# Copyright (C) 2026 Ilker Manap
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# /etc/adc-maas/adc-maas.conf
#
# Defaults for adc-maas-init. DO NOT EDIT THIS FILE. Put per-node settings in
# /etc/adc-maas/conf.d/*.conf, which cloud-init writes from the user-data MAAS
# passes at deploy time; those values override everything here.
#
# A note on terminology, because it trips people up. "Primary" and "backup"
# domain controllers are Windows NT 4 concepts. Active Directory, from Windows
# 2000 onwards, has no such split: every DC is a writable, equal peer and they
# replicate to each other. What does live on exactly one DC at a time are the
# five FSMO roles, one of which is confusingly named "PDC Emulator".
#
# So the real distinction is not primary versus backup, it is:
#
#   AD_MODE=provision   the FIRST DC, which creates the domain
#   AD_MODE=join        every DC after that, which joins the existing domain
#
# All of them then serve logons equally. Losing the first one costs you the FSMO
# roles, which you seize onto another DC — it does not cost you the domain.

# ---------------------------------------------------------------- general
AD_ENABLED=true

# none | provision | join
AD_MODE=none

# ---------------------------------------------------------------- identity
# The Kerberos realm: your DNS domain in UPPERCASE. Use a domain you control and
# that is not your public web domain — EXAMPLE.LAN, AD.EXAMPLE.COM, and so on.
# Never use a bare ".local", which collides with mDNS.
AD_REALM=

# The NetBIOS name: the short, legacy form. Uppercase, at most 15 characters,
# no dots. Conventionally the first label of the realm.
AD_DOMAIN=

# For AD_MODE=provision this becomes the domain Administrator password.
# For AD_MODE=join these are the credentials used to join.
#
# Active Directory enforces password complexity by default: at least 7
# characters and three of upper case, lower case, digit, symbol. A weak password
# makes provisioning fail with an error that does not say so clearly.
AD_ADMIN_PASSWORD=
AD_ADMIN_PASSWORD_FILE=
AD_JOIN_USER=Administrator

# An existing DC to join, by IP or FQDN. Empty means "find one via DNS", which
# only works if this host's resolver already points at the domain.
AD_JOIN_PEER=

# ---------------------------------------------------------------- DNS
# SAMBA_INTERNAL is the Samba-provided DNS server. It is the recommended default
# and needs no separate configuration. BIND9_DLZ hands DNS to BIND with an AD
# backend, which you only want if you need BIND features such as complex views
# or DNSSEC.
AD_DNS_BACKEND=SAMBA_INTERNAL

# Where the DC sends queries it is not authoritative for. Without this the DC
# resolves your domain but nothing else.
AD_DNS_FORWARDER=

# ---------------------------------------------------------------- domain shape
# 2008_R2 is the safe default and interoperates with everything current.
# Raise it only when every DC in the domain supports the higher level.
AD_FUNCTION_LEVEL=2008_R2
AD_SITE=Default-First-Site-Name

# Store POSIX uid/gid attributes in AD. Keep this on if Linux machines will also
# authenticate against the domain; it makes uids consistent across them.
AD_USE_RFC2307=true

# ---------------------------------------------------------------- networking
# Empty means the interface holding the default route.
AD_INTERFACE=

# Subnet allowed to use this DC as an NTP source, e.g. 192.0.2.0/24.
# Domain members need working time: Kerberos rejects a skew over five minutes,
# and the usual symptom is logins failing for no visible reason.
AD_NTP_ALLOW=

# ---------------------------------------------------------------- SYSVOL
# SYSVOL is the share holding Group Policy objects and logon scripts. Windows
# replicates it between DCs with DFS-R. Samba implements neither DFS-R nor its
# predecessor FRS, so without help a policy created on one DC never reaches the
# others and clients behave differently depending on which DC answered them.
#
# The workaround, straight from the Samba wiki, is to pull SYSVOL over rsync
# from the DC holding the PDC Emulator role and then reapply the ACLs from AD.
#
#   auto  replicate on nodes that joined, not on the one that provisioned
#   on    replicate here
#   off   do not replicate; you are handling it another way
#
# This needs a root SSH key on this host that is authorised on the source DC.
# Without one the sync exits with an explanation instead of failing quietly.
AD_SYSVOL_SYNC=auto
AD_SYSVOL_SOURCE=
AD_SYSVOL_INTERVAL=5min

# ---------------------------------------------------------------- misc
AD_WAIT=900
AD_RETRIES=5

# Scrub AD_ADMIN_PASSWORD from conf.d once the domain is up.
AD_WIPE_SECRETS=true