panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
81 lines
4.1 KiB
YAML
81 lines
4.1 KiB
YAML
---
|
|
# samba_member role defaults — Samba as an Active Directory DOMAIN MEMBER (fileserver).
|
|
# Joins the box to the domain provisioned by the samba_ad_dc role and lets AD users
|
|
# authenticate to its SMB shares via winbind. The existing standalone shares are
|
|
# preserved (see samba_member_shares below) and the machine's own login stack is
|
|
# left untouched (NSS gains winbind, but PAM is NOT modified — no AD OS login).
|
|
#
|
|
# Domain identity (samba_ad_realm / samba_ad_domain / samba_ad_dc_ip) is inherited
|
|
# from group_vars/all/vars.yml — the same values the DC was provisioned with.
|
|
|
|
# NetBIOS name of THIS member (<=15 chars, uppercase). Defaults to the short hostname.
|
|
samba_member_netbios_name: "{{ ansible_facts['hostname'] | upper }}"
|
|
|
|
# --- ID mapping ---------------------------------------------------------------
|
|
# Algorithmic RID backend: deterministic UIDs/GIDs from the AD RID, no RFC2307
|
|
# attributes required. (The DC was provisioned --use-rfc2307, so switching to the
|
|
# `ad` backend for centrally-managed uidNumber/gidNumber is possible later — see README.)
|
|
samba_member_idmap_default_range: "3000-7999" # idmap config * (local/builtin)
|
|
samba_member_idmap_domain_range: "10000-999999" # idmap config DOMAIN (rid)
|
|
|
|
# Strip the DOMAIN\ prefix so AD users appear as bare names (e.g. `alice`, not
|
|
# `DDUPAN\alice`). Only shadows a local account if an AD user shares its name.
|
|
samba_member_use_default_domain: true
|
|
|
|
# Shell/home template applied to AD users by winbind.
|
|
samba_member_template_shell: "/bin/bash"
|
|
samba_member_template_homedir: "/home/%U"
|
|
|
|
# --- Split-DNS ----------------------------------------------------------------
|
|
# The domain member MUST resolve _ldap._tcp / _kerberos._udp SRV records for the
|
|
# realm to discover the DC. The LAN router does NOT forward ad.ddupan.top here, so
|
|
# route just the realm to the DC via a systemd-resolved drop-in. Set false if your
|
|
# resolver already answers realm SRV lookups.
|
|
samba_member_configure_split_dns: true
|
|
|
|
# --- Packages -----------------------------------------------------------------
|
|
# Deliberately NO libpam-winbind: this is a fileserver join, not an OS-login join.
|
|
# libnss-winbind IS included so `getent passwd` / `ls -l` resolve AD owners.
|
|
#
|
|
# Cache refresh is OFF by default: `apt update` refreshes EVERY repo in
|
|
# sources.list.d, and this host's upstream DNS forwarder is unreliable, so a full
|
|
# refresh routinely fails. The member packages are standard Ubuntu main and are
|
|
# already in the local cache. Set true (with `-e samba_member_apt_update_cache=true`)
|
|
# to force a refresh when DNS is healthy and you need newer versions.
|
|
samba_member_apt_update_cache: false
|
|
|
|
samba_member_packages:
|
|
- samba
|
|
- winbind
|
|
- libnss-winbind
|
|
- krb5-user # kinit/klist for the join + smoke tests
|
|
- smbclient
|
|
- ldb-tools
|
|
|
|
# --- Preserved shares ---------------------------------------------------------
|
|
# Custom shares carried over verbatim from the pre-join standalone smb.conf.
|
|
# [printers]/[print$] and the Cockpit `include` are emitted by the template itself.
|
|
samba_member_shares:
|
|
# Guests (e.g. WinPE) get read-only access; the authenticated AD user panxiao81
|
|
# can write (write list). `guest only` is intentionally NOT set — that would force
|
|
# EVERY session to guest and defeat the write list. force user keeps all files
|
|
# owned by the local panxiao81 (uid 1000) that owns /mnt/pool/win.
|
|
- name: win
|
|
options:
|
|
comment: Windows install media (guest RO; panxiao81 RW)
|
|
path: /mnt/pool/win
|
|
browseable: "yes"
|
|
read only: "yes"
|
|
guest ok: "yes"
|
|
# Domain-qualified: a LOCAL panxiao81 (uid 1000) also exists, and a bare name
|
|
# resolves to the local SID, which won't match the connected AD user's SID.
|
|
write list: 'DDUPAN\panxiao81'
|
|
force user: panxiao81
|
|
hosts allow: 192.168.10.0/24 127.0.0.1
|
|
create mask: "0644"
|
|
directory mask: "0755"
|
|
# Files are written 0644 (no Unix +x). Since Samba 4.0, "open for execution"
|
|
# is denied without the execute bit, which blocks running setup.exe/dism off the
|
|
# share from WinPE. Allow execution regardless of the mode bit.
|
|
acl allow execute always: "yes"
|