---
# ============================================================================
# Configure DNS Settings
# ============================================================================

- name: Get current DNS configuration from firewall
  ansible.builtin.uri:
    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController?reqxml=<Request><Login><Username>{{ sophos_api_username }}</Username><Password>{{ sophos_api_password }}</Password></Login><Get><DNS/></Get></Request>"
    method: POST
    validate_certs: "{{ sophos_validate_certs }}"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    return_content: true
    status_code: [200]
  register: current_dns_config
  no_log: "{{ sophos_no_log_sensitive }}"
  tags: ['dns']

- name: Display current DNS forwarders
  ansible.builtin.debug:
    msg: "Current DNS configuration retrieved"
  tags: ['dns']

- name: Configure DNS settings
  ansible.builtin.uri:
    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
    method: POST
    validate_certs: "{{ sophos_validate_certs }}"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    body: "reqxml={{ lookup('template', 'dns_config.json.j2') | urlencode }}"
    status_code: [200, 201]
    timeout: "{{ sophos_api_timeout }}"
  register: dns_result
  no_log: "{{ sophos_no_log_sensitive }}"
  changed_when: "'successful' in dns_result.content | lower or '200' in dns_result.content"
  failed_when: "'error' in dns_result.content | lower"
  tags: ['dns']

- name: Display DNS configuration result
  ansible.builtin.debug:
    msg: "DNS configuration applied successfully"
  tags: ['dns']