sync-ptr-auto-zone.sh

#!/bin/bash

# --- CONFIGURATION ---
FORWARD_ZONES=("example.com" "internal.lan")
# ---------------------

if ! klist -s; then
    echo "❌ Error: No valid Kerberos ticket found. Please run 'kinit admin' first."
    exit 1
fi

echo "🚀 Starting FreeIPA PTR & Reverse Zone synchronization..."

for ZONE in "${FORWARD_ZONES[@]}"; do
    echo "--------------------------------------------------"
    echo "📂 Processing forward zone: $ZONE"
    echo "--------------------------------------------------"

    ipa dnsrecord-find "$ZONE" --sizelimit=0 | awk '
        /^  Record name:/ { host=$3 }
        /A record:/ { print host, $3 }
    ' | while read -r HOST IP; do
        
        if [[ -z "$HOST" || -z "$IP" || "$HOST" == "@" ]]; then
            continue
        fi

        # The backend payload MUST have the trailing dot
        FQDN_WITH_DOT="${HOST}.${ZONE}."
        # FreeIPA CLI outputs it WITHOUT a trailing dot, so we match against this
        FQDN_WITHOUT_DOT="${HOST}.${ZONE}"

        IFS='.' read -r o1 o2 o3 o4 <<< "$IP"
        REVERSE_ZONE="${o3}.${o2}.${o1}.in-addr.arpa"
        REVERSE_RECORD="$o4"

        echo "Checking: $FQDN_WITHOUT_DOT ($IP)"

        # Check if Reverse Zone exists
        ipa dnszone-show "$REVERSE_ZONE" > /dev/null 2>&1
        if [ $? -ne 0 ]; then
            echo "   🌐 Reverse zone '$REVERSE_ZONE' is missing. Creating it..."
            ipa dnszone-add "$REVERSE_ZONE" > /dev/null 2>&1
            if [ $? -eq 0 ]; then
                echo "   ✅ Successfully created reverse zone: $REVERSE_ZONE"
            else
                echo "   ❌ Failed to create reverse zone: $REVERSE_ZONE. Skipping."
                continue
            fi
        fi

        # Fetch what FreeIPA claims is registered (it will strip the dot visually)
        CURRENT_PTR=$(ipa dnsrecord-find "$REVERSE_ZONE" --name="$REVERSE_RECORD" 2>/dev/null | awk -F': ' '/PTR record/ {print $2}' | xargs)

        # Compare against the DOTLESS version since FreeIPA hides the dot on output
        if [ "$CURRENT_PTR" == "$FQDN_WITHOUT_DOT" ]; then
            echo "   ✅ PTR record is properly configured in FreeIPA backend. Skipping."
        else
            if [ -n "$CURRENT_PTR" ]; then
                echo "   ⚠️  Mismatched PTR record found ('$CURRENT_PTR'). Cleaning up..."
                ipa dnsrecord-del "$REVERSE_ZONE" "$REVERSE_RECORD" --ptr-rec="$CURRENT_PTR" > /dev/null 2>&1
            fi
            
            echo "   ➕ Adding canonical PTR record: $FQDN_WITH_DOT"
            # Explicitly force the trailing dot into the API
            ipa dnsrecord-add "$REVERSE_ZONE" "$REVERSE_RECORD" --ptr-rec="${FQDN_WITH_DOT}" > /dev/null 2>&1
            
            if [ $? -eq 0 ]; then
                echo "   ✅ Successfully pushed updated PTR for $IP"
            else
                echo "   ❌ Unexpected error updating PTR for $IP."
            fi
        fi
    done
done

echo "--------------------------------------------------"
echo "🎉 Synchronization complete!"