fix(samba_ad_dc): bind to LAN IP only so the DC stops registering junk DNS

The AD DC's smb.conf set no `interfaces` / `bind interfaces only`, so Samba
bound to — and samba_dnsupdate registered into DNS — every interface on the
host. On myrddin that meant the Docker bridge (172.17.0.1) and k3s/flannel
CNI addresses (10.42.0.0, 10.42.0.1) were published as A records for both the
prole.org apex and `myrddin`, alongside the real 10.0.0.3. Clients then
round-robined onto unroutable addresses, producing the long-standing
"resolves, then doesn't" internal DNS flakiness.

Confine Samba to loopback + the LAN service IP:

  interfaces = lo 10.0.0.3
  bind interfaces only = yes

This scopes both service binding and DNS self-registration to the real
address, so the junk records stop being (re)created on restart.

  - smb.conf.j2: emit the two directives, gated on bind-interfaces-only being
    enabled AND a non-loopback IP being present (empty -> directives omitted,
    never binds loopback-only by accident).
  - defaults: samba_ad_dc_lan_ip ("" by default), samba_ad_dc_bind_interfaces_only
    (true), samba_ad_dc_interfaces (lo + lan_ip), all documented.
  - tasks: assert samba_ad_dc_lan_ip is non-empty before deploying smb.conf
    when bind-interfaces-only is on, so a missing value fails fast instead of
    rendering the DC unreachable.
  - group_vars/ad_dc: set samba_ad_dc_lan_ip=10.0.0.3 (myrddin's LAN address).

Deploying notifies the existing Restart samba-ad-dc handler. Pre-existing junk
records must be deleted once by hand; they will not be re-registered after the
restart. Template rendering verified for both the set and empty-IP cases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infrastructure/inventory/group_vars/ad_dc/vars.yml

@@ -2,6 +2,12 @@
 samba_dns_server: "127.0.0.1"
 samba_dns_admin_user: "administrator@PROLE.ORG"
 
+# myrddin's stable LAN service address. Scopes Samba service binding and
+# samba_dnsupdate DNS registration to this IP only, so Docker/k3s interface IPs
+# (172.17.x, 10.42.x) no longer pollute the prole.org zone. If a future child
+# DC joins ad_dc with a different address, move this to host_vars instead.
+samba_ad_dc_lan_ip: "10.0.0.3"
+
 # We'll wire the password with vault next
 samba_dns_admin_pass: "{{ vault_samba_dns_admin_pass }}"
 

infrastructure/roles/samba_ad_dc/defaults/main.yml

@@ -6,6 +6,23 @@ samba_ad_dc_dns_forwarders:
   - 10.0.0.5
   - 10.0.0.4
 
+# --- Interface / DNS-registration scoping ---
+# A Samba AD DC runs samba_dnsupdate on startup (and periodically), which
+# registers an A record for the DC hostname and the realm apex for EVERY IP it
+# is bound to. On a multi-homed host (Docker bridge 172.17.0.1, k3s/flannel
+# 10.42.0.0 / 10.42.0.1, etc.) those junk IPs land in the prole.org zone and
+# get round-robined to clients, producing intermittent "resolves, then doesn't"
+# DNS failures. Binding Samba to loopback + the LAN IP only confines both
+# service binding and DNS registration to the real service address.
+#
+# samba_ad_dc_lan_ip MUST be the DC's stable LAN service address. It is left
+# empty here and set per host (see inventory/group_vars/ad_dc/vars.yml); the
+# role asserts it is non-empty before enabling bind-interfaces-only, so a
+# missing value can never silently bind the DC to loopback alone (unreachable).
+samba_ad_dc_lan_ip: ""
+samba_ad_dc_bind_interfaces_only: true
+samba_ad_dc_interfaces: "{{ ['lo'] + ([samba_ad_dc_lan_ip] if (samba_ad_dc_lan_ip | length > 0) else []) }}"
+
 # Identity
 # When samba_ad_dc_child_id is set (e.g., A000001), the realm/workgroup/netbios
 # will be derived automatically as a child of samba_ad_dc_parent_realm.

infrastructure/roles/samba_ad_dc/tasks/main.yml

@@ -40,6 +40,16 @@
           --username='{{ samba_ad_dc_parent_netbios }}\\Administrator'
   when: not samba_ad_provisioned.stat.exists
 
+- name: Assert LAN IP is set before binding to specific interfaces
+  ansible.builtin.assert:
+    that:
+      - samba_ad_dc_lan_ip | length > 0
+    fail_msg: >-
+      samba_ad_dc_bind_interfaces_only is enabled but samba_ad_dc_lan_ip is empty.
+      Set the DC's LAN service IP (see inventory/group_vars/ad_dc/vars.yml) so
+      Samba does not bind to loopback only and make the DC unreachable.
+  when: samba_ad_dc_bind_interfaces_only | bool
+
 - name: Deploy smb.conf
   ansible.builtin.template:
     src: smb.conf.j2

infrastructure/roles/samba_ad_dc/templates/smb.conf.j2

@@ -1,6 +1,14 @@
 # Global parameters
 [global]
         dns forwarder = {{ samba_ad_dc_dns_forwarders | join(' ') }}
+{% if samba_ad_dc_bind_interfaces_only and (samba_ad_dc_interfaces | reject('equalto', 'lo') | list | length) > 0 %}
+
+        # Confine service binding AND samba_dnsupdate registration to loopback +
+        # the LAN IP. Prevents the DC from registering Docker/CNI interface IPs
+        # (172.17.x, 10.42.x) into the AD DNS zone. See roles/samba_ad_dc/defaults.
+        interfaces = {{ samba_ad_dc_interfaces | join(' ') }}
+        bind interfaces only = yes
+{% endif %}
 
         netbios name = {{ (samba_ad_dc_netbios_name | default(inventory_hostname_short)) | upper }}
         realm = {{ samba_ad_dc_realm }}