---
# Non-secret variables shared by all plays. EDIT THESE to your environment.
# Secrets live in group_vars/vault.yml (encrypted) — see vault.example.yml.

# --- Domain identity (used by both the DC and the Windows join) ---
samba_ad_realm: "AD.DDUPAN.TOP"
samba_ad_domain: "DDUPAN"
samba_ad_dc_hostname: "dc1"
samba_ad_dc_ip: "192.168.10.5"
samba_ad_dns_forwarder: "192.168.10.1"
samba_ad_reverse_zone: "10.168.192.in-addr.arpa"   # reverse of 192.168.10.0/24

# Static records now live in ../../dns/records.yml and are reconciled as complete
# RRsets by the local samba_dns_record module.

# Support legacy clients (Win9x/NT4/2000/XP)? INSECURE — see README "Retro clients".
samba_ad_legacy_clients: false

# --- KMS auto-activation via DNS ---
# Adds a _vlmcs._tcp SRV record so any domain-joined Windows self-activates against
# vlmcsd. Set the IP where vlmcsd listens (:1688); empty string disables.
samba_ad_kms_host_ip: "192.168.10.127"    # vlmcsd runs here (docker, 0.0.0.0:1688)
samba_ad_kms_hostname: "kms"              # A record kms.ad.ddupan.top -> that IP
samba_ad_kms_port: 1688

# --- Windows admin box ---
win_dc_ip: "{{ samba_ad_dc_ip }}"
win_domain_dns_name: "{{ samba_ad_realm | lower }}"
win_domain_admin_user: "{{ samba_ad_domain }}\\Administrator"
win_kms_host: ""                       # e.g. "kms.example.com:1688" (existing vlmcsd)
win_kms_client_key: ""                 # public GVLK for the Windows edition

# --- Secret indirection: real values come from the encrypted vault ---
samba_ad_admin_password: "{{ vault_samba_ad_admin_password }}"
win_domain_admin_password: "{{ vault_samba_ad_admin_password }}"

# --- Service accounts for apps that BIND to LDAP (passwords in vault.yml) ---
# Previously created by hand (svc-authelia); codified so a DC rebuild restores them.
samba_ad_service_accounts:
  - name: svc-pve
    password: "{{ vault_pve_bind_password }}"
    description: "Proxmox VE realm bind + user/group sync (read-only)"

# --- Groups used for RBAC by downstream apps ---
# NOTE: PVE renames synced groups to "<name>-<realm>", so pve-admins becomes
# "pve-admins-ad" inside Proxmox. Grant ACLs to THAT name, not this one.
samba_ad_groups:
  - name: pve-admins
    members: [panxiao81]

  # Gitea maps this OIDC group to site administrators through oauth2.adminGroup.
  # Keep at least one human administrator independent of the local break-glass account.
  - name: gitea-admins
    members: [panxiao81]

  # NetBox: Authelia forward-auth restricts the site to this group, and NetBox maps it
  # to is_superuser + is_staff via REMOTE_AUTH_SUPERUSER_GROUPS / STAFF_GROUPS
  # (../../../apps/netbox). Membership is re-evaluated on every request, so removing someone
  # here revokes their NetBox admin immediately.
  - name: netbox-admins
    members: [panxiao81]

  # Who may log in to AD-joined workstations (SSSD simple_allow_groups).
  # NESTING DIRECTION MATTERS: pve-admins is a MEMBER OF this group, so admins
  # get lab access. The reverse (this group inside pve-admins) would hand every
  # lab user Proxmox Administrator on / — see the ACL in proxmox/ansible.
  - name: retrolab-users
    members: [pve-admins]