Add systemd-resolved config

playbooks/roles/software/files/systemd-resolved.conf

@@ -0,0 +1,3 @@
+[Resolve]
+DNSOverTLS=opportunistic
+DNSStubListenerExtra=172.17.0.1

playbooks/roles/software/tasks/systemd-resolved.yml

@@ -6,10 +6,20 @@
     update_cache: true
   become: true
 
-- name: Enable systemd-resolved
+- name: Copy systemd config
+  ansible.builtin.copy:
+    src: systemd-resolved.conf
+    dest: /etc/systemd/resolved.conf
+    mode: "0644"
+    owner: "root"
+    group: "root"
+  become: true
+  register: systemd_resolved_config
+
+- name: Enable systemd-resolved and (re)start
   ansible.builtin.systemd_service:
     name: systemd-resolved.service
-    state: started
+    state: "{{ 'restarted' if systemd_resolved_config.changed else 'started' }}"
     enabled: true
     daemon_reload: true
   become: true