# =====================================================================================
# Copy to .env and edit.  Everything here is consumed by docker compose interpolation
# (hostname/container_name/paths) AND passed into the container environment.
#
#   cp .env.example .env && chmod 600 .env
# =====================================================================================

# --- Identity -------------------------------------------------------------------------
# Realm: uppercase, no underscores, must be a DNS domain you control. Use a *sub*domain
# (ad.example.com) - never your registered mail domain root.
# Quoting: docker-compose accepts unquoted multi-word values, but a plain shell does NOT
# (AD_DNS_FORWARDER=1.1.1.1 8.8.8.8 would try to EXECUTE "8.8.8.8"). The scripts here
# parse .env rather than execute it, but please QUOTE any value containing spaces anyway.
AD_REALM=AD.EXAMPLE.COM
AD_DNS_DOMAIN=ad.example.com
# Short container/DC hostname -> FQDN becomes dc1.ad.example.com
AD_HOSTNAME=dc1

# Docker container name (used by scripts/*.sh; override with AD_CONTAINER=... )
AD_CONTAINER=ad-dc

# --- Network -------------------------------------------------------------------------
# The address that lands in the DC's DNS A record. MUST be reachable by domain clients.
# With network_mode: host this is the host's LAN IP. Set it explicitly if the host has
# more than one address or if DHCP may move it (get a DHCP reservation!).
AD_IP=192.168.5.12
# Optional: static hosts injected into /etc/hosts (semicolon separated), useful for
# replicas that must reach the first DC before DNS is trustworthy:
#AD_EXTRA_HOSTS=192.168.5.20 dc1.ad.example.com dc1
#AD_IP6=auto            # "auto" = discover a global IPv6; empty = no AAAA record
AD_DNS_FORWARDER="1.1.1.1 8.8.8.8"
AD_MANAGE_RESOLV=yes     # yes = container points its own resolver at 127.0.0.1

# --- Directory -----------------------------------------------------------------------
AD_DNS_BACKEND=SAMBA_INTERNAL     # SAMBA_INTERNAL | BIND9_DLZ
AD_SITE=Default-First-Site-Name
AD_FUNCTION_LEVEL=2008_R2         # 2000|2003|2008|2008_R2|2016  (Win11 fine at 2008_R2)
AD_BASE_SCHEMA=2019               # 4.22 default; do NOT run Windows adprep against it
AD_USE_RFC2307=yes                # posix uid/gid in AD (handy for joined Linux hosts)
AD_ADMIN_USER=administrator

# --- Credentials ---------------------------------------------------------------------
# Preferred: leave AD_ADMIN_PASSWORD empty and put the password in secrets/ad_admin.password
# with mode 600. NOTE: during the *first* provision Samba passes it via argv, so
# `docker top` can see it for a few seconds - rotate the password afterwards if that
# matters to you:  docker exec -it ad-dc samba-tool user setpassword administrator
AD_ADMIN_PASSWORD=

# --- Hardening (rendered into smb.conf [global] on every start) ----------------------
AD_APPLY_HARDENING=yes
AD_SMB_SIGNING=required           # Win11: sign or encrypt always
AD_SMB_ENCRYPT=desired            # required = force SMB3 encryption (old clients may break)
AD_NTLM_AUTH=ntlmv2-only          # disabled  = Kerberos only (set after migration audit)
AD_RESTRICT_ANONYMOUS=2
AD_SMB_MIN_PROTOCOL=SMB2_02
AD_LOG_LEVEL=1

# --- LDAPS ---------------------------------------------------------------------------
# Generate with scripts/tls.sh, then uncomment. The leaf MUST contain SAN=DC=<fqdn>.
#AD_TLS_CERT=/run/ad-secrets/tls/dc.crt
#AD_TLS_KEY=/run/ad-secrets/tls/dc.key
#AD_TLS_CA=/run/ad-secrets/tls/ca.crt

# --- Additional domain controller (replica) ------------------------------------------
# Only used on a fresh data volume; otherwise the existing database decides.
#AD_JOIN_SERVER=dc1.ad.example.com
#AD_JOIN_USER=administrator
#AD_JOIN_PASSWORD=

# --- Ops ----------------------------------------------------------------------------
AD_DNS_REFRESH_SECONDS=300