From 384aab30d28751e9396ac06e855dad1cf116d6d5 Mon Sep 17 00:00:00 2001
From: shenlan <manbuzhe2009@qq.com>
Date: Mon, 7 Apr 2025 21:32:51 +0800
Subject: [PATCH 1/2] Update app-pipeline-renew-node-ssl-certs.yml

---
 .github/workflows/app-pipeline-renew-node-ssl-certs.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/app-pipeline-renew-node-ssl-certs.yml b/.github/workflows/app-pipeline-renew-node-ssl-certs.yml
index 6d80faff..3511e6a5 100644
--- a/.github/workflows/app-pipeline-renew-node-ssl-certs.yml
+++ b/.github/workflows/app-pipeline-renew-node-ssl-certs.yml
@@ -2,7 +2,6 @@ name: Renew node ssl cert
 
 on:
   pull_request:
-  push:
     paths:
       - '.github/workflows/app-pipeline-renew-node-ssl-certs.yml'
   workflow_dispatch:

From c8988c397a017433072df794a7e6ca5c8cf5a158 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Mon, 7 Apr 2025 22:01:43 +0800
Subject: [PATCH 2/2] refactor: replace disable-systemd-resolved with
 setup-systemd-resolved task

---
 .../roles/vhosts/common/tasks/main.yml        |  4 +--
 .../common/tasks/setup-systemd-resolved.yml   | 36 +++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml

diff --git a/ansible/playbooks/roles/vhosts/common/tasks/main.yml b/ansible/playbooks/roles/vhosts/common/tasks/main.yml
index 8cfd29a5..e4e39167 100644
--- a/ansible/playbooks/roles/vhosts/common/tasks/main.yml
+++ b/ansible/playbooks/roles/vhosts/common/tasks/main.yml
@@ -13,8 +13,8 @@
 - name: Run secure_ssh.sh script
   script: files/secure_ssh.sh
 
-- name: Disable systemd-resolved and set static DNS
-  include_tasks: disable-systemd-resolved.yml
+- name: Set systemd-resolved and set static DNS
+  include_tasks: setup-systemd-resolved.yml
 
 - name: Install packages
   script: files/install-packages.sh
diff --git a/ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml b/ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml
new file mode 100644
index 00000000..e7a130c7
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml
@@ -0,0 +1,36 @@
+# playbooks/setup-systemd-resolved.yml
+- name: Ensure systemd-resolved is installed
+  package:
+    name: systemd-resolved
+    state: present
+
+- name: Enable and start systemd-resolved
+  systemd:
+    name: systemd-resolved
+    enabled: yes
+    state: started
+
+- name: Configure /etc/systemd/resolved.conf
+  ini_file:
+    path: /etc/systemd/resolved.conf
+    section: "Resolve"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    mode: '0644'
+  loop:
+    - { option: "DNSStubListener", value: "no" }
+    - { option: "DNS", value: "" }
+    - { option: "FallbackDNS", value: "" }
+
+- name: Restart systemd-resolved
+  systemd:
+    name: systemd-resolved
+    state: restarted
+    daemon_reload: yes
+
+- name: Ensure /etc/resolv.conf points to /run/systemd/resolve/resolv.conf
+  file:
+    src: /run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true