panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
---
|
|
# Smoke tests — run via the `verify` tag: ansible-playbook provision-dc.yml --tags verify
|
|
# Fails the play if the DC is not answering LDAP/Kerberos/DNS/SMB correctly.
|
|
|
|
- name: LDAP / domain level responds
|
|
ansible.builtin.command: samba-tool domain level show
|
|
changed_when: false
|
|
|
|
- name: DNS SRV record for LDAP resolves
|
|
ansible.builtin.command: "host -t SRV _ldap._tcp.{{ samba_ad_realm | lower }}."
|
|
register: srv_ldap
|
|
changed_when: false
|
|
failed_when: "'has SRV record' not in srv_ldap.stdout"
|
|
|
|
- name: DNS SRV record for Kerberos resolves
|
|
ansible.builtin.command: "host -t SRV _kerberos._udp.{{ samba_ad_realm | lower }}."
|
|
register: srv_krb
|
|
changed_when: false
|
|
failed_when: "'has SRV record' not in srv_krb.stdout"
|
|
|
|
- name: DC A record resolves to its own IP
|
|
ansible.builtin.command: "host -t A {{ samba_ad_dc_hostname }}.{{ samba_ad_realm | lower }}."
|
|
register: dc_a
|
|
changed_when: false
|
|
failed_when: samba_ad_dc_ip not in dc_a.stdout
|
|
|
|
- name: SMB default shares are listable
|
|
ansible.builtin.command: "smbclient -L localhost -U administrator%{{ samba_ad_admin_password }}"
|
|
register: smb_list
|
|
changed_when: false
|
|
no_log: true
|
|
failed_when: "'sysvol' not in (smb_list.stdout | lower)"
|
|
|
|
- name: Report
|
|
ansible.builtin.debug:
|
|
msg: "Samba AD DC smoke tests passed: LDAP + Kerberos SRV + DC A record + SMB shares OK."
|