声明式管理 Proxmox API 对象与 Samba DNS 上游

2026-09-17 13:22:50 +00:00
parent 71eea7d8fc
commit 2e05b1a96a
15 changed files with 277 additions and 106 deletions
@@ -0,0 +1,10 @@
+---
+- name: 更新现有 AD 域控 DNS 上游
+  hosts: samba_dc
+  become: true
+  gather_facts: false
+  tasks:
+    - name: 仅应用 DNS 转发器配置
+      ansible.builtin.import_role:
+        name: samba_ad_dc
+        tasks_from: dns_forwarder
@@ -7,7 +7,7 @@ samba_ad_realm: "AD.DDUPAN.TOP"
 samba_ad_domain: "DDUPAN"
 samba_ad_dc_hostname: "dc1"
 samba_ad_dc_ip: "192.168.10.5"
-samba_ad_dns_forwarder: "192.168.10.1"
+samba_ad_dns_forwarder: "192.168.10.127"   # Blocky：DN42 条件转发及公网解析
 samba_ad_reverse_zone: "10.168.192.in-addr.arpa"   # reverse of 192.168.10.0/24

 # Static records now live in ../../dns/records.yml and are reconciled as complete
@@ -0,0 +1,10 @@
+---
+- name: 更新 Samba DNS 转发器并校验配置
+  ansible.builtin.lineinfile:
+    path: /etc/samba/smb.conf
+    regexp: '^\s*dns forwarder\s*='
+    insertafter: '^\[global\]'
+    line: "\tdns forwarder = {{ samba_ad_dns_forwarder }}"
+    validate: '/usr/bin/testparm -s %s'
+    backup: true
+  notify: restart samba-ad-dc
@@ -87,6 +87,9 @@
    creates: /var/lib/samba/private/sam.ldb
  no_log: true   # keep the admin password out of logs

+- name: 持续管理已初始化域控的 DNS 上游
+  ansible.builtin.import_tasks: dns_forwarder.yml
+
 - name: Install the generated krb5.conf system-wide
  ansible.builtin.copy:
    src: /var/lib/samba/private/krb5.conf