First Commit

.gitignore

@@ -0,0 +1,81 @@
+# =====================================================================================
+# Two kinds of things belong on this list:
+#   (a) SECRETS  - leaking these is a domain compromise, not a typo
+#   (b) RUNNING CONTAINER STATE - reproducible from this repo; committing it would shadow
+#       the config that the entrypoint renders from .env on every start
+#
+# What you need to build a container stays tracked: image/, scripts/, tests/, docs/,
+# docker-compose*.yml, Makefile, README.md, .env.example, .dockerignore, this file.
+# =====================================================================================
+
+# --- secrets --------------------------------------------------------------------
+# Real configuration: holds the domain administrator password.
+# `.env.*` also catches restore scratch/backups (.env.pre-restore-<ts>, .env.tmp).
+# .env.example is the only member of this family that belongs in git.
+.env
+.env.*
+!.env.example
+
+# Admin password file, LDAPS CA + leaf + keys, throwaway lab CAs (secrets/tls-lab).
+# NOTE: secrets/tls/ca.key is the trust anchor every joined client has installed. Leak it
+# and someone can mint certificates your whole fleet trusts.
+secrets/*
+!secrets/.gitkeep
+
+# Belt-and-braces: never let key material sneak in from anywhere else either.
+*.key
+*.pem
+# (public certs are harmless but only ever live under secrets/, so ignore them too)
+*.crt
+*.p12
+*.pfx
+
+# --- running container state ----------------------------------------------------
+# smb.conf as generated/rendered by the entrypoint (source of truth is .env + entrypoint).
+conf/*
+!conf/.gitkeep
+conf-dc2/*
+!conf-dc2/.gitkeep
+
+# sam.ldb (NT hashes, Kerberos keys, Backup Key) + SYSVOL + machine account keys.
+# This IS the domain. Treat it as production data, never as source.
+data/*
+!data/.gitkeep
+data/samba
+!data/samba
+data/samba/*
+!data/samba/.gitkeep
+data/samba-dc2
+!data/samba-dc2
+data/samba-dc2/*
+!data/samba-dc2/.gitkeep
+
+# --- backups ------------------------------------------------------------------
+# `samba-tool domain backup` archives are whole-domain copies: password hashes and the
+# Backup Key included. They go off-host encrypted, not into version control.
+backups/*
+!backups/.gitkeep
+*.tar.bz2
+*.tgz
+*.sha256
+
+# --- per-machine compose overrides ----------------------------------------------
+# Usually local-only (different IP/realm per box). Force-add if you mean to share it:
+#   git add -f docker-compose.override.yml
+docker-compose.override.yml
+docker-compose.*.local.yml
+
+# --- scratch, logs, editor and OS junk ------------------------------------------
+*.log
+*.tmp
+*.bak
+*.swp
+*~
+.DS_Store
+Thumbs.db
+# test harness scratch that landed inside the tree
+tests/.tmp/
+
+# --- python -------------------------------------------------------------------
+__pycache__/
+*.py[co]