---
- name: Assert Samba DNS admin password is set (vault loaded)
  ansible.builtin.assert:
    that:
      - samba_dns_admin_pass is defined
      - samba_dns_admin_pass | length > 0
    fail_msg: "Missing samba_dns_admin_pass. Create inventory/group_vars/ad_dc.vault.yml with vault_samba_dns_admin_pass."

- name: List Samba DNS zones
  ansible.builtin.command:
    cmd: samba-tool dns zonelist {{ samba_dns_server }} -U Administrator --password={{ samba_dns_admin_pass }}
  register: samba_zones
  changed_when: false
  tags: [samba, samba_reverse_dns]

# The reverse-zone list is computed inline in the loop below rather than via a
# separate set_fact. A set_fact must carry the same tags as the tasks that
# consume it, or tag-filtered runs (e.g. --tags samba_reverse_dns) skip it and
# leave the variable undefined. Inlining removes that cross-task dependency so
# the role is correct under any tag selection.
- name: Create reverse DNS zones if missing
  ansible.builtin.command:
    cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ reverse_zone }} -U Administrator --password={{ samba_dns_admin_pass }}
  loop: "{{ ([lan_reverse_zone] + (k3s_reverse_zones | default([]))) | unique }}"
  loop_control:
    loop_var: reverse_zone
  when: reverse_zone not in samba_zones.stdout
  tags: [samba, samba_reverse_dns]

- name: Ensure minimum PTR records (DC + Pi-holes)
  ansible.builtin.include_tasks: ensure_ptr.yml
  loop: "{{ ptr_records | default([]) }}"
  tags: [samba, samba_reverse_dns]