALWART_HOSTNAME }}"
          - type: SRV
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ STALWART_DOMAIN }}"
            solo: true
            service: "_imaps"
            proto: "_tcp"
            priority: 20
            weight: 1
            port: 993
            value: "{{ STALWART_HOSTNAME }}"
          - type: SRV
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ STALWART_DOMAIN }}"
            solo: true
            service: "_pop3s"
            proto: "_tcp"
            priority: 20
            weight: 1
            port: 995
            value: "{{ STALWART_HOSTNAME }}"
          - type: SRV
            zone: "{{ STALWART_DOMAIN_DNS_ZONE }}"
            name: "{{ STALWART_DOMAIN }}"
            solo: true
            service: "_autodiscover"
            proto: "_tcp"
            priority: 20
            weight: 1
            port: 443
            value: "{{ STALWART_HOSTNAME }}"

    - name: "🔧 MX (Cloudflare) for the Stalwart alias domains"
      include_role:
        name: sys-dns-cloudflare-records
      when:
        - STALWART_ALIAS_DOMAINS | length > 0
      vars:
        cloudflare_no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
        cloudflare_records: "{{ STALWART_ALIAS_DOMAIN_MX_RECORDS }}"

- name: "🔧 rDNS (Hetzner Cloud) for Stalwart"
  include_role:
    name: sys-dns-hetzner-rdns
  when: HOSTING_PROVIDER | lower == 'hetzner'
  vars:
    rdns_records:
      - { resource: "server", ip_address: "{{ STALWART_IP4_PUBLIC }}", dns_ptr: "{{ STALWART_HOSTNAME }}" }