93 lines
3.7 KiB
YAML
93 lines
3.7 KiB
YAML
# =====================================================================================
|
|
# Samba AD Domain Controller - production shape.
|
|
#
|
|
# cp .env.example .env && chmod 600 .env
|
|
# make build && make up && make verify
|
|
#
|
|
# WHY host networking by default
|
|
# ----------------------------
|
|
# An AD DC writes *its own IP* into DNS A records and Windows clients then connect to
|
|
# that IP on 88/389/445/3268 plus dynamically allocated DCE-RPC ports. NAT/port
|
|
# publishing breaks that contract: the DC advertises an address the client cannot route
|
|
# to, and group policy / Kerberos / secure channel fail in ways that look like auth bugs.
|
|
# With network_mode: host, host IP == DC IP == the published record: self-consistent.
|
|
#
|
|
# Before `make up`:
|
|
# * nothing may hold TCP/UDP 53 (systemd-resolved stub!), 88, 135, 139, 445, 3268
|
|
# * get the host a DHCP reservation. A DHCP lease change silently rots the DNS A record.
|
|
#
|
|
# Other modes:
|
|
# AD_NETWORK_MODE=adlan -> use the named bridge below (lab; needs published ports)
|
|
# macvlan -> see docs/docker-compose.macvlan.yml.example
|
|
# =====================================================================================
|
|
|
|
name: windowsad
|
|
|
|
x-ad-dc: &ad-dc
|
|
image: local/samba-ad-dc:4.22-debian13
|
|
build:
|
|
context: .
|
|
dockerfile: image/Dockerfile
|
|
args:
|
|
SAMBA_VERSION: "2:4.22.11+dfsg-0+deb13u1" # bump deliberately, see README "Upgrades"
|
|
env_file:
|
|
- .env
|
|
volumes:
|
|
- ./conf:/etc/samba # smb.conf lives here so you can read it on the host
|
|
- ./data/samba:/var/lib/samba # sam.ldb + SYSVOL + private keys -> BACK THIS UP
|
|
- ./secrets:/run/ad-secrets:ro
|
|
- /etc/localtime:/etc/localtime:ro # password expiry / logs follow host TZ
|
|
stop_grace_period: 90s # let SMB sessions and the LDB/BDK close cleanly
|
|
restart: unless-stopped
|
|
# Least privilege this image actually runs with (validated by tests/smoke.sh).
|
|
cap_drop: [ALL]
|
|
cap_add:
|
|
- CHOWN
|
|
- FOWNER
|
|
- SETUID
|
|
- SETGID
|
|
- DAC_OVERRIDE
|
|
- NET_BIND_SERVICE
|
|
- SYS_NICE
|
|
- SYS_RESOURCE
|
|
- AUDIT_WRITE
|
|
# Required: Samba stores NT ACLs in the security.NTACL xattr, which the kernel
|
|
# refuses without CAP_SYS_ADMIN inside a container (provisioning dies on SYSVOL ACLs).
|
|
- SYS_ADMIN
|
|
|
|
services:
|
|
# ---- only / primary domain controller ---------------------------------------------
|
|
ad-dc:
|
|
<<: *ad-dc
|
|
container_name: ${AD_CONTAINER:-ad-dc}
|
|
hostname: ${AD_HOSTNAME:-dc1}.${AD_DNS_DOMAIN:-ad.example.com}
|
|
network_mode: ${AD_NETWORK_MODE:-host}
|
|
|
|
# ---- second domain controller (HA / replica) --------------------------------------
|
|
# Because this uses host networking, run this profile on a SECOND MACHINE with the repo
|
|
# synced to it (or switch to macvlan so each DC gets its own LAN address).
|
|
# In .env set: AD_HOSTNAME2=dc2 AD_IP=<that machine's ip> AD_JOIN_SERVER=dc1.<domain>
|
|
# AD_JOIN_USER=administrator AD_JOIN_PASSWORD=<or secrets/join.password>
|
|
# Then: docker compose --profile replica up -d
|
|
ad-dc2:
|
|
<<: *ad-dc
|
|
profiles: ["replica"]
|
|
container_name: ${AD_CONTAINER2:-ad-dc2}
|
|
hostname: ${AD_HOSTNAME2:-dc2}.${AD_DNS_DOMAIN:-ad.example.com}
|
|
network_mode: ${AD_NETWORK_MODE:-host}
|
|
volumes:
|
|
- ./conf-dc2:/etc/samba
|
|
- ./data/samba-dc2:/var/lib/samba
|
|
- ./secrets:/run/ad-secrets:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
|
|
networks:
|
|
# Only used when AD_NETWORK_MODE=adlan. Kept here so `make up` can be switched to a
|
|
# sandboxed bridge without editing YAML. Real Win11 joins from the LAN will NOT work in
|
|
# this mode - see docs/ for macvlan if you need LAN-reachable without host networking.
|
|
adlan:
|
|
name: adlan
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.90.0/24
|