feat(dns): 建立统一清单并接管 Samba 静态记录

infrastructure/samba-ad/ansible/roles/samba_ad_dc/tasks/dns_records.yml

@@ -0,0 +1,14 @@
+---
+- name: Reconcile explicitly managed AD DNS RRsets
+  ddupan.homelab.samba_dns_record:
+    server: "{{ samba_ad_dc_ip }}"
+    zone: "{{ item['zone'] }}"
+    name: "{{ item['name'] }}"
+    type: "{{ item['type'] }}"
+    values: "{{ item['values'] }}"
+    state: present
+    exact: true
+  loop: "{{ homelab_dns.samba.records }}"
+  loop_control:
+    label: "{{ item['name'] }}.{{ item['zone'] }} {{ item['type'] }}"
+  tags: [dns]

infrastructure/samba-ad/ansible/roles/samba_ad_dc/tasks/main.yml

@@ -198,20 +198,11 @@
     - "'already exists' not in (kms_srv.stderr | default('')) + (kms_srv.stdout | default(''))"
   no_log: true
 
-# --- Extra A records for non-domain hosts (e.g. OpenBao) -----------------------
+# --- Directory objects and explicitly managed DNS records ----------------------
 - name: Service accounts and RBAC groups
   ansible.builtin.import_tasks: directory_objects.yml
   tags: [directory, accounts]
 
-- name: Register extra A records in the AD DNS zone
-  ansible.builtin.command:
-    cmd: >-
-      samba-tool dns add {{ samba_ad_dc_ip }} {{ samba_ad_realm | lower }}
-      {{ item.name }} A {{ item.ip }} -P
-  loop: "{{ samba_ad_extra_a_records }}"
-  register: extra_a
-  changed_when: "'Record added successfully' in (extra_a.stdout | default(''))"
-  failed_when:
-    - extra_a.rc != 0
-    - "'already exists' not in (extra_a.stderr | default('')) + (extra_a.stdout | default(''))"
+- name: Reconcile static AD DNS records
+  ansible.builtin.import_tasks: dns_records.yml
   tags: [dns]