65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
# =====================================================================================
|
|
# ISOLATED LAB DC - used by tests/smoke.sh, handy for local experimentation.
|
|
#
|
|
# * realm TESTLAB.LOCAL, throwaway credentials committed here ON PURPOSE (test only)
|
|
# * `internal: true` network: the container has NO route to your LAN and no LAN route to
|
|
# it, so binding privileged ports here is harmless
|
|
# * named volumes, so it never touches ./conf ./data ./secrets
|
|
#
|
|
# docker compose -f docker-compose.lab.yml up -d
|
|
# docker compose -f docker-compose.lab.yml down -v # destroy
|
|
# =====================================================================================
|
|
name: ad-lab
|
|
|
|
services:
|
|
ad-lab:
|
|
image: local/samba-ad-dc:4.22-debian13
|
|
container_name: ad-lab
|
|
hostname: dc1.testlab.local
|
|
networks:
|
|
adlab:
|
|
ipv4_address: 172.28.90.10
|
|
environment:
|
|
AD_REALM: TESTLAB.LOCAL
|
|
AD_DNS_DOMAIN: testlab.local
|
|
AD_HOSTNAME: dc1
|
|
AD_IP: 172.28.90.10
|
|
AD_CONTAINER: ad-lab
|
|
AD_DNS_FORWARDER: 1.1.1.1 8.8.8.8
|
|
AD_ADMIN_PASSWORD: 'Lab!Only9Tester#2026'
|
|
AD_SMB_SIGNING: required
|
|
AD_SMB_ENCRYPT: desired
|
|
AD_NTLM_AUTH: ntlmv2-only
|
|
AD_LOG_LEVEL: '1'
|
|
volumes:
|
|
- adlab-conf:/etc/samba
|
|
- adlab-lib:/var/lib/samba
|
|
stop_grace_period: 60s
|
|
restart: unless-stopped
|
|
cap_drop: [ALL]
|
|
# SYS_ADMIN is required: Samba persists NT ACLs in the security.NTACL xattr, which
|
|
# the kernel refuses inside a container without it (SYSVOL/NETLOGON ACL writes).
|
|
cap_add:
|
|
- CHOWN
|
|
- FOWNER
|
|
- SETUID
|
|
- SETGID
|
|
- DAC_OVERRIDE
|
|
- NET_BIND_SERVICE
|
|
- SYS_NICE
|
|
- SYS_RESOURCE
|
|
- AUDIT_WRITE
|
|
- SYS_ADMIN
|
|
|
|
networks:
|
|
adlab:
|
|
name: adlab
|
|
driver: bridge
|
|
internal: true
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.90.0/24
|
|
|
|
volumes:
|
|
adlab-conf:
|
|
adlab-lib:
|