Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Install a freshly issued/renewed cert into Samba's TLS dir.
+# lego passes the paths in LEGO_CERT_PATH / LEGO_CERT_KEY_PATH.
+set -euo pipefail
+
+TLS="{{ samba_ad_acme_tls_dir }}"
+CRT="${LEGO_CERT_PATH:-{{ samba_ad_acme_dir }}/certificates/{{ samba_ad_acme_domain }}.crt}"
+KEY="${LEGO_CERT_KEY_PATH:-{{ samba_ad_acme_dir }}/certificates/{{ samba_ad_acme_domain }}.key}"
+ISS="${CRT%.crt}.issuer.crt"
+
+install -o root -g root -m 0644 "${CRT}" "${TLS}/cert.pem"
+install -o root -g root -m 0600 "${KEY}" "${TLS}/key.pem"
+[ -s "${ISS}" ] && install -o root -g root -m 0644 "${ISS}" "${TLS}/ca.pem"
+
+# Samba re-reads its TLS credentials PER CONNECTION, so a renewal normally goes
+# live with no restart and no LDAPS downtime (observed 2026-07-25). Do not assume
+# it though: if the served cert does not match what we just installed, the old one
+# is still being handed out and would eventually expire in place. Verify, and only
+# restart if we must — that keeps the common path at zero downtime while making
+# the failure mode loud instead of silent.
+new="$(openssl x509 -noout -fingerprint -sha256 -in "${TLS}/cert.pem" | cut -d= -f2)"
+served="$(echo | timeout 10 openssl s_client -connect 127.0.0.1:636 2>/dev/null \
+          | openssl x509 -noout -fingerprint -sha256 2>/dev/null | cut -d= -f2 || true)"
+
+if [ "${new}" != "${served}" ]; then
+    echo "served cert != installed cert; restarting samba-ad-dc to load it"
+    systemctl restart samba-ad-dc
+else
+    echo "samba already serving the new cert; no restart needed"
+fi
@@ -0,0 +1,9 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Samba AD DC LDAPS certificate (lego, OpenBao ACME http-01)
+After=network-online.target samba-ad-dc.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/samba-acme.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Obtain or renew the DC's LDAPS cert from OpenBao's internal ACME (http-01).
+# lego's `run` does BOTH: it renews only when due (--renew-days) and fires
+# --deploy-hook on any actual create/renew. There is no separate `renew` command
+# in lego v5, and every flag must come AFTER `run`.
+set -euo pipefail
+
+exec {{ samba_ad_acme_bin }} run \
+  --accept-tos \
+  --email "{{ samba_ad_acme_email }}" \
+  --server "{{ samba_ad_acme_server }}" \
+  --http \
+  --http.address "{{ samba_ad_acme_http_address }}" \
+  --domains "{{ samba_ad_acme_domain }}" \
+  --key-type "{{ samba_ad_acme_key_type }}" \
+  --path "{{ samba_ad_acme_dir }}" \
+  --renew-days {{ samba_ad_acme_renew_days }} \
+  --deploy-hook /usr/local/bin/samba-acme-deploy.sh
@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Samba AD DC LDAPS certificate renewal timer
+
+[Timer]
+OnCalendar={{ samba_ad_acme_renew_oncalendar }}
+RandomizedDelaySec=3600
+Persistent=true
+
+[Install]
+WantedBy=timers.target