First Commit

docker-compose.lab.yml

@@ -0,0 +1,65 @@
+# =====================================================================================
+# ISOLATED LAB DC - used by tests/smoke.sh, handy for local experimentation.
+#
+# * realm TESTLAB.LOCAL, throwaway credentials committed here ON PURPOSE (test only)
+# * `internal: true` network: the container has NO route to your LAN and no LAN route to
+#   it, so binding privileged ports here is harmless
+# * named volumes, so it never touches ./conf ./data ./secrets
+#
+#   docker compose -f docker-compose.lab.yml up -d
+#   docker compose -f docker-compose.lab.yml down -v      # destroy
+# =====================================================================================
+name: ad-lab
+
+services:
+  ad-lab:
+    image: local/samba-ad-dc:4.22-debian13
+    container_name: ad-lab
+    hostname: dc1.testlab.local
+    networks:
+      adlab:
+        ipv4_address: 172.28.90.10
+    environment:
+      AD_REALM: TESTLAB.LOCAL
+      AD_DNS_DOMAIN: testlab.local
+      AD_HOSTNAME: dc1
+      AD_IP: 172.28.90.10
+      AD_CONTAINER: ad-lab
+      AD_DNS_FORWARDER: 1.1.1.1 8.8.8.8
+      AD_ADMIN_PASSWORD: 'Lab!Only9Tester#2026'
+      AD_SMB_SIGNING: required
+      AD_SMB_ENCRYPT: desired
+      AD_NTLM_AUTH: ntlmv2-only
+      AD_LOG_LEVEL: '1'
+    volumes:
+      - adlab-conf:/etc/samba
+      - adlab-lib:/var/lib/samba
+    stop_grace_period: 60s
+    restart: unless-stopped
+    cap_drop: [ALL]
+    # SYS_ADMIN is required: Samba persists NT ACLs in the security.NTACL xattr, which
+    # the kernel refuses inside a container without it (SYSVOL/NETLOGON ACL writes).
+    cap_add:
+      - CHOWN
+      - FOWNER
+      - SETUID
+      - SETGID
+      - DAC_OVERRIDE
+      - NET_BIND_SERVICE
+      - SYS_NICE
+      - SYS_RESOURCE
+      - AUDIT_WRITE
+      - SYS_ADMIN
+
+networks:
+  adlab:
+    name: adlab
+    driver: bridge
+    internal: true
+    ipam:
+      config:
+        - subnet: 172.28.90.0/24
+
+volumes:
+  adlab-conf:
+  adlab-lib: