---
# roles/samba_ad_dc_defaults/defaults/main.yml

# DNS
samba_ad_dc_dns_forwarders:
  - 10.0.0.5
  - 10.0.0.4

# --- Interface / DNS-registration scoping ---
# A Samba AD DC runs samba_dnsupdate on startup (and periodically), which
# registers an A record for the DC hostname and the realm apex for EVERY IP it
# is bound to. On a multi-homed host (Docker bridge 172.17.0.1, k3s/flannel
# 10.42.0.0 / 10.42.0.1, etc.) those junk IPs land in the prole.org zone and
# get round-robined to clients, producing intermittent "resolves, then doesn't"
# DNS failures. Binding Samba to loopback + the LAN IP only confines both
# service binding and DNS registration to the real service address.
#
# samba_ad_dc_lan_ip MUST be the DC's stable LAN service address. It is left
# empty here and set per host (see inventory/group_vars/ad_dc/vars.yml); the
# role asserts it is non-empty before enabling bind-interfaces-only, so a
# missing value can never silently bind the DC to loopback alone (unreachable).
samba_ad_dc_lan_ip: ""
samba_ad_dc_bind_interfaces_only: true
samba_ad_dc_interfaces: "{{ ['lo'] + ([samba_ad_dc_lan_ip] if (samba_ad_dc_lan_ip | length > 0) else []) }}"

# Identity
# When samba_ad_dc_child_id is set (e.g., A000001), the realm/workgroup/netbios
# will be derived automatically as a child of samba_ad_dc_parent_realm.
samba_ad_dc_parent_realm: "PROLE.ORG"
samba_ad_dc_parent_netbios: "{{ samba_ad_dc_parent_realm.split('.')[0] | upper }}"
samba_ad_dc_child_id: ""
samba_ad_dc_realm: >-
  {{ (samba_ad_dc_child_id | length > 0)
     | ternary((samba_ad_dc_child_id | upper) ~ '.' ~ samba_ad_dc_parent_realm, samba_ad_dc_parent_realm) }}
samba_ad_dc_workgroup: >-
  {{ (samba_ad_dc_child_id | length > 0)
     | ternary((samba_ad_dc_child_id | upper), "PROLE") }}
samba_ad_dc_netbios_name: "{{ inventory_hostname_short | upper }}"
samba_ad_dc_server_string: "{{ samba_ad_dc_realm }} AD DC"

# Role/services
samba_ad_dc_server_role: "active directory domain controller"
samba_ad_dc_server_services: "-smb -winbind"

# RFC2307
samba_ad_dc_rfc2307: true

# Homes
samba_ad_dc_template_homedir: "/prole/home/%U"
samba_ad_dc_template_shell: "/bin/bash"

# Shares
samba_ad_dc_sysvol_path: "/var/lib/samba/sysvol"
samba_ad_dc_netlogon_path: "/var/lib/samba/sysvol/{{ samba_ad_dc_realm | lower }}/scripts"

# K3s/Kubeadm access group
samba_kubeadm_group: "kubeadm"
samba_kubeadm_members:
  - chrisfu