mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:54:34 +00:00
9b0005aa4c
The AD DC's smb.conf set no `interfaces` / `bind interfaces only`, so Samba
bound to — and samba_dnsupdate registered into DNS — every interface on the
host. On myrddin that meant the Docker bridge (172.17.0.1) and k3s/flannel
CNI addresses (10.42.0.0, 10.42.0.1) were published as A records for both the
prole.org apex and `myrddin`, alongside the real 10.0.0.3. Clients then
round-robined onto unroutable addresses, producing the long-standing
"resolves, then doesn't" internal DNS flakiness.
Confine Samba to loopback + the LAN service IP:
interfaces = lo 10.0.0.3
bind interfaces only = yes
This scopes both service binding and DNS self-registration to the real
address, so the junk records stop being (re)created on restart.
- smb.conf.j2: emit the two directives, gated on bind-interfaces-only being
enabled AND a non-loopback IP being present (empty -> directives omitted,
never binds loopback-only by accident).
- defaults: samba_ad_dc_lan_ip ("" by default), samba_ad_dc_bind_interfaces_only
(true), samba_ad_dc_interfaces (lo + lan_ip), all documented.
- tasks: assert samba_ad_dc_lan_ip is non-empty before deploying smb.conf
when bind-interfaces-only is on, so a missing value fails fast instead of
rendering the DC unreachable.
- group_vars/ad_dc: set samba_ad_dc_lan_ip=10.0.0.3 (myrddin's LAN address).
Deploying notifies the existing Restart samba-ad-dc handler. Pre-existing junk
records must be deleted once by hand; they will not be re-registered after the
restart. Template rendering verified for both the set and empty-IP cases.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
1.3 KiB
Django/Jinja
30 lines
1.3 KiB
Django/Jinja
# Global parameters
|
|
[global]
|
|
dns forwarder = {{ samba_ad_dc_dns_forwarders | join(' ') }}
|
|
{% if samba_ad_dc_bind_interfaces_only and (samba_ad_dc_interfaces | reject('equalto', 'lo') | list | length) > 0 %}
|
|
|
|
# Confine service binding AND samba_dnsupdate registration to loopback +
|
|
# the LAN IP. Prevents the DC from registering Docker/CNI interface IPs
|
|
# (172.17.x, 10.42.x) into the AD DNS zone. See roles/samba_ad_dc/defaults.
|
|
interfaces = {{ samba_ad_dc_interfaces | join(' ') }}
|
|
bind interfaces only = yes
|
|
{% endif %}
|
|
|
|
netbios name = {{ (samba_ad_dc_netbios_name | default(inventory_hostname_short)) | upper }}
|
|
realm = {{ samba_ad_dc_realm }}
|
|
server string = {{ samba_ad_dc_server_string }}
|
|
server role = {{ samba_ad_dc_server_role }}
|
|
server services = {{ samba_ad_dc_server_services }}
|
|
workgroup = {{ samba_ad_dc_workgroup }}
|
|
idmap_ldb:use rfc2307 = {{ "yes" if samba_ad_dc_rfc2307 else "no" }}
|
|
template homedir = {{ samba_ad_dc_template_homedir }}
|
|
template shell = {{ samba_ad_dc_template_shell }}
|
|
|
|
[sysvol]
|
|
path = {{ samba_ad_dc_sysvol_path }}
|
|
read only = No
|
|
|
|
[netlogon]
|
|
path = {{ samba_ad_dc_netlogon_path }}
|
|
read only = No
|