Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/samba-ad/ansible/roles/ad_sssd_join/defaults/main.yml

@@ -0,0 +1,37 @@
+---
+# Join a Linux host to AD for INTERACTIVE LOGIN, via realmd + SSSD.
+#
+# WHY NOT `samba_member`: that role makes a host an AD member FILE SERVER —
+# smb.conf, smbd/nmbd, winbind in NSS only, and its own comment says
+# "no PAM/login change". It deliberately cannot log a domain user in.
+# This role is the other half: PAM/SSSD so domain users can actually sign in
+# (RDP, console, ssh), with no SMB serving at all.
+#
+# Use samba_member for a fileserver, this for a workstation. A host could run
+# both, but neither implies the other.
+
+ad_sssd_packages:
+  - sssd-ad
+  - sssd-tools
+  - realmd
+  - adcli
+  - krb5-user
+  - oddjob
+  - oddjob-mkhomedir
+  - libnss-sss
+  - libpam-sss
+
+# Domain users log in as `user` rather than `user@realm`.
+ad_sssd_use_fqn: false
+ad_sssd_fallback_homedir: "/home/%u"
+ad_sssd_shell: "/bin/bash"
+
+# Restrict who may log in. EMPTY = every domain user can, which on a lab box
+# reachable from the LAN is broader than it looks. Prefer naming a group.
+# pve-admins is nested INSIDE retrolab-users, so admins get lab login without
+# lab users gaining Proxmox rights. SSSD resolves nested AD groups.
+ad_sssd_allow_groups: [retrolab-users]
+
+# Credentials for the join itself (creates a computer account in AD).
+ad_sssd_join_user: Administrator
+ad_sssd_join_password: "{{ vault_samba_ad_admin_password }}"

infrastructure/samba-ad/ansible/roles/ad_sssd_join/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart sssd
+  ansible.builtin.systemd_service:
+    name: sssd
+    state: restarted

infrastructure/samba-ad/ansible/roles/ad_sssd_join/tasks/main.yml

@@ -0,0 +1,94 @@
+---
+# realmd + SSSD join, for INTERACTIVE LOGIN. See defaults for why this is
+# separate from samba_member.
+#
+# SSSD is Ubuntu's default AD backend (ADSys uses it unless winbind is
+# explicitly selected); winbind is for file/printer sharing and GPO.
+
+- name: Assert required variables
+  ansible.builtin.assert:
+    that:
+      - samba_ad_realm | length > 0
+      - ad_sssd_join_password | length > 0
+    fail_msg: "samba_ad_realm and ad_sssd_join_password (vault_samba_ad_admin_password) are required."
+    quiet: true
+
+- name: Install realmd + SSSD packages
+  ansible.builtin.apt:
+    name: "{{ ad_sssd_packages }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  register: _sssd_pkgs
+  retries: 3
+  delay: 15
+  until: _sssd_pkgs is succeeded
+
+# Kerberos rejects a skew over 5 minutes, and the resulting error names the
+# clock nowhere near clearly enough. Fail here with a useful message instead.
+- name: Check the clock is NTP-synchronised
+  ansible.builtin.command: timedatectl show -p NTPSynchronized --value
+  register: _ntp
+  changed_when: false
+
+- name: Assert time is synchronised
+  ansible.builtin.assert:
+    that: "_ntp.stdout | trim == 'yes'"
+    fail_msg: "Clock is not NTP-synchronised; the Kerberos join will fail on skew."
+    quiet: true
+
+- name: Check whether already joined
+  ansible.builtin.command: "realm list {{ samba_ad_realm | lower }}"
+  register: _realm
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Join the domain
+  # adcli creates the computer account. no_log: the admin password is on argv.
+  ansible.builtin.shell:
+    cmd: >-
+      echo '{{ ad_sssd_join_password }}' |
+      realm join --user={{ ad_sssd_join_user }} {{ samba_ad_realm | lower }}
+  when: samba_ad_realm | lower not in (_realm.stdout | default(''))
+  no_log: true
+  notify: Restart sssd
+
+- name: Deploy sssd.conf
+  ansible.builtin.template:
+    src: sssd.conf.j2
+    dest: /etc/sssd/sssd.conf
+    owner: root
+    group: root
+    mode: "0600"          # sssd refuses to start if this is group/world readable
+  notify: Restart sssd
+
+- name: Create home directories on first login
+  # Without this a domain user logs in with no home and lands in /, which breaks
+  # anything expecting a desktop session.
+  ansible.builtin.command:
+    cmd: pam-auth-update --enable mkhomedir
+  register: _mkhome
+  changed_when: false
+
+- name: Enable and start sssd
+  ansible.builtin.systemd_service:
+    name: sssd
+    enabled: true
+    state: started
+
+- name: Flush handlers before verifying
+  ansible.builtin.meta: flush_handlers
+
+# --- verification: prove the join actually resolves a domain user ------------
+- name: Verify a domain user resolves through NSS
+  ansible.builtin.command: "id {{ ad_sssd_verify_user | default('Administrator') }}"
+  register: _id
+  changed_when: false
+  retries: 6
+  delay: 5
+  until: _id.rc == 0
+
+- name: Report
+  ansible.builtin.debug:
+    msg: "{{ _id.stdout }}"

infrastructure/samba-ad/ansible/roles/ad_sssd_join/templates/sssd.conf.j2

@@ -0,0 +1,23 @@
+# {{ ansible_managed }}
+# SSSD in AD mode: identity + authentication for interactive login.
+[sssd]
+domains = {{ samba_ad_realm | lower }}
+config_file_version = 2
+services = nss, pam
+
+[domain/{{ samba_ad_realm | lower }}]
+id_provider = ad
+access_provider = {{ 'simple' if ad_sssd_allow_groups else 'ad' }}
+{% if ad_sssd_allow_groups %}
+simple_allow_groups = {{ ad_sssd_allow_groups | join(', ') }}
+{% endif %}
+ad_domain = {{ samba_ad_realm | lower }}
+krb5_realm = {{ samba_ad_realm | upper }}
+realmd_tags = manages-system joined-with-adcli
+cache_credentials = true
+krb5_store_password_if_offline = true
+# Log in as `alice`, not `[email protected]`.
+use_fully_qualified_names = {{ 'true' if ad_sssd_use_fqn else 'false' }}
+fallback_homedir = {{ ad_sssd_fallback_homedir }}
+default_shell = {{ ad_sssd_shell }}
+ldap_id_mapping = true