81 lines
2.7 KiB
Text
81 lines
2.7 KiB
Text
# =====================================================================================
|
|
# Two kinds of things belong on this list:
|
|
# (a) SECRETS - leaking these is a domain compromise, not a typo
|
|
# (b) RUNNING CONTAINER STATE - reproducible from this repo; committing it would shadow
|
|
# the config that the entrypoint renders from .env on every start
|
|
#
|
|
# What you need to build a container stays tracked: image/, scripts/, tests/, docs/,
|
|
# docker-compose*.yml, Makefile, README.md, .env.example, .dockerignore, this file.
|
|
# =====================================================================================
|
|
|
|
# --- secrets --------------------------------------------------------------------
|
|
# Real configuration: holds the domain administrator password.
|
|
# `.env.*` also catches restore scratch/backups (.env.pre-restore-<ts>, .env.tmp).
|
|
# .env.example is the only member of this family that belongs in git.
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Admin password file, LDAPS CA + leaf + keys, throwaway lab CAs (secrets/tls-lab).
|
|
# NOTE: secrets/tls/ca.key is the trust anchor every joined client has installed. Leak it
|
|
# and someone can mint certificates your whole fleet trusts.
|
|
secrets/*
|
|
!secrets/.gitkeep
|
|
|
|
# Belt-and-braces: never let key material sneak in from anywhere else either.
|
|
*.key
|
|
*.pem
|
|
# (public certs are harmless but only ever live under secrets/, so ignore them too)
|
|
*.crt
|
|
*.p12
|
|
*.pfx
|
|
|
|
# --- running container state ----------------------------------------------------
|
|
# smb.conf as generated/rendered by the entrypoint (source of truth is .env + entrypoint).
|
|
conf/*
|
|
!conf/.gitkeep
|
|
conf-dc2/*
|
|
!conf-dc2/.gitkeep
|
|
|
|
# sam.ldb (NT hashes, Kerberos keys, Backup Key) + SYSVOL + machine account keys.
|
|
# This IS the domain. Treat it as production data, never as source.
|
|
data/*
|
|
!data/.gitkeep
|
|
data/samba
|
|
!data/samba
|
|
data/samba/*
|
|
!data/samba/.gitkeep
|
|
data/samba-dc2
|
|
!data/samba-dc2
|
|
data/samba-dc2/*
|
|
!data/samba-dc2/.gitkeep
|
|
|
|
# --- backups ------------------------------------------------------------------
|
|
# `samba-tool domain backup` archives are whole-domain copies: password hashes and the
|
|
# Backup Key included. They go off-host encrypted, not into version control.
|
|
backups/*
|
|
!backups/.gitkeep
|
|
*.tar.bz2
|
|
*.tgz
|
|
*.sha256
|
|
|
|
# --- per-machine compose overrides ----------------------------------------------
|
|
# Usually local-only (different IP/realm per box). Force-add if you mean to share it:
|
|
# git add -f docker-compose.override.yml
|
|
docker-compose.override.yml
|
|
docker-compose.*.local.yml
|
|
|
|
# --- scratch, logs, editor and OS junk ------------------------------------------
|
|
*.log
|
|
*.tmp
|
|
*.bak
|
|
*.swp
|
|
*~
|
|
.DS_Store
|
|
Thumbs.db
|
|
# test harness scratch that landed inside the tree
|
|
tests/.tmp/
|
|
|
|
# --- python -------------------------------------------------------------------
|
|
__pycache__/
|
|
*.py[co]
|