fix(samba_dns): use admin credentials instead of machine Kerberos (-P)

All samba-tool dns commands were using -P (machine account Kerberos) which
silently failed with no error — tasks reported changed=0 but records were
never written. Switch to -U Administrator --password={{ samba_dns_admin_pass }}
which uses the vault-protected admin credentials that were already defined
but never wired up.

Also fix regex patterns in record parsers: samba-tool output uses `A: IP`
and `PTR: fqdn` format, not `A IP` / `PTR fqdn` (space-separated), so
updated regex_findall patterns to match `TYPE:\s+value`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/roles/samba_dns/tasks/ensure_a.yml

@@ -12,7 +12,8 @@
 
 - name: Query existing A records
   ansible.builtin.command:
-    cmd: samba-tool dns query {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A -P
+    cmd: samba-tool dns query {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A
+      -U Administrator --password={{ samba_dns_admin_pass }}
   register: a_query
   changed_when: false
   failed_when: false
@@ -22,13 +23,14 @@
     a_existing_values: >-
       {{
         (a_query.stdout | default('') |
-         regex_findall('\\bA\\s+([0-9]{1,3}(?:\\.[0-9]{1,3}){3})\\b') |
+         regex_findall('\\bA:\\s+([0-9]{1,3}(?:\\.[0-9]{1,3}){3})\\b') |
          list)
       }}
 
 - name: Remove stale A records
   ansible.builtin.command:
-    cmd: samba-tool dns delete {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A {{ a_value }} -P
+    cmd: samba-tool dns delete {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A {{ a_value }}
+      -U Administrator --password={{ samba_dns_admin_pass }}
   loop: "{{ a_existing_values | difference(item.ipv4s) }}"
   loop_control:
     loop_var: a_value
@@ -36,7 +38,8 @@
 
 - name: Add missing A records
   ansible.builtin.command:
-    cmd: samba-tool dns add {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A {{ a_target_ip }} -P
+    cmd: samba-tool dns add {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A {{ a_target_ip }}
+      -U Administrator --password={{ samba_dns_admin_pass }}
   register: a_add
   changed_when: a_add.rc == 0
   failed_when: >

infrastructure/roles/samba_dns/tasks/ensure_cname.yml

@@ -12,7 +12,8 @@
 
 - name: Query existing CNAME records
   ansible.builtin.command:
-    cmd: samba-tool dns query {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} CNAME -P
+    cmd: samba-tool dns query {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} CNAME
+      -U Administrator --password={{ samba_dns_admin_pass }}
   register: cname_query
   changed_when: false
   failed_when: false
@@ -22,20 +23,22 @@
     cname_existing_value: >-
       {{
         (cname_query.stdout | default('') |
-         regex_findall('\\bCNAME\\s+([a-zA-Z0-9.-]+)\\b') |
+         regex_findall('\\bCNAME:\\s+([a-zA-Z0-9.-]+)\\b') |
          first | default(''))
       }}
 
 - name: Remove stale CNAME record
   ansible.builtin.command:
-    cmd: samba-tool dns delete {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} CNAME {{ cname_existing_value }} -P
+    cmd: samba-tool dns delete {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} CNAME {{ cname_existing_value }}
+      -U Administrator --password={{ samba_dns_admin_pass }}
   when:
     - cname_existing_value | length > 0
     - cname_existing_value != item.target
 
 - name: Add missing CNAME record
   ansible.builtin.command:
-    cmd: samba-tool dns add {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} CNAME {{ item.target }} -P
+    cmd: samba-tool dns add {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} CNAME {{ item.target }}
+      -U Administrator --password={{ samba_dns_admin_pass }}
   register: cname_add
   changed_when: cname_add.rc == 0
   failed_when: >

infrastructure/roles/samba_dns/tasks/main.yml

@@ -9,14 +9,14 @@
 
 - name: List Samba DNS zones
   ansible.builtin.command:
-    cmd: samba-tool dns zonelist {{ samba_dns_server }} -P
+    cmd: samba-tool dns zonelist {{ samba_dns_server }} -U Administrator --password={{ samba_dns_admin_pass }}
   register: samba_zones
   changed_when: false
   tags: [samba, samba_dns]
 
 - name: Create DNS zones if missing
   ansible.builtin.command:
-    cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ item }} -P
+    cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ item }} -U Administrator --password={{ samba_dns_admin_pass }}
   loop:
     - "{{ prole_domain }}"
     - "internal.{{ prole_domain }}"

infrastructure/roles/samba_reverse_dns/tasks/ensure_ptr.yml

@@ -1,7 +1,7 @@
 ---
 - name: Query existing PTR records
   ansible.builtin.command:
-    cmd: samba-tool dns query {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR -P
+    cmd: samba-tool dns query {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR -U Administrator --password={{ samba_dns_admin_pass }}
   register: ptr_query
   changed_when: false
   failed_when: false
@@ -11,14 +11,14 @@
     ptr_existing_values: >-
       {{
         (ptr_query.stdout | default('') |
-         regex_findall('PTR\\s+([A-Za-z0-9.-]+)\\.?') |
+         regex_findall('PTR:\\s+([A-Za-z0-9.-]+)\\.?') |
          map('regex_replace', '\\.$', '') |
          list)
       }}
 
 - name: Remove stale PTR records
   ansible.builtin.command:
-    cmd: samba-tool dns delete {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ ptr_value }} -P
+    cmd: samba-tool dns delete {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ ptr_value }} -U Administrator --password={{ samba_dns_admin_pass }}
   loop: "{{ ptr_existing_values | reject('equalto', item.fqdn) | list }}"
   loop_control:
     loop_var: ptr_value
@@ -26,7 +26,7 @@
 
 - name: Add expected PTR record
   ansible.builtin.command:
-    cmd: samba-tool dns add {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ item.fqdn }} -P
+    cmd: samba-tool dns add {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ item.fqdn }} -U Administrator --password={{ samba_dns_admin_pass }}
   register: ptr_add
   changed_when: ptr_add.rc == 0
   failed_when: >

infrastructure/roles/samba_reverse_dns/tasks/main.yml

@@ -8,7 +8,7 @@
 
 - name: List Samba DNS zones
   ansible.builtin.command:
-    cmd: samba-tool dns zonelist {{ samba_dns_server }} -P
+    cmd: samba-tool dns zonelist {{ samba_dns_server }} -U Administrator --password={{ samba_dns_admin_pass }}
   register: samba_zones
   changed_when: false
   tags: [samba, samba_reverse_dns]
@@ -20,7 +20,7 @@
 
 - name: Create reverse DNS zones if missing
   ansible.builtin.command:
-    cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ reverse_zone }} -P
+    cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ reverse_zone }} -U Administrator --password={{ samba_dns_admin_pass }}
   loop: "{{ samba_reverse_zones }}"
   loop_control:
     loop_var: reverse_zone