From 3ada16c875b6ad6f89bf640913d3921226a51124 Mon Sep 17 00:00:00 2001 From: chrisfu Date: Sat, 23 May 2026 21:31:52 -0700 Subject: [PATCH] feat(infrastructure): add Pi-hole DNS flush playbook and logs dir MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit infrastructure/playbooks/pihole_flush_dns.yml — Ansible playbook to flush Pi-hole DNS cache across inventory hosts. infrastructure/logs/ — log directory for Ansible run output. Co-authored-by: Junie --- .../20260514-224653-morgana-chrisfu.log | 58 +++++++++++++++ .../20260514-230343-morgana-chrisfu.log | 58 +++++++++++++++ .../20260514-231604-morgana-chrisfu.log | 32 ++++++++ .../20260514-231850-morgana-chrisfu.log | 58 +++++++++++++++ .../20260514-235224-morgana-chrisfu.log | 14 ++++ .../20260514-235400-morgana-chrisfu.log | 74 +++++++++++++++++++ .../20260514-235731-morgana-chrisfu.log | 58 +++++++++++++++ infrastructure/playbooks/pihole_flush_dns.yml | 34 +++++++++ 8 files changed, 386 insertions(+) create mode 100644 infrastructure/logs/ansible/20260514-224653-morgana-chrisfu.log create mode 100644 infrastructure/logs/ansible/20260514-230343-morgana-chrisfu.log create mode 100644 infrastructure/logs/ansible/20260514-231604-morgana-chrisfu.log create mode 100644 infrastructure/logs/ansible/20260514-231850-morgana-chrisfu.log create mode 100644 infrastructure/logs/ansible/20260514-235224-morgana-chrisfu.log create mode 100644 infrastructure/logs/ansible/20260514-235400-morgana-chrisfu.log create mode 100644 infrastructure/logs/ansible/20260514-235731-morgana-chrisfu.log create mode 100644 infrastructure/playbooks/pihole_flush_dns.yml diff --git a/infrastructure/logs/ansible/20260514-224653-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-224653-morgana-chrisfu.log new file mode 100644 index 0000000..0cbee4b --- /dev/null +++ b/infrastructure/logs/ansible/20260514-224653-morgana-chrisfu.log @@ -0,0 +1,58 @@ +Ansible Run Started: 2026-05-14T22:46:53.544514 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l ad_dc --tags samba_dns --ask-vault-pass +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] + +PLAY [Tier 3 - Filesystem mounts (iSCSI)] +Targets: ['iscsi'] + +PLAY [Tier 4 - OS configuration (Pi-hole DNS and resilience)] +Targets: ['pihole'] + +PLAY [Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)] +Targets: ['ad_dc'] +OK: myrddin.prole.org - samba_dns : Assert Samba DNS admin password is set (vault loaded) +OK: myrddin.prole.org - samba_dns : List Samba DNS zones +SKIPPED: myrddin.prole.org - samba_dns : Create DNS zones if missing +OK: myrddin.prole.org - samba_dns : Ensure forward A records (internal RFC1918 hosts and k3s front-door) +OK: myrddin.prole.org - samba_dns : Ensure forward CNAME records + +PLAY [Tier 4 - OS configuration (base linux)] +Targets: ['linux_hosts'] + +PLAY [Tier 4.1 - OS configuration (Prole SSL certs)] +Targets: ['ssl_hosts'] + +PLAY [Tier 4 - OS configuration (console dashboard)] +Targets: ['k3s_hosts'] + +PLAY [Tier 4.5 - Database (MariaDB primary)] +Targets: ['mariadb_primary'] + +PLAY [Tier 4.6 - Database (MariaDB replica)] +Targets: ['mariadb_replica'] + +PLAY [Tier 5 - OS package installation (k3s)] +Targets: ['k3s_hosts'] + +PLAY [Tier 5.5 - Kubernetes node operations (labels)] +Targets: ['k3s_servers'] + +PLAY [Tier 6 - OS package configuration (helm/kubectl apply)] +Targets: ['k3s_hosts'] + +STATS +myrddin.prole.org: ok=28 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 + +Ansible Run Ended: 2026-05-14T22:46:55.459098 +Duration: 0:00:01.914584 diff --git a/infrastructure/logs/ansible/20260514-230343-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-230343-morgana-chrisfu.log new file mode 100644 index 0000000..d189d18 --- /dev/null +++ b/infrastructure/logs/ansible/20260514-230343-morgana-chrisfu.log @@ -0,0 +1,58 @@ +Ansible Run Started: 2026-05-14T23:03:43.139519 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l ad_dc --tags samba_dns --ask-vault-pass +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] + +PLAY [Tier 3 - Filesystem mounts (iSCSI)] +Targets: ['iscsi'] + +PLAY [Tier 4 - OS configuration (Pi-hole DNS and resilience)] +Targets: ['pihole'] + +PLAY [Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)] +Targets: ['ad_dc'] +OK: myrddin.prole.org - samba_dns : Assert Samba DNS admin password is set (vault loaded) +OK: myrddin.prole.org - samba_dns : List Samba DNS zones +SKIPPED: myrddin.prole.org - samba_dns : Create DNS zones if missing +OK: myrddin.prole.org - samba_dns : Ensure forward A records (internal RFC1918 hosts and k3s front-door) +OK: myrddin.prole.org - samba_dns : Ensure forward CNAME records + +PLAY [Tier 4 - OS configuration (base linux)] +Targets: ['linux_hosts'] + +PLAY [Tier 4.1 - OS configuration (Prole SSL certs)] +Targets: ['ssl_hosts'] + +PLAY [Tier 4 - OS configuration (console dashboard)] +Targets: ['k3s_hosts'] + +PLAY [Tier 4.5 - Database (MariaDB primary)] +Targets: ['mariadb_primary'] + +PLAY [Tier 4.6 - Database (MariaDB replica)] +Targets: ['mariadb_replica'] + +PLAY [Tier 5 - OS package installation (k3s)] +Targets: ['k3s_hosts'] + +PLAY [Tier 5.5 - Kubernetes node operations (labels)] +Targets: ['k3s_servers'] + +PLAY [Tier 6 - OS package configuration (helm/kubectl apply)] +Targets: ['k3s_hosts'] + +STATS +myrddin.prole.org: ok=28 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 + +Ansible Run Ended: 2026-05-14T23:03:44.606216 +Duration: 0:00:01.466697 diff --git a/infrastructure/logs/ansible/20260514-231604-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-231604-morgana-chrisfu.log new file mode 100644 index 0000000..82c3a4e --- /dev/null +++ b/infrastructure/logs/ansible/20260514-231604-morgana-chrisfu.log @@ -0,0 +1,32 @@ +Ansible Run Started: 2026-05-14T23:16:04.692930 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l ad_dc --tags samba_dns --ask-vault-pass +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] + +PLAY [Tier 3 - Filesystem mounts (iSCSI)] +Targets: ['iscsi'] + +PLAY [Tier 4 - OS configuration (Pi-hole DNS and resilience)] +Targets: ['pihole'] + +PLAY [Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)] +Targets: ['ad_dc'] +OK: myrddin.prole.org - samba_dns : Assert Samba DNS admin password is set (vault loaded) +FAILED: myrddin.prole.org - samba_dns : List Samba DNS zones (ignore_errors=None) +Error: {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3.13"}, "changed": false, "cmd": ["samba-tool", "dns", "zonelist", "127.0.0.1", "-U", "Administrator", "--password=6XirwhGsfx_7g.FEXYXH"], "delta": "0:00:00.192015", "end": "2026-05-14 23:16:05.765290", "msg": "non-zero return code", "rc": 255, "start": "2026-05-14 23:16:05.573275", "stderr": "WARNING: Using passwords on command line is insecure. Installing the setproctitle python module will hide these from shortly after program start.