mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
a2a82bc495
All samba-tool dns commands were using -P (machine account Kerberos) which
silently failed with no error — tasks reported changed=0 but records were
never written. Switch to -U Administrator --password={{ samba_dns_admin_pass }}
which uses the vault-protected admin credentials that were already defined
but never wired up.
Also fix regex patterns in record parsers: samba-tool output uses `A: IP`
and `PTR: fqdn` format, not `A IP` / `PTR fqdn` (space-separated), so
updated regex_findall patterns to match `TYPE:\s+value`.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
53 lines
2.3 KiB
YAML
53 lines
2.3 KiB
YAML
---
|
|
- name: Determine zone and record name
|
|
ansible.builtin.set_fact:
|
|
samba_target_zone: "{{ 'internal.' ~ prole_domain if item.fqdn.endswith('.internal.' ~ prole_domain) or item.fqdn == 'internal.' ~ prole_domain else prole_domain }}"
|
|
samba_dns_record_name: >-
|
|
{% set fqdn_clean = item.fqdn | regex_replace('\\.?$', '') %}
|
|
{% if fqdn_clean == ('internal.' ~ prole_domain if item.fqdn.endswith('.internal.' ~ prole_domain) or item.fqdn == 'internal.' ~ prole_domain else prole_domain) %}
|
|
@
|
|
{% else %}
|
|
{{ fqdn_clean | regex_replace('\\.' ~ (('internal.' ~ prole_domain if item.fqdn.endswith('.internal.' ~ prole_domain) or item.fqdn == 'internal.' ~ prole_domain else prole_domain) | regex_escape) ~ '$', '') }}
|
|
{% endif %}
|
|
|
|
- name: Query existing A records
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns query {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A
|
|
-U Administrator --password={{ samba_dns_admin_pass }}
|
|
register: a_query
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Parse existing A record values
|
|
ansible.builtin.set_fact:
|
|
a_existing_values: >-
|
|
{{
|
|
(a_query.stdout | default('') |
|
|
regex_findall('\\bA:\\s+([0-9]{1,3}(?:\\.[0-9]{1,3}){3})\\b') |
|
|
list)
|
|
}}
|
|
|
|
- name: Remove stale A records
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns delete {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A {{ a_value }}
|
|
-U Administrator --password={{ samba_dns_admin_pass }}
|
|
loop: "{{ a_existing_values | difference(item.ipv4s) }}"
|
|
loop_control:
|
|
loop_var: a_value
|
|
when: (a_existing_values | difference(item.ipv4s) | length) > 0
|
|
|
|
- name: Add missing A records
|
|
ansible.builtin.command:
|
|
cmd: samba-tool dns add {{ samba_dns_server }} {{ samba_target_zone }} {{ samba_dns_record_name }} A {{ a_target_ip }}
|
|
-U Administrator --password={{ samba_dns_admin_pass }}
|
|
register: a_add
|
|
changed_when: a_add.rc == 0
|
|
failed_when: >
|
|
a_add.rc != 0 and
|
|
('WERR_DNS_ERROR_RECORD_ALREADY_EXISTS' not in (a_add.stderr | default(''))) and
|
|
('Record already exists' not in (a_add.stderr | default('')))
|
|
loop: "{{ item.ipv4s | difference(a_existing_values) }}"
|
|
loop_control:
|
|
loop_var: a_target_ip
|
|
when: (item.ipv4s | difference(a_existing_values) | length) > 0
|