---
- name: Converge
  hosts: all
  tasks:
    - name: Include bind9 role
      ansible.builtin.include_role:
        name: ../../../ansible-bind9-role  # noqa: role-name[path]
  vars:
    bind9_host_config:
      - name: named.conf.options
        options:
          directory: "{{ bind9_working_directory }}"
          recursion: true
          allow_query:
            - any
          allow_recursion:
            - 10.0.0.0/8
            - 192.168.0.0/16
            - 172.16.0.0/12
            - localhost
            - localnets
          forwarders:
            - address: 91.239.100.100
              tls: censurfridns-anycast
            - address: 89.233.43.71
              tls: censurfridns-unicast
          forward: first
          dnssec_validation: auto
      - name: named.conf.local
        tls:
          - name: censurfridns-anycast
            remote_hostname: anycast.uncensoreddns.org
          - name: censurfridns-unicast
            remote_hostname: unicast.uncensoreddns.org
        zones:
          - name: example.internal
            type: forward
            forward: only
            forwarders:
              - 10.0.0.53
              - 10.0.0.54