# Throwaway Samba Active Directory domain controller for CI and local end-to-end runs.
# Domain PSTEST.LOCAL. Never used outside the CI stack. Never points at PESCO's AD.
# The integrating session may pin this base by digest:
#   docker buildx imagetools inspect debian:bookworm-slim
FROM debian:bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive

# samba brings samba-tool and its python3 bindings. winbind is started by the DC.
# ldb-tools gives ldbmodify for employeeID. openssl makes the CA and the server certificate.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      samba samba-ad-provision samba-dsdb-modules samba-vfs-modules winbind ldb-tools krb5-user \
      openssl ca-certificates tini \
 && rm -rf /var/lib/apt/lists/* \
 && rm -f /etc/samba/smb.conf

COPY entrypoint.sh seed.sh healthcheck.sh /usr/local/bin/
COPY groups.txt /usr/local/share/pstest/groups.txt
RUN chmod 0755 /usr/local/bin/entrypoint.sh /usr/local/bin/seed.sh /usr/local/bin/healthcheck.sh

VOLUME ["/var/lib/samba", "/export"]
EXPOSE 389 636

HEALTHCHECK --interval=10s --timeout=10s --start-period=120s --retries=30 \
  CMD ["/usr/local/bin/healthcheck.sh"]

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]