mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
9b0005aa4c
The AD DC's smb.conf set no `interfaces` / `bind interfaces only`, so Samba
bound to — and samba_dnsupdate registered into DNS — every interface on the
host. On myrddin that meant the Docker bridge (172.17.0.1) and k3s/flannel
CNI addresses (10.42.0.0, 10.42.0.1) were published as A records for both the
prole.org apex and `myrddin`, alongside the real 10.0.0.3. Clients then
round-robined onto unroutable addresses, producing the long-standing
"resolves, then doesn't" internal DNS flakiness.
Confine Samba to loopback + the LAN service IP:
interfaces = lo 10.0.0.3
bind interfaces only = yes
This scopes both service binding and DNS self-registration to the real
address, so the junk records stop being (re)created on restart.
- smb.conf.j2: emit the two directives, gated on bind-interfaces-only being
enabled AND a non-loopback IP being present (empty -> directives omitted,
never binds loopback-only by accident).
- defaults: samba_ad_dc_lan_ip ("" by default), samba_ad_dc_bind_interfaces_only
(true), samba_ad_dc_interfaces (lo + lan_ip), all documented.
- tasks: assert samba_ad_dc_lan_ip is non-empty before deploying smb.conf
when bind-interfaces-only is on, so a missing value fails fast instead of
rendering the DC unreachable.
- group_vars/ad_dc: set samba_ad_dc_lan_ip=10.0.0.3 (myrddin's LAN address).
Deploying notifies the existing Restart samba-ad-dc handler. Pre-existing junk
records must be deleted once by hand; they will not be re-registered after the
restart. Template rendering verified for both the set and empty-IP cases.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
15 lines
544 B
YAML
15 lines
544 B
YAML
---
|
|
samba_dns_server: "127.0.0.1"
|
|
samba_dns_admin_user: "administrator@PROLE.ORG"
|
|
|
|
# myrddin's stable LAN service address. Scopes Samba service binding and
|
|
# samba_dnsupdate DNS registration to this IP only, so Docker/k3s interface IPs
|
|
# (172.17.x, 10.42.x) no longer pollute the prole.org zone. If a future child
|
|
# DC joins ad_dc with a different address, move this to host_vars instead.
|
|
samba_ad_dc_lan_ip: "10.0.0.3"
|
|
|
|
# We'll wire the password with vault next
|
|
samba_dns_admin_pass: "{{ vault_samba_dns_admin_pass }}"
|
|
|
|
rsyslog_role: receiver
|