First Commit

docs/docker-compose.macvlan.yml.example

@@ -0,0 +1,46 @@
+# Standalone macvlan variant: the DC owns its own address on the LAN segment, so physical
+# Windows 11 clients can reach it without giving the container the host's network stack.
+#
+# Two things to know about macvlan:
+#   * by default a macvlan container CANNOT talk to its own host. If you need that, add a
+#     macvlan interface on the host too (`ip link add link <if> macvlan1 type macvlan
+#     mode bridge ...`) or just use network_mode: host from the base compose file.
+#   * pick an IP that your DHCP server will never hand out (or reserve it).
+name: windowsad-lan
+
+services:
+  ad-dc:
+    image: local/samba-ad-dc:4.22-debian13
+    container_name: ad-dc
+    hostname: dc1.ad.example.com
+    env_file:
+      - .env
+    environment:
+      # MUST match ipv4_address below - this is what lands in the DC's DNS A record.
+      AD_IP: 192.168.5.50
+    networks:
+      lan:
+        ipv4_address: 192.168.5.50
+    volumes:
+      - ./conf:/etc/samba
+      - ./data/samba:/var/lib/samba
+      - ./secrets:/run/ad-secrets:ro
+      - /etc/localtime:/etc/localtime:ro
+    stop_grace_period: 90s
+    restart: unless-stopped
+    cap_drop: [ALL]
+    cap_add: [CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE,
+              SYS_NICE, SYS_RESOURCE, AUDIT_WRITE,
+              SYS_ADMIN]  # security.NTACL xattr writes (SYSVOL/NETLOGON ACLs)
+
+networks:
+  lan:
+    name: adlan
+    driver: macvlan
+    driver_opts:
+      parent: br0                 # <- your LAN interface or bridge
+    ipam:
+      config:
+        - subnet: 192.168.5.0/24
+          gateway: 192.168.5.1
+          ip_range: 192.168.5.48/28