# Standalone macvlan variant: the DC owns its own address on the LAN segment, so physical
# Windows 11 clients can reach it without giving the container the host's network stack.
#
# Two things to know about macvlan:
#   * by default a macvlan container CANNOT talk to its own host. If you need that, add a
#     macvlan interface on the host too (`ip link add link <if> macvlan1 type macvlan
#     mode bridge ...`) or just use network_mode: host from the base compose file.
#   * pick an IP that your DHCP server will never hand out (or reserve it).
name: windowsad-lan

services:
  ad-dc:
    image: local/samba-ad-dc:4.22-debian13
    container_name: ad-dc
    hostname: dc1.ad.example.com
    env_file:
      - .env
    environment:
      # MUST match ipv4_address below - this is what lands in the DC's DNS A record.
      AD_IP: 192.168.5.50
    networks:
      lan:
        ipv4_address: 192.168.5.50
    volumes:
      - ./conf:/etc/samba
      - ./data/samba:/var/lib/samba
      - ./secrets:/run/ad-secrets:ro
      - /etc/localtime:/etc/localtime:ro
    stop_grace_period: 90s
    restart: unless-stopped
    cap_drop: [ALL]
    cap_add: [CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE,
              SYS_NICE, SYS_RESOURCE, AUDIT_WRITE,
              SYS_ADMIN]  # security.NTACL xattr writes (SYSVOL/NETLOGON ACLs)

networks:
  lan:
    name: adlan
    driver: macvlan
    driver_opts:
      parent: br0                 # <- your LAN interface or bridge
    ipam:
      config:
        - subnet: 192.168.5.0/24
          gateway: 192.168.5.1
          ip_range: 192.168.5.48/28