\ncli_credentials_failed_kerberos_login: krb5_cc_get_principal failed: No such file or directory\nFailed to bind to uuid 50abc2a4-574d-40b3-9d66-ee4fd5fba076 for ncacn_ip_tcp:127.0.0.1[49153,sign,abstract_syntax=50abc2a4-574d-40b3-9d66-ee4fd5fba076/0x00000005,localaddress=127.0.0.1] NT_STATUS_LOGON_FAILURE\nERROR: Connecting to DNS RPC server 127.0.0.1 failed with (3221225581, 'The attempted logon is invalid. This is either due to a bad username or authentication information.')", "stderr_lines": ["WARNING: Using passwords on command line is insecure. Installing the setproctitle python module will hide these from shortly after program start.", "cli_credentials_failed_kerberos_login: krb5_cc_get_principal failed: No such file or directory", "Failed to bind to uuid 50abc2a4-574d-40b3-9d66-ee4fd5fba076 for ncacn_ip_tcp:127.0.0.1[49153,sign,abstract_syntax=50abc2a4-574d-40b3-9d66-ee4fd5fba076/0x00000005,localaddress=127.0.0.1] NT_STATUS_LOGON_FAILURE", "ERROR: Connecting to DNS RPC server 127.0.0.1 failed with (3221225581, 'The attempted logon is invalid. This is either due to a bad username or authentication information.')"], "stdout": "", "stdout_lines": []} + +STATS +myrddin.prole.org: ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +Ansible Run Ended: 2026-05-14T23:16:05.816069 +Duration: 0:00:01.123139 diff --git a/infrastructure/logs/ansible/20260514-231850-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-231850-morgana-chrisfu.log new file mode 100644 index 0000000..87d7261 --- /dev/null +++ b/infrastructure/logs/ansible/20260514-231850-morgana-chrisfu.log @@ -0,0 +1,58 @@ +Ansible Run Started: 2026-05-14T23:18:50.388721 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l ad_dc --tags samba_dns --ask-vault-pass +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] + +PLAY [Tier 3 - Filesystem mounts (iSCSI)] +Targets: ['iscsi'] + +PLAY [Tier 4 - OS configuration (Pi-hole DNS and resilience)] +Targets: ['pihole'] + +PLAY [Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)] +Targets: ['ad_dc'] +OK: myrddin.prole.org - samba_dns : Assert Samba DNS admin password is set (vault loaded) +OK: myrddin.prole.org - samba_dns : List Samba DNS zones +SKIPPED: myrddin.prole.org - samba_dns : Create DNS zones if missing +OK: myrddin.prole.org - samba_dns : Ensure forward A records (internal RFC1918 hosts and k3s front-door) +OK: myrddin.prole.org - samba_dns : Ensure forward CNAME records + +PLAY [Tier 4 - OS configuration (base linux)] +Targets: ['linux_hosts'] + +PLAY [Tier 4.1 - OS configuration (Prole SSL certs)] +Targets: ['ssl_hosts'] + +PLAY [Tier 4 - OS configuration (console dashboard)] +Targets: ['k3s_hosts'] + +PLAY [Tier 4.5 - Database (MariaDB primary)] +Targets: ['mariadb_primary'] + +PLAY [Tier 4.6 - Database (MariaDB replica)] +Targets: ['mariadb_replica'] + +PLAY [Tier 5 - OS package installation (k3s)] +Targets: ['k3s_hosts'] + +PLAY [Tier 5.5 - Kubernetes node operations (labels)] +Targets: ['k3s_servers'] + +PLAY [Tier 6 - OS package configuration (helm/kubectl apply)] +Targets: ['k3s_hosts'] + +STATS +myrddin.prole.org: ok=28 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 + +Ansible Run Ended: 2026-05-14T23:18:51.752632 +Duration: 0:00:01.363911 diff --git a/infrastructure/logs/ansible/20260514-235224-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-235224-morgana-chrisfu.log new file mode 100644 index 0000000..ded47be --- /dev/null +++ b/infrastructure/logs/ansible/20260514-235224-morgana-chrisfu.log @@ -0,0 +1,14 @@ +Ansible Run Started: 2026-05-14T23:52:24.278689 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l pihole --tags pihole +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] diff --git a/infrastructure/logs/ansible/20260514-235400-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-235400-morgana-chrisfu.log new file mode 100644 index 0000000..ecb4503 --- /dev/null +++ b/infrastructure/logs/ansible/20260514-235400-morgana-chrisfu.log @@ -0,0 +1,74 @@ +Ansible Run Started: 2026-05-14T23:54:00.871501 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l pihole --tags pihole --vault-password-file /Users/chrisfu/dev/prole/.vault_pass +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] + +PLAY [Tier 3 - Filesystem mounts (iSCSI)] +Targets: ['iscsi'] + +PLAY [Tier 4 - OS configuration (Pi-hole DNS and resilience)] +Targets: ['pihole'] +OK: pi.prole.org - Gather minimal facts +OK: raspberry.prole.org - Gather minimal facts +OK: pi.prole.org - pihole_dns : Ensure dnsmasq.d exists +OK: raspberry.prole.org - pihole_dns : Ensure dnsmasq.d exists +OK: pi.prole.org - pihole_dns : Configure dns-forward-max +OK: raspberry.prole.org - pihole_dns : Configure dns-forward-max +OK: pi.prole.org - pihole_dns : Configure Pi-hole forwarding for Samba AD + reverse zone +OK: raspberry.prole.org - pihole_dns : Configure Pi-hole forwarding for Samba AD + reverse zone +OK: pi.prole.org - pihole_dns : Read current Pi-hole FTL DB journal mode (WAL?) +OK: raspberry.prole.org - pihole_dns : Read current Pi-hole FTL DB journal mode (WAL?) +OK: pi.prole.org - pihole_dns : Parse current journal mode (safe default) +OK: raspberry.prole.org - pihole_dns : Parse current journal mode (safe default) +OK: pi.prole.org - pihole_dns : Determine whether WAL update is needed +OK: raspberry.prole.org - pihole_dns : Determine whether WAL update is needed +SKIPPED: pi.prole.org - pihole_dns : Stop pihole-FTL before switching SQLite journal mode +SKIPPED: raspberry.prole.org - pihole_dns : Stop pihole-FTL before switching SQLite journal mode +SKIPPED: pi.prole.org - pihole_dns : Set SQLite journal_mode=WAL +SKIPPED: raspberry.prole.org - pihole_dns : Set SQLite journal_mode=WAL +SKIPPED: pi.prole.org - pihole_dns : Start pihole-FTL after switching SQLite journal mode +SKIPPED: raspberry.prole.org - pihole_dns : Start pihole-FTL after switching SQLite journal mode + +PLAY [Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)] +Targets: ['ad_dc'] + +PLAY [Tier 4 - OS configuration (base linux)] +Targets: ['linux_hosts'] + +PLAY [Tier 4.1 - OS configuration (Prole SSL certs)] +Targets: ['ssl_hosts'] + +PLAY [Tier 4 - OS configuration (console dashboard)] +Targets: ['k3s_hosts'] + +PLAY [Tier 4.5 - Database (MariaDB primary)] +Targets: ['mariadb_primary'] + +PLAY [Tier 4.6 - Database (MariaDB replica)] +Targets: ['mariadb_replica'] + +PLAY [Tier 5 - OS package installation (k3s)] +Targets: ['k3s_hosts'] + +PLAY [Tier 5.5 - Kubernetes node operations (labels)] +Targets: ['k3s_servers'] + +PLAY [Tier 6 - OS package configuration (helm/kubectl apply)] +Targets: ['k3s_hosts'] + +STATS +pi.prole.org: ok=7 changed=0 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0 +raspberry.prole.org: ok=7 changed=0 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0 + +Ansible Run Ended: 2026-05-14T23:55:44.737826 +Duration: 0:01:43.866325 diff --git