CT-101 Samba: Check-Mode-Guards und self-contained Inventory für site.yml

- group_vars spiegelt samba_smb_config_file/passdb_file sowie
  samba_access_admin_user/ssh_dropin, damit backup.yml/verify-production.yml
  ohne geladene Rolle laufen (CT-100/102-Konvention); alle drei Inventare
  byte-identisch
- samba_lxc_baseline: unattended-upgrades.service nach dem apt-Install
  enable+starten, Task mit when: not ansible_check_mode
- samba_nfs: artifact_source_root auf playbook_dir/../.. korrigiert
  (Artifacts liegen in ct-101-samba/, nicht in ansible/); gn-media-Probe mit
  failed_when: false und Assert-Guard für den ersten Check-Mode-Lauf;
  Ganesha-Restart-Handler mit when: not ansible_check_mode
- site.yml --check --diff gegen CT 101 grün: ok=100 changed=20 failed=0

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml

@@ -33,6 +33,10 @@ samba_firewall_nfs_ports:
   - 2049
 
 samba_access_source_networks: 10.0.0.0/24,10.8.0.0/24
+# Mirrored from the samba_access role defaults so that verify-production.yml
+# runs with a self-contained inventory (CT 100/102 convention):
+samba_access_admin_user: ghost
+samba_access_ssh_dropin: /etc/ssh/sshd_config.d/99-security.conf
 
 samba_media_group_name: gn-media
 samba_media_group_gid: 970
@@ -74,6 +78,11 @@ samba_media_mount_points:
   - /media/datenhdd3
 
 samba_smb_workgroup: Ghost.net
+# Mirrored from the samba_smb role defaults so that the playbooks
+# (backup.yml/verify-production.yml) run with a self-contained inventory
+# (CT 100/102 convention):
+samba_smb_config_file: /etc/samba/smb.conf
+samba_smb_passdb_file: /var/lib/samba/private/passdb.tdb
 samba_smb_service_units:
   - smbd.service
   - nmbd.service

proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml

@@ -33,6 +33,10 @@ samba_firewall_nfs_ports:
   - 2049
 
 samba_access_source_networks: 10.0.0.0/24,10.8.0.0/24
+# Mirrored from the samba_access role defaults so that verify-production.yml
+# runs with a self-contained inventory (CT 100/102 convention):
+samba_access_admin_user: ghost
+samba_access_ssh_dropin: /etc/ssh/sshd_config.d/99-security.conf
 
 samba_media_group_name: gn-media
 samba_media_group_gid: 970
@@ -74,6 +78,11 @@ samba_media_mount_points:
   - /media/datenhdd3
 
 samba_smb_workgroup: Ghost.net
+# Mirrored from the samba_smb role defaults so that the playbooks
+# (backup.yml/verify-production.yml) run with a self-contained inventory
+# (CT 100/102 convention):
+samba_smb_config_file: /etc/samba/smb.conf
+samba_smb_passdb_file: /var/lib/samba/private/passdb.tdb
 samba_smb_service_units:
   - smbd.service
   - nmbd.service

proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml

@@ -33,6 +33,10 @@ samba_firewall_nfs_ports:
   - 2049
 
 samba_access_source_networks: 10.0.0.0/24,10.8.0.0/24
+# Mirrored from the samba_access role defaults so that verify-production.yml
+# runs with a self-contained inventory (CT 100/102 convention):
+samba_access_admin_user: ghost
+samba_access_ssh_dropin: /etc/ssh/sshd_config.d/99-security.conf
 
 samba_media_group_name: gn-media
 samba_media_group_gid: 970
@@ -74,6 +78,11 @@ samba_media_mount_points:
   - /media/datenhdd3
 
 samba_smb_workgroup: Ghost.net
+# Mirrored from the samba_smb role defaults so that the playbooks
+# (backup.yml/verify-production.yml) run with a self-contained inventory
+# (CT 100/102 convention):
+samba_smb_config_file: /etc/samba/smb.conf
+samba_smb_passdb_file: /var/lib/samba/private/passdb.tdb
 samba_smb_service_units:
   - smbd.service
   - nmbd.service

proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml

@@ -98,6 +98,7 @@
     enabled: true
     state: started
     daemon_reload: true
+  when: not ansible_check_mode
 
 - name: Set the local timezone database link
   ansible.builtin.file:

proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/defaults/main.yml

@@ -1,10 +1,10 @@
 ---
-samba_nfs_artifact_source_root: "{{ playbook_dir }}/.."
+samba_nfs_artifact_source_root: "{{ playbook_dir }}/../.."
 samba_nfs_quadlet_directory: /etc/containers/systemd
 samba_nfs_build_directory: /var/lib/ghostnet/samba/build
 samba_nfs_config_directory: /etc/ghostnet/samba/ganesha
 samba_nfs_state_directory: /var/lib/ghostnet/samba/ganesha
-# Reviewed checksum of ../Containerfile.ganesha (sha256sum, 2026-10-20):
+# Reviewed checksum of ../../Containerfile.ganesha (sha256sum, 2026-10-20):
 samba_nfs_containerfile_sha256: >-
   0fdbe6b5fe542f22ed291c4cabe505e0da472024f0186e2414fd002b751f784f
 samba_nfs_source_image: >-

proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/handlers/main.yml

@@ -7,3 +7,4 @@
   ansible.builtin.systemd_service:
     name: ghostnet-samba-nfs.service
     state: restarted
+  when: not ansible_check_mode

proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/tasks/main.yml

@@ -19,6 +19,7 @@
       - "{{ samba_media_group_name }}"
   check_mode: false
   changed_when: false
+  failed_when: false
   register: samba_nfs_media_group
 
 - name: Fail closed when the media group is missing
@@ -32,6 +33,7 @@
       The group {{ samba_media_group_name }} (GID {{ samba_media_group_gid }})
       is missing or carries a different GID. Run the samba_media role first;
       the export root must be group-writable for the pipeline identities.
+  when: not ansible_check_mode or not samba_media_group_task.changed | default(false) | bool
 
 - name: Create the NFS export root with the pipeline group
   ansible.builtin.file: