First Commit

.env.example

@@ -0,0 +1,71 @@
+# =====================================================================================
+# Copy to .env and edit.  Everything here is consumed by docker compose interpolation
+# (hostname/container_name/paths) AND passed into the container environment.
+#
+#   cp .env.example .env && chmod 600 .env
+# =====================================================================================
+
+# --- Identity -------------------------------------------------------------------------
+# Realm: uppercase, no underscores, must be a DNS domain you control. Use a *sub*domain
+# (ad.example.com) - never your registered mail domain root.
+# Quoting: docker-compose accepts unquoted multi-word values, but a plain shell does NOT
+# (AD_DNS_FORWARDER=1.1.1.1 8.8.8.8 would try to EXECUTE "8.8.8.8"). The scripts here
+# parse .env rather than execute it, but please QUOTE any value containing spaces anyway.
+AD_REALM=AD.EXAMPLE.COM
+AD_DNS_DOMAIN=ad.example.com
+# Short container/DC hostname -> FQDN becomes dc1.ad.example.com
+AD_HOSTNAME=dc1
+
+# Docker container name (used by scripts/*.sh; override with AD_CONTAINER=... )
+AD_CONTAINER=ad-dc
+
+# --- Network -------------------------------------------------------------------------
+# The address that lands in the DC's DNS A record. MUST be reachable by domain clients.
+# With network_mode: host this is the host's LAN IP. Set it explicitly if the host has
+# more than one address or if DHCP may move it (get a DHCP reservation!).
+AD_IP=192.168.5.12
+# Optional: static hosts injected into /etc/hosts (semicolon separated), useful for
+# replicas that must reach the first DC before DNS is trustworthy:
+#AD_EXTRA_HOSTS=192.168.5.20 dc1.ad.example.com dc1
+#AD_IP6=auto            # "auto" = discover a global IPv6; empty = no AAAA record
+AD_DNS_FORWARDER="1.1.1.1 8.8.8.8"
+AD_MANAGE_RESOLV=yes     # yes = container points its own resolver at 127.0.0.1
+
+# --- Directory -----------------------------------------------------------------------
+AD_DNS_BACKEND=SAMBA_INTERNAL     # SAMBA_INTERNAL | BIND9_DLZ
+AD_SITE=Default-First-Site-Name
+AD_FUNCTION_LEVEL=2008_R2         # 2000|2003|2008|2008_R2|2016  (Win11 fine at 2008_R2)
+AD_BASE_SCHEMA=2019               # 4.22 default; do NOT run Windows adprep against it
+AD_USE_RFC2307=yes                # posix uid/gid in AD (handy for joined Linux hosts)
+AD_ADMIN_USER=administrator
+
+# --- Credentials ---------------------------------------------------------------------
+# Preferred: leave AD_ADMIN_PASSWORD empty and put the password in secrets/ad_admin.password
+# with mode 600. NOTE: during the *first* provision Samba passes it via argv, so
+# `docker top` can see it for a few seconds - rotate the password afterwards if that
+# matters to you:  docker exec -it ad-dc samba-tool user setpassword administrator
+AD_ADMIN_PASSWORD=
+
+# --- Hardening (rendered into smb.conf [global] on every start) ----------------------
+AD_APPLY_HARDENING=yes
+AD_SMB_SIGNING=required           # Win11: sign or encrypt always
+AD_SMB_ENCRYPT=desired            # required = force SMB3 encryption (old clients may break)
+AD_NTLM_AUTH=ntlmv2-only          # disabled  = Kerberos only (set after migration audit)
+AD_RESTRICT_ANONYMOUS=2
+AD_SMB_MIN_PROTOCOL=SMB2_02
+AD_LOG_LEVEL=1
+
+# --- LDAPS ---------------------------------------------------------------------------
+# Generate with scripts/tls.sh, then uncomment. The leaf MUST contain SAN=DC=<fqdn>.
+#AD_TLS_CERT=/run/ad-secrets/tls/dc.crt
+#AD_TLS_KEY=/run/ad-secrets/tls/dc.key
+#AD_TLS_CA=/run/ad-secrets/tls/ca.crt
+
+# --- Additional domain controller (replica) ------------------------------------------
+# Only used on a fresh data volume; otherwise the existing database decides.
+#AD_JOIN_SERVER=dc1.ad.example.com
+#AD_JOIN_USER=administrator
+#AD_JOIN_PASSWORD=
+
+# --- Ops ----------------------------------------------------------------------------
+AD_DNS_REFRESH_SECONDS=300