First Commit

2026-09-24 11:29:54 -05:00 · 2026-09-24 11:29:54 -05:00 · 2e5a4751a7
commit 2e5a4751a7
30 changed files with 2517 additions and 0 deletions
--- a/100
+++ b/100
@ -0,0 +1,100 @@
+# Samba AD DC - operational entry points. `make` prints this list.
+SHELL := /bin/bash
+IMAGE  ?= local/samba-ad-dc:4.22-debian13
+CID    ?= $(shell sed -n 's/^AD_CONTAINER=//p' .env 2>/dev/null | head -1)
+CID    := $(if $(CID),$(CID),ad-dc)
+
+.PHONY: help build up down restart logs ps verify verify-full backup tls lab labdown smoke drill ldaps test \
+        shell secrets passwd fsmo repl-status clean
+
+help:
+	@echo "Samba AD DC on Debian 13 (container: $(IMAGE), name: $(CID))"
+	@echo
+	@echo "  make secrets        create secrets/ad_admin.password (random, 0600)"
+	@echo "  make build         build the image"
+	@echo "  make up            start the DC (host networking - check ports 53/88/445 first)"
+	@echo "  make down          stop it                 make restart: same, harder"
+	@echo "  make logs          follow container logs"
+	@echo "  make verify        run the verification battery (add FULL=1 for dbcheck)"
+	@echo "  make backup        online full-domain backup into ./backups"
+	@echo "  make tls           build internal CA + LDAPS leaf cert"
+	@echo "  make passwd        rotate the administrator password (interactive)"
+	@echo "  make fsmo         show FSMO role ownership"
+	@echo "  make repl-status  replication status (meaningful once a replica exists)"
+	@echo
+	@echo "  make lab           isolated TESTLAB.LOCAL lab DC (no host ports)"
+	@echo "  make labdown       destroy the lab"
+	@echo "  make smoke         full isolated end-to-end test (build -> provision -> verify -> restart)"
+	@echo "  make drill         disaster-recovery drill (backup -> restore -> SID + data assertions)"
+	@echo "  make ldaps         LDAPS: chain verifies, SAN matches, untrusted clients rejected"
+	@echo "  make test          smoke + drill + ldaps (run before every upgrade)"
+	@echo "  make restore BACKUP=backups/xxx.tgz   disaster recovery drill"
+
+build:
+	docker build -t $(IMAGE) -f image/Dockerfile .
+
+up:
+	docker compose up -d
+
+down:
+	docker compose down
+
+restart:
+	docker compose restart
+
+logs:
+	docker compose logs -f --tail=100
+
+ps:
+	@docker compose ps -a
+
+verify:
+	AD_CONTAINER=$(CID) ./scripts/verify.sh $(if $(FULL),--full,)
+
+backup:
+	./scripts/backup.sh
+
+tls:
+	./scripts/tls.sh
+
+secrets:
+	./scripts/mksecrets.sh
+
+passwd:
+	docker exec -it $(CID) samba-tool user setpassword $(shell grep -m1 '^AD_ADMIN_USER=' .env 2>/dev/null | cut -d= -f2 || echo administrator)
+
+fsmo:
+	docker exec -it $(CID) samba-tool fsmo show
+
+repl-status:
+	docker exec -it $(CID) samba-tool drs showrepl
+
+lab:
+	docker compose -f docker-compose.lab.yml up -d
+	@echo "lab up: realm TESTLAB.LOCAL, host alias dc1.testlab.local -> 172.28.90.10"
+	@echo "destroy with: make labdown"
+
+labdown:
+	docker compose -f docker-compose.lab.yml down -v
+
+smoke:
+	./tests/smoke.sh
+
+drill:
+	./tests/dr-drill.sh
+
+ldaps:
+	./scripts/tls.sh
+	./tests/ldaps-test.sh
+
+test: smoke drill ldaps
+	@echo "all test suites passed"
+
+restore:
+	@test -n "$(BACKUP)" || { echo "usage: make restore BACKUP=backups/<file>.tgz"; exit 2; }
+	./scripts/restore.sh $(BACKUP)
+
+clean:
+	docker compose down -v --remove-orphans || true
+	docker compose -f docker-compose.lab.yml down -v --remove-orphans || true
+	@echo "left ./conf ./data ./secrets ./backups in place (delete manually if you really mean it)"