a/infrastructure/logs/ansible/20260514-235731-morgana-chrisfu.log b/infrastructure/logs/ansible/20260514-235731-morgana-chrisfu.log new file mode 100644 index 0000000..5595709 --- /dev/null +++ b/infrastructure/logs/ansible/20260514-235731-morgana-chrisfu.log @@ -0,0 +1,58 @@ +Ansible Run Started: 2026-05-14T23:57:31.479796 +User: chrisfu +Machine: morgana +Command: /opt/homebrew/bin/ansible-playbook playbooks/site.yml -i inventory/hosts.ini -l ad_dc --tags samba_dns --vault-password-file /Users/chrisfu/dev/prole/.vault_pass +---------------------------------------- + +PLAY [Tier 1 - Boot / kernel (cgroups)] +Targets: ['k3s_hosts'] + +PLAY [Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)] +Targets: ['myrddin.prole.org'] + +PLAY [Tier 2 - Storage (iSCSI auth/login)] +Targets: ['iscsi'] + +PLAY [Tier 3 - Filesystem mounts (iSCSI)] +Targets: ['iscsi'] + +PLAY [Tier 4 - OS configuration (Pi-hole DNS and resilience)] +Targets: ['pihole'] + +PLAY [Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)] +Targets: ['ad_dc'] +OK: myrddin.prole.org - samba_dns : Assert Samba DNS admin password is set (vault loaded) +OK: myrddin.prole.org - samba_dns : List Samba DNS zones +SKIPPED: myrddin.prole.org - samba_dns : Create DNS zones if missing +OK: myrddin.prole.org - samba_dns : Ensure forward A records (internal RFC1918 hosts and k3s front-door) +OK: myrddin.prole.org - samba_dns : Ensure forward CNAME records + +PLAY [Tier 4 - OS configuration (base linux)] +Targets: ['linux_hosts'] + +PLAY [Tier 4.1 - OS configuration (Prole SSL certs)] +Targets: ['ssl_hosts'] + +PLAY [Tier 4 - OS configuration (console dashboard)] +Targets: ['k3s_hosts'] + +PLAY [Tier 4.5 - Database (MariaDB primary)] +Targets: ['mariadb_primary'] + +PLAY [Tier 4.6 - Database (MariaDB replica)] +Targets: ['mariadb_replica'] + +PLAY [Tier 5 - OS package installation (k3s)] +Targets: ['k3s_hosts'] + +PLAY [Tier 5.5 - Kubernetes node operations (labels)] +Targets: ['k3s_servers'] + +PLAY [Tier 6 - OS package configuration (helm/kubectl apply)] +Targets: ['k3s_hosts'] + +STATS +myrddin.prole.org: ok=28 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 + +Ansible Run Ended: 2026-05-14T23:57:32.974604 +Duration: 0:00:01.494808 diff --git a/infrastructure/playbooks/pihole_flush_dns.yml b/infrastructure/playbooks/pihole_flush_dns.yml new file mode 100644 index 0000000..cffcbcc --- /dev/null +++ b/infrastructure/playbooks/pihole_flush_dns.yml @@ -0,0 +1,34 @@ +--- +# pihole_flush_dns.yml +# Flush and reload DNS on all Pi-hole instances in sequence. +# Runs serially (serial: 1) so one resolver is always available. +# +# Usage: +# ansible-playbook -i inventory/hosts.ini playbooks/pihole_flush_dns.yml +# ansible-playbook -i inventory/hosts.ini playbooks/pihole_flush_dns.yml --limit pi.prole.org + +- name: Flush and reload Pi-hole DNS cache + hosts: pihole + serial: 1 # one at a time — keep a resolver up at all times + become: true + gather_facts: false + + tasks: + - name: Flush cache and reload lists (Pi-hole v6+) + command: pihole reloaddns + register: pihole_reload + changed_when: true + + - name: Show pihole reloaddns output + debug: + msg: "{{ pihole_reload.stdout_lines }}" + when: pihole_reload.stdout_lines | length > 0 + + - name: Verify pihole-FTL is running + command: pihole status + register: pihole_status + changed_when: false + + - name: Show Pi-hole status + debug: + msg: "{{ pihole_status.stdout_lines }}"