chore(vault): add WinRM passwords for morgoth (chrisfu) and fairyland (minecraft)

vault_winrm_password_morgoth and vault_winrm_password_fairyland stored for
Ansible WinRM auth to Windows GPU workstations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/inventory/group_vars/all/prole_vault.yml

@@ -1,16 +1,21 @@
 $ANSIBLE_VAULT;1.1;AES256
-66323461303462653037626532663132336638373963376464316634313765656562386639633934
-6536623735393332373261313461363736316663663366630a346331653237346564303036626237
-66356630313138363064633536653539353834613131383761653938383233393761303863656663
-6238646266313162640a353335393138313231656235353138343335653330336261666338326539
-37656339643965383330363966653239663663613836353462363535323361323835373738323638
-35303461626635353465333334323037336534343661633662343738663238316364613537646165
-65373334383538363438343237636433306633356563613335313335633061633231373038353035
-65623833363561333530656335383136623936303132646231346531383365336539643762353862
-32343064343665643833386133616362623137636530303535353934353332626436316235333965
-66313836653361366266623731613830396337653964303362363964393561316366313334326439
-37623061623736666262373566666236613034393038343331363632636234396265396261663461
-66346633363062616462643064303736643930383732363630396666303232393833623832313532
-38303662346461643134393532373162363534386530323930336164613865653633663462383264
-39343062303433373463353431613032313731303030356331656163346166633264643436343735
-313334356636356666383536353936666566
+30363730373465623032383739333039376234373335323733663564393165383863633737383536
+6433333437656637323232306430346539633836646330620a343430623664326266616535313166
+34343763646338343834613036386432656435623338626436623334306332616137663438336436
+3439343837666534340a393234363233363365366431366665303861383138656535316438616665
+65363930646332323935393733653438656135313434623264633864633330643939396239636636
+32356636383132646433386662363463313064356634666232326339323864336464353230616436
+38643165363135303733356466653766636533653563366366616663316261663063643961623434
+33613633353335323063633830653033633432376362316237356639343962383731636135653938
+35346531323638656664646435316462376239626439623764396339613164393137386236616539
+31333335313735643366393065396632313161616631393733633136613434356233333239393566
+39666263633433313432323034633831363666343663396564636566356637353861366439393364
+66386334366564396163306136373765396436376632633236316261356664353035393134613334
+30383365663831666661376333663365376461363766366334656330376564333639313132383664
+32323966343036313933333437623935616465356239666165373666373562666264373766663465
+38343265313630653339663361363761313435653338643237623436623766613661376430383935
+37373035353234313236636631353534613831383630343462373063653165386231363132323137
+66383864633364356336333337623934396466633537636166643161323863313332623563303131
+64613866333237623839306365363637613962353531353461653965363332646532636236336461
+65646230626366313436646332343462616662656166343732336230373666363432613030613831
+37313038356134353737

infrastructure/roles/pihole_dns/tasks/main.yml

@@ -23,7 +23,7 @@
     mode: "0644"
   notify: restart pihole-FTL
 
-- name: Configure knoe.dev GKE service records (LAN split-horizon)
+- name: Configure knoe.dev GKE service records (dnsmasq fallback)
   ansible.builtin.template:
     src: 06-knoe-dev.conf.j2
     dest: /etc/dnsmasq.d/06-knoe-dev.conf
@@ -32,6 +32,21 @@
     mode: "0644"
   notify: restart pihole-FTL
 
+- name: Register knoe.dev GKE records in Pi-hole 6 dns.hosts (native override)
+  # Pi-hole 6 uses pihole-FTL's internal dns.hosts for local records.
+  # dnsmasq address= directives work for some domains but Pi-hole 6 may
+  # serve cached upstream answers over them; dns.hosts always wins.
+  ansible.builtin.shell: |
+    # Build the hosts array: preserve existing non-knoe entries + add ours
+    CURRENT=$(pihole-FTL --config dns.hosts 2>/dev/null | tr -d '[]' | tr ',' '\n' | grep -v '0.knoe.dev' | grep -v '^$' | sed 's/^ *//' | sed 's/ *$//')
+    NEW_ENTRIES="{% for r in knoe_dev_dns_records %}{{ r.ip }} {{ r.name }}{% if not loop.last %}\n{% endif %}{% endfor %}"
+    ALL=$(printf '%s\n%s' "$CURRENT" "$(printf '%b' "$NEW_ENTRIES")" | grep -v '^$' | sort -u)
+    JSON=$(echo "$ALL" | awk '{print "\"" $0 "\""}' | paste -sd ',' | sed 's/^/[/;s/$/]/')
+    pihole-FTL --config dns.hosts "$JSON"
+    pihole reloaddns
+  register: pihole_hosts_result
+  changed_when: true
+
 - name: Read current Pi-hole FTL DB journal mode (WAL?)
   ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode;"
   register: pihole_journal