# =====================================================================================
# ISOLATED LAB DC - used by tests/smoke.sh, handy for local experimentation.
#
# * realm TESTLAB.LOCAL, throwaway credentials committed here ON PURPOSE (test only)
# * `internal: true` network: the container has NO route to your LAN and no LAN route to
#   it, so binding privileged ports here is harmless
# * named volumes, so it never touches ./conf ./data ./secrets
#
#   docker compose -f docker-compose.lab.yml up -d
#   docker compose -f docker-compose.lab.yml down -v      # destroy
# =====================================================================================
name: ad-lab

services:
  ad-lab:
    image: local/samba-ad-dc:4.22-debian13
    container_name: ad-lab
    hostname: dc1.testlab.local
    networks:
      adlab:
        ipv4_address: 172.28.90.10
    environment:
      AD_REALM: TESTLAB.LOCAL
      AD_DNS_DOMAIN: testlab.local
      AD_HOSTNAME: dc1
      AD_IP: 172.28.90.10
      AD_CONTAINER: ad-lab
      AD_DNS_FORWARDER: 1.1.1.1 8.8.8.8
      AD_ADMIN_PASSWORD: 'Lab!Only9Tester#2026'
      AD_SMB_SIGNING: required
      AD_SMB_ENCRYPT: desired
      AD_NTLM_AUTH: ntlmv2-only
      AD_LOG_LEVEL: '1'
    volumes:
      - adlab-conf:/etc/samba
      - adlab-lib:/var/lib/samba
    stop_grace_period: 60s
    restart: unless-stopped
    cap_drop: [ALL]
    # SYS_ADMIN is required: Samba persists NT ACLs in the security.NTACL xattr, which
    # the kernel refuses inside a container without it (SYSVOL/NETLOGON ACL writes).
    cap_add:
      - CHOWN
      - FOWNER
      - SETUID
      - SETGID
      - DAC_OVERRIDE
      - NET_BIND_SERVICE
      - SYS_NICE
      - SYS_RESOURCE
      - AUDIT_WRITE
      - SYS_ADMIN

networks:
  adlab:
    name: adlab
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.28.90.0/24

volumes:
  adlab-conf:
  adlab-lib: