---
- name: Assert Samba DNS admin password is set (vault loaded)
  ansible.builtin.assert:
    that:
      - samba_dns_admin_pass is defined
      - samba_dns_admin_pass | length > 0
    fail_msg: "Missing samba_dns_admin_pass. Create inventory/group_vars/ad_dc.vault.yml with vault_samba_dns_admin_pass."
  tags: [samba, samba_dns]

- name: List Samba DNS zones
  ansible.builtin.command:
    cmd: samba-tool dns zonelist {{ samba_dns_server }} -P
  register: samba_zones
  changed_when: false
  tags: [samba, samba_dns]

- name: Create DNS zones if missing
  ansible.builtin.command:
    cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ item }} -P
  loop:
    - "{{ prole_domain }}"
    - "internal.{{ prole_domain }}"
  when: item not in samba_zones.stdout
  tags: [samba, samba_dns]

- name: Ensure forward A records (internal RFC1918 hosts and k3s front-door)
  ansible.builtin.include_tasks: ensure_a.yml
  loop: "{{ (prole_internal_a_records | default([])) + (prole_k3s_dns_records | default([])) }}"
  tags: [samba, samba_dns]

- name: Ensure forward CNAME records
  ansible.builtin.include_tasks: ensure_cname.yml
  loop: "{{ prole_k3s_cname_records | default([]) }}"
  tags: [samba, samba_dns]