panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
38 lines
1.6 KiB
YAML
38 lines
1.6 KiB
YAML
---
|
|
# samba_ad_dc role defaults — override in group_vars/host_vars.
|
|
# Secrets (samba_ad_admin_password) MUST come from an Ansible Vault file, not here.
|
|
|
|
samba_ad_realm: "AD.EXAMPLE.COM" # DNS realm, uppercase. Delegated subdomain you own.
|
|
samba_ad_domain: "EXAMPLE" # NetBIOS / short name, <=15 chars, uppercase, no dots.
|
|
samba_ad_dc_hostname: "dc1" # short hostname of this DC
|
|
samba_ad_dc_ip: "10.10.10.10" # this DC's static IP (used for /etc/hosts + resolv.conf)
|
|
samba_ad_dns_forwarder: "10.10.10.1" # where the DC forwards non-AD lookups
|
|
|
|
# Reverse DNS zone to create after provision (optional; empty string skips it).
|
|
# Give the in-addr.arpa name directly, e.g. "10.10.10.in-addr.arpa" for 10.10.10.0/24.
|
|
samba_ad_reverse_zone: ""
|
|
|
|
# Extra A records to publish in the AD DNS zone for non-domain hosts (e.g. OpenBao).
|
|
# List of {name, ip}. Added with the DC machine account (-P) — no admin password.
|
|
samba_ad_extra_a_records: []
|
|
|
|
# Re-enable legacy protocols (SMB1/NTLMv1/LANMAN) for Win9x/NT4/2000/XP. INSECURE.
|
|
samba_ad_legacy_clients: false
|
|
|
|
# Package set (Debian/Ubuntu). RHEL-family names differ — adjust if you switch base.
|
|
samba_ad_packages:
|
|
- samba
|
|
- krb5-config
|
|
- krb5-user # kinit/klist for admin + smoke tests
|
|
- winbind
|
|
- smbclient
|
|
- ldb-tools
|
|
- chrony
|
|
|
|
# Distro daemons that MUST be stopped on an AD DC (the unified `samba` service owns these roles).
|
|
samba_ad_conflicting_services:
|
|
- smbd
|
|
- nmbd
|
|
- winbind
|
|
- systemd-resolved # stub listener freed separately; service left running but stub disabled
|