#! /bin/sh
#
# Univention Bind
#  postinst script for the univention-bind debian package
#
# SPDX-FileCopyrightText: 2001-2026 Univention GmbH
# SPDX-License-Identifier: AGPL-3.0-only

# shellcheck source=/dev/null
. /usr/share/univention-lib/all.sh

if [ "$1" = "configure" ]; then
	# touch config file just in case the listener module bind.py has not created it yet
	touch /etc/bind/univention.conf.proxy
fi

# Bug #59441: UCS 5.2 used the per-zone SDB 'database "ldap"' driver, configured
# via /etc/bind/univention.conf.d/<zone> included from /etc/bind/univention.conf.
# UCS 5.3 serves every zone from the global DLZ block in named.conf, where those
# leftovers register a zone that shadows the DLZ and breaks zone transfer. Drop
# them on upgrade. named.conf no longer includes univention.conf
if [ "$1" = "configure" ] && dpkg --compare-versions "$2" lt-nl 17.0.0; then
	ucr commit /etc/bind/named.conf
	if [ -d /etc/bind/univention.conf.d ]; then
		find /etc/bind/univention.conf.d -maxdepth 1 -type f ! -name '*.proxy' -delete
	fi
	rm -f /etc/bind/univention.conf
fi

# Remove service diversion before any service is restarted through debhelper
if [ "$1" = "configure" ] && dpkg --compare-versions "$2" lt 14.0.0-7; then
	dpkg-divert --quiet \
		--package univention-bind \
		--divert /lib/systemd/system/bind9.service.debian \
		--rename --remove /lib/systemd/system/bind9.service
	rm /etc/systemd/system/bind9.service.d/09-upgrade_workaround.conf
	if [ "$(readlink --canonicalize /etc/systemd/system/bind9.service)" = "/lib/systemd/system/bind9.service.debian" ]; then
		rm /etc/systemd/system/bind9.service
		systemctl daemon-reload
	fi

	ucr unset dns/master/port
fi

#DEBHELPER#

# configure firewall
ucr set security/packetfilter/package/univention-bind/udp/53/all=ACCEPT \
        security/packetfilter/package/univention-bind/tcp/53/all=ACCEPT \
        security/packetfilter/package/univention-bind/udp/7777/all=ACCEPT \
        security/packetfilter/package/univention-bind/tcp/7777/all=ACCEPT \
        security/packetfilter/package/univention-bind/udp/53/all/en="DNS proxy" \
        security/packetfilter/package/univention-bind/tcp/53/all/en="DNS proxy" \
        security/packetfilter/package/univention-bind/udp/7777/all/en="DNS server" \
        security/packetfilter/package/univention-bind/tcp/7777/all/en="DNS server"
[ -x "/etc/init.d/univention-firewall" ] && service univention-firewall restart

chmod g+w /etc/bind
chmod g+w /etc/bind/*

univention-config-registry set 'bind/autostart?yes' \
                               'dns/ipv6?yes' \
                               'nameserver/external?false' \
                               'dns/allow/query?any' \
                               'dns/allow/transfer?any' \
                               'dns/dlz/debug/level?0' \
                               'dns/debug/level?0'

if [ "$1" = configure ] && [ -z "$2" ]
then
	univention-config-registry set dns/allow/query/cache?'localhost; 10.0.0.0/8; 169.254.0.0/16; 172.16.0.0/12; 192.168.0.0/16; fc00::/7; fe80::/10; localnets'
fi

if [ ! -e /etc/bind/local.conf ]; then
	echo "# add local zones here" >> /etc/bind/local.conf
fi
if [ ! -e /etc/bind/local.conf.proxy ]; then
	echo "# add local zones here" >> /etc/bind/local.conf.proxy
fi
if [ ! -e /etc/bind/local.conf.samba4 ]; then
	echo "# add local zones here" >> /etc/bind/local.conf.samba4
fi
if [ ! -e /etc/bind/local-predlz.conf.samba4 ]; then
	echo "# add local zones, which have to be declared before the Samba 4 DLZ, here" >> /etc/bind/local-predlz.conf.samba4
fi

if [ "$1" = "configure" ]; then
	if [ -z "$2" ]
	then
		ucr commit /etc/bind/named.conf.samba4
		rm -f /etc/systemd/system/named.service
		systemctl --system daemon-reload
	fi
	deb-systemd-invoke restart named
	if [ -z "$2" ]
	then
		# shellcheck disable=SC2015
		[ -e /var/univention-join/joined ] &&
		[ -x /usr/share/univention-server/univention-fix-ucr-dns ] &&
		/usr/share/univention-server/univention-fix-ucr-dns ||
		: # better safe than sorry
	fi
	deb-systemd-invoke try-restart univention-directory-listener
fi

deb-systemd-helper enable named.service

call_joinscript 05univention-bind.inst
call_joinscript 90univention-bind-post.inst

exit 0
