First Commit

image/ad-healthcheck.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# =====================================================================================
+# Container healthcheck. Credential-free on purpose: it must never risk locking out an
+# account by testing authentication. Authenticated checks live in scripts/verify.sh.
+#   - process alive
+#   - LDAP rootDSE answers (anonymous base object is allowed by design)
+#   - own DNS answers the AD SRV records
+#   - Kerberos / SMB / Global Catalog ports accept a connection
+#   - smb.conf still parses
+# =====================================================================================
+set -uo pipefail
+
+problems=()
+
+pgrep -x samba >/dev/null 2>&1 || problems+=("samba process not running")
+
+# LDAP rootDSE
+if ! ldapsearch -x -H ldap://127.0.0.1:389 -s base -b '' defaultNamingContext 2>/dev/null \
+        | grep -q '^defaultNamingContext:'; then
+    problems+=("LDAP rootDSE did not answer")
+fi
+
+# authoritative SRV lookup against ourselves
+zone="$(sed -n 's/^[[:space:]]*search[[:space:]]\{1,\}\([^[:space:]]\{1,\}\).*/\1/p' /etc/resolv.conf 2>/dev/null | head -1)"
+if [ -z "$zone" ]; then
+    zone="$(hostname -d 2>/dev/null || true)"
+fi
+if [ -n "$zone" ]; then
+    if ! dig +time=2 +tries=1 +short @127.0.0.1 "_ldap._tcp.dc._msdcs.${zone}" SRV 2>/dev/null | grep -q .; then
+        problems+=("_ldap._tcp.dc._msdcs.${zone} SRV returned nothing")
+    fi
+else
+    problems+=("cannot determine DNS zone")
+fi
+
+for port in 88 135 445 3268; do
+    if ! timeout 3 bash -c "exec 3<>/dev/tcp/127.0.0.1/${port}" 2>/dev/null; then
+        problems+=("tcp/${port} refused")
+    fi
+done
+
+# kpasswd (464) is UDP-only for most clients; check the KDC UDP path instead
+if ! timeout 3 bash -c 'exec 3<>/dev/udp/127.0.0.1/88' 2>/dev/null; then
+    problems+=("udp/88 unusable")
+fi
+
+testparm -s /etc/samba/smb.conf >/dev/null 2>&1 || problems+=("testparm failed")
+
+if ((${#problems[@]} == 0)); then
+    echo "healthy"
+    exit 0
+fi
+printf 'UNHEALTHY:'
+printf ' %s;' "${problems[@]}"
+# Surface the daemon's own last words: samba writes the real reason to its log file and this
+# shows up in `docker inspect --format '{{json .State.Health}}'`.
+if [ -r /var/log/samba/log.samba ]; then
+    printf '\n  log.samba tail: %s\n' "$(tail -3 /var/log/samba/log.samba | tr '\n' '|')"
+fi
+echo
+exit 1