46 lines
1.6 KiB
Text
46 lines
1.6 KiB
Text
# Standalone macvlan variant: the DC owns its own address on the LAN segment, so physical
|
|
# Windows 11 clients can reach it without giving the container the host's network stack.
|
|
#
|
|
# Two things to know about macvlan:
|
|
# * by default a macvlan container CANNOT talk to its own host. If you need that, add a
|
|
# macvlan interface on the host too (`ip link add link <if> macvlan1 type macvlan
|
|
# mode bridge ...`) or just use network_mode: host from the base compose file.
|
|
# * pick an IP that your DHCP server will never hand out (or reserve it).
|
|
name: windowsad-lan
|
|
|
|
services:
|
|
ad-dc:
|
|
image: local/samba-ad-dc:4.22-debian13
|
|
container_name: ad-dc
|
|
hostname: dc1.ad.example.com
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
# MUST match ipv4_address below - this is what lands in the DC's DNS A record.
|
|
AD_IP: 192.168.5.50
|
|
networks:
|
|
lan:
|
|
ipv4_address: 192.168.5.50
|
|
volumes:
|
|
- ./conf:/etc/samba
|
|
- ./data/samba:/var/lib/samba
|
|
- ./secrets:/run/ad-secrets:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
stop_grace_period: 90s
|
|
restart: unless-stopped
|
|
cap_drop: [ALL]
|
|
cap_add: [CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE,
|
|
SYS_NICE, SYS_RESOURCE, AUDIT_WRITE,
|
|
SYS_ADMIN] # security.NTACL xattr writes (SYSVOL/NETLOGON ACLs)
|
|
|
|
networks:
|
|
lan:
|
|
name: adlan
|
|
driver: macvlan
|
|
driver_opts:
|
|
parent: br0 # <- your LAN interface or bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 192.168.5.0/24
|
|
gateway: 192.168.5.1
|
|
ip_range: 192.168.5.48/28
|