# Samba AD DC for CI (phase 1)

Placeholder. Phase 1 builds a throwaway Samba Active Directory domain controller here
so CI and local end-to-end runs exercise real LDAP over TLS.

Planned contents:

- `Dockerfile` from `debian:bookworm-slim` with samba, provisioned as `PSTEST.LOCAL`.
- Its generated CA exported to `deploy/ci/ci-secrets/ca.pem`, which becomes `LDAP_CA_BUNDLE`.
- `seed.sh`: the OU tree, the 50 PS-* groups from `packetstation ad-groups --list` (one left
  out and one extra, to test the reconcile report), and test users per role. Also multi-role,
  nested, disabled, no-employeeID, duplicate-employeeID and no-role users.

Open question 15: whether the Gitea runner can run this container (overlayfs xattrs,
possibly `SYS_ADMIN`). If not, CI uses a runner with the Docker socket on docker-1.