#!/bin/bash

# 安装 BIND 和必需的工具，如果它们还未安装
if ! rpm -q bind bind-utils >/dev/null 2>&1; then
    dnf install -y bind bind-utils
fi

# 确保日志目录存在
mkdir -p /var/log/named/
chown named:named /var/log/named/ -R

# 定义配置文件内容
named_conf_content='
options {
    listen-on port 53 { any; };
    listen-on-v6 port 53 { any; };
    directory "/var/named";
    dump-file "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    secroots-file "/var/named/data/named.secroots";
    recursing-file "/var/named/data/named.recursing";
    allow-query { any; };
    forwarders { 192.168.100.254; };
    recursion yes;
    dnssec-enable yes;
    dnssec-validation yes;
    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
    include "/etc/crypto-policies/back-ends/bind.config";
};

logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };

    channel custom_log {
        file "/var/log/named/named.log" versions 3 size 5m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    category default {
        custom_log;
    };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

zone "lab.example.com" IN {
    type master;
    file "lab.example.com.zone";
    allow-query { any; };
};

zone "250.25.172.in-addr.arpa" IN {
    type master;
    file "250.25.172.rev";
    allow-query { any; };
};
'

# 只有在 /etc/named.conf 的内容不匹配时才更新它
if ! echo "$named_conf_content" | diff - /etc/named.conf >/dev/null; then
    echo "$named_conf_content" | sudo tee /etc/named.conf > /dev/null
fi

# 以下是为 zone "lab.example.com" 和反向解析的内容
# 仅当文件不存在或内容不匹配时才创建或更新

update_zone_file() {
    local file="$1"
    local content="$2"

    if [ ! -f "$file" ] || ! echo "$content" | diff - "$file" >/dev/null; then
        echo "$content" | sudo tee "$file" > /dev/null
        chown root:named "$file"
        chmod 644 "$file"
    fi
}

update_zone_file "/var/named/lab.example.com.zone" '
$TTL 86400
@   IN  SOA     router.lab.example.com. root.lab.example.com. (
                20240101  ; Serial
                3600      ; Refresh
                1800      ; Retry
                604800    ; Expire
                86400     ; Minimum TTL
)
                IN  NS      router.lab.example.com.
router          IN  A       172.25.250.1
servera         IN  A       172.25.250.11
serverb         IN  A       172.25.250.12
serverc         IN  A       172.25.250.13
serverd         IN  A       172.25.250.14
'

update_zone_file "/var/named/250.25.172.rev" '
$TTL 86400
@   IN  SOA     router.lab.example.com. root.lab.example.com. (
                20240101  ; Serial
                3600      ; Refresh
                1800      ; Retry
                604800    ; Expire
                86400     ; Minimum TTL
)
                IN  NS      router.lab.example.com.
1               IN  PTR     router.lab.example.com.
11              IN  PTR     servera.lab.example.com.
12              IN  PTR     serverb.lab.example.com.
13              IN  PTR     serverc.lab.example.com.
14              IN  PTR     serverd.lab.example.com.
'

# 确保 named 服务已启用并根据需要启动
if ! systemctl is-enabled named >/dev/null 2>&1; then
    systemctl enable named
fi

if ! systemctl is-active named >/dev/null 2>&1; then
    systemctl restart named
else
    systemctl reload named
fi

# 配置防火墙规则，仅当规则不存在时添加
if ! firewall-cmd --list-all | grep -q 'service: dns'; then
    firewall-cmd --add-service=dns --permanent
    firewall-cmd --reload
fi

if ! firewall-cmd --list-all | grep -q 'masquerade: yes'; then
    firewall-cmd --add-masquerade --permanent
    firewall-cmd --reload
fi
