mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 03:04:30 +00:00
c0c43bcf6a
Forward A/CNAME and reverse PTR records reported changed=0 / ok but never
resolved by short name on the Samba AD DC (myrddin.prole.org). Root cause was
regex escaping inside YAML folded block scalars (">-"): unlike double-quoted
scalars, block scalars do NOT process backslash escapes, so a pattern written
as '\\.' reached Jinja as a literal backslash + any-char and never matched.
Consequences:
- regex_replace() never stripped the zone suffix, so records were created
under their full FQDN (e.g. a record literally named "sg2428lp.prole.org"
inside zone "prole.org"). `samba-tool dns query ... prole.org sg2428lp A`
then returns WERR_DNS_ERROR_NAME_DOES_NOT_EXIST.
- regex_findall() of existing values always returned [], so stale records
were never pruned and idempotency only survived via RECORD_ALREADY_EXISTS.
The leading/trailing whitespace from the folded scalar was a red herring: the
command module's shlex tokenization collapses it, so a single-token name
survived intact. The escaping was the actual defect.
Fix:
- Convert the templated set_fact expressions from ">-" block scalars to
double-quoted single-line scalars (one consistent escaping convention,
matching the already-working samba_target_zone line; also removes the
stray whitespace).
- Add an assertion that the computed record name is a clean, non-empty,
whitespace-free token.
- Add a post-apply verification re-query + assert that the expected
value(s) are actually present, turning a silent no-op into a hard failure.
Applies to roles/samba_dns (ensure_a.yml, ensure_cname.yml) and
roles/samba_reverse_dns (ensure_ptr.yml).
Verified end-to-end through ansible-playbook against a stateful fake
samba-tool: correct short names (sg2428lp, git, @, registry), stale-value
removal, internal.prole.org zone routing, idempotent re-runs (changed=0),
and the verify-assert failing loudly when an add silently does not persist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
52 lines
2.5 KiB
YAML
52 lines
2.5 KiB
YAML
---
|
|
- name: Query existing PTR records
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns query {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR -U Administrator --password={{ samba_dns_admin_pass }}
|
|
register: ptr_query
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
# Double-quoted scalar (not ">-"): in a block scalar '\\s'/'\\.' reach the regex
|
|
# as a literal backslash and never match, so PTR parsing silently returned [] —
|
|
# stale records were never pruned. samba-tool prints PTR targets fully-qualified
|
|
# with a trailing dot, which we strip for comparison against item.fqdn.
|
|
- name: Parse existing PTR records
|
|
ansible.builtin.set_fact:
|
|
ptr_existing_values: "{{ ptr_query.stdout | default('') | regex_findall('PTR:\\s+([A-Za-z0-9.-]+)') | map('regex_replace', '\\.$', '') | list }}"
|
|
|
|
- name: Remove stale PTR records
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns delete {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ ptr_value }} -U Administrator --password={{ samba_dns_admin_pass }}
|
|
loop: "{{ ptr_existing_values | reject('equalto', item.fqdn) | list }}"
|
|
loop_control:
|
|
loop_var: ptr_value
|
|
when: (ptr_existing_values | reject('equalto', item.fqdn) | list | length) > 0
|
|
|
|
- name: Add expected PTR record
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns add {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ item.fqdn }} -U Administrator --password={{ samba_dns_admin_pass }}
|
|
register: ptr_add
|
|
changed_when: ptr_add.rc == 0
|
|
failed_when: >
|
|
ptr_add.rc != 0 and
|
|
('WERR_DNS_ERROR_RECORD_ALREADY_EXISTS' not in (ptr_add.stderr | default(''))) and
|
|
('Record already exists' not in (ptr_add.stderr | default('')))
|
|
when: item.fqdn not in ptr_existing_values
|
|
|
|
- name: Verify PTR record resolves
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns query {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR -U Administrator --password={{ samba_dns_admin_pass }}
|
|
register: ptr_verify
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Assert expected PTR record is present
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.fqdn in ptr_verify_values
|
|
fail_msg: >-
|
|
PTR {{ item.last_octet }} in zone {{ lan_reverse_zone }} does not contain
|
|
expected target '{{ item.fqdn }}' after apply (got {{ ptr_verify_values }}).
|
|
vars:
|
|
ptr_verify_values: "{{ ptr_verify.stdout | default('') | regex_findall('PTR:\\s+([A-Za-z0-9.-]+)') | map('regex_replace', '\\.$', '') | list }}"
|