Configure Ansible to run from project root and improve vault integration: Added root ansible.cfg, updated infrastructure/ansible.cfg, added etc/init_ansible.sh, and updated ad_dc.yml for vault integration.

ansible.cfg

@@ -0,0 +1,18 @@
+[defaults]
+inventory = infrastructure/inventory/hosts.ini
+roles_path = infrastructure/roles
+collections_paths = infrastructure/collections
+interpreter_python = auto_silent
+stdout_callback = default
+result_format = yaml
+forks = 20
+timeout = 30
+host_key_checking = True
+
+[privilege_escalation]
+become = True
+become_method = sudo
+become_ask_pass = False
+
+[ssh_connection]
+pipelining = True

etc/init_ansible.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# init_ansible.sh
+# Purpose:
+# - Initialize or update the Ansible vault password file (.vault_pass)
+# - Should be run after init_openbao.sh
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+PROLE_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
+VAULT_PASS_FILE="$PROLE_ROOT/.vault_pass"
+
+ACTION=${1:-initialize}
+
+case "$ACTION" in
+    initialize|update)
+        # Use PROLE_PASSWD if set, otherwise prompt
+        if [[ -n "${PROLE_PASSWD:-}" ]]; then
+            echo "Using PROLE_PASSWD for Ansible Vault password."
+            echo "$PROLE_PASSWD" > "$VAULT_PASS_FILE"
+        else
+            echo -n "Enter Ansible Vault password: "
+            read -rs vault_pass
+            echo
+            echo "$vault_pass" > "$VAULT_PASS_FILE"
+        fi
+
+        chmod 600 "$VAULT_PASS_FILE"
+        echo "Ansible Vault password file $ACTION""d at $VAULT_PASS_FILE"
+        ;;
+    *)
+        echo "Usage: $0 {initialize|update}" >&2
+        exit 2
+        ;;
+esac

infrastructure/ansible.cfg

@@ -1,4 +1,6 @@
 [defaults]
+# Note: When running from the project root, the root ansible.cfg is used.
+# This file is for running ansible-playbook from within the infrastructure/ directory.
 inventory = inventory/hosts.ini
 roles_path = roles
 collections_paths = collections

infrastructure/inventory/group_vars/ad_dc.yml

@@ -3,6 +3,6 @@ samba_dns_server: "myrddin.prole.org"
 samba_dns_admin_user: "administrator"
 
 # We'll wire the password with vault next
-samba_dns_admin_pass: "6XirwhGsfx_7g.FEXYXH"
+samba_dns_admin_pass: "{{ vault_samba_dns_admin_pass }}"
 
 rsyslog_role: receiver