# Samba AD DC - operational entry points. `make` prints this list.
SHELL := /bin/bash
IMAGE  ?= local/samba-ad-dc:4.22-debian13
CID    ?= $(shell sed -n 's/^AD_CONTAINER=//p' .env 2>/dev/null | head -1)
CID    := $(if $(CID),$(CID),ad-dc)

.PHONY: help build up down restart logs ps verify verify-full backup tls lab labdown smoke drill ldaps test \
        shell secrets passwd fsmo repl-status clean

help:
	@echo "Samba AD DC on Debian 13 (container: $(IMAGE), name: $(CID))"
	@echo
	@echo "  make secrets        create secrets/ad_admin.password (random, 0600)"
	@echo "  make build         build the image"
	@echo "  make up            start the DC (host networking - check ports 53/88/445 first)"
	@echo "  make down          stop it                 make restart: same, harder"
	@echo "  make logs          follow container logs"
	@echo "  make verify        run the verification battery (add FULL=1 for dbcheck)"
	@echo "  make backup        online full-domain backup into ./backups"
	@echo "  make tls           build internal CA + LDAPS leaf cert"
	@echo "  make passwd        rotate the administrator password (interactive)"
	@echo "  make fsmo         show FSMO role ownership"
	@echo "  make repl-status  replication status (meaningful once a replica exists)"
	@echo
	@echo "  make lab           isolated TESTLAB.LOCAL lab DC (no host ports)"
	@echo "  make labdown       destroy the lab"
	@echo "  make smoke         full isolated end-to-end test (build -> provision -> verify -> restart)"
	@echo "  make drill         disaster-recovery drill (backup -> restore -> SID + data assertions)"
	@echo "  make ldaps         LDAPS: chain verifies, SAN matches, untrusted clients rejected"
	@echo "  make test          smoke + drill + ldaps (run before every upgrade)"
	@echo "  make restore BACKUP=backups/xxx.tgz   disaster recovery drill"

build:
	docker build -t $(IMAGE) -f image/Dockerfile .

up:
	docker compose up -d

down:
	docker compose down

restart:
	docker compose restart

logs:
	docker compose logs -f --tail=100

ps:
	@docker compose ps -a

verify:
	AD_CONTAINER=$(CID) ./scripts/verify.sh $(if $(FULL),--full,)

backup:
	./scripts/backup.sh

tls:
	./scripts/tls.sh

secrets:
	./scripts/mksecrets.sh

passwd:
	docker exec -it $(CID) samba-tool user setpassword $(shell grep -m1 '^AD_ADMIN_USER=' .env 2>/dev/null | cut -d= -f2 || echo administrator)

fsmo:
	docker exec -it $(CID) samba-tool fsmo show

repl-status:
	docker exec -it $(CID) samba-tool drs showrepl

lab:
	docker compose -f docker-compose.lab.yml up -d
	@echo "lab up: realm TESTLAB.LOCAL, host alias dc1.testlab.local -> 172.28.90.10"
	@echo "destroy with: make labdown"

labdown:
	docker compose -f docker-compose.lab.yml down -v

smoke:
	./tests/smoke.sh

drill:
	./tests/dr-drill.sh

ldaps:
	./scripts/tls.sh
	./tests/ldaps-test.sh

test: smoke drill ldaps
	@echo "all test suites passed"

restore:
	@test -n "$(BACKUP)" || { echo "usage: make restore BACKUP=backups/<file>.tgz"; exit 2; }
	./scripts/restore.sh $(BACKUP)

clean:
	docker compose down -v --remove-orphans || true
	docker compose -f docker-compose.lab.yml down -v --remove-orphans || true
	@echo "left ./conf ./data ./secrets ./backups in place (delete manually if you really mean it)"