<?xml version="1.0" encoding="utf-8"?>
<creole>

    <files>
        <file filelist='ad-files' name='/etc/logrotate.d/samba'
              source='samba.logrotate'/>
        <file filelist='ad-files' name='/etc/samba/smb.conf'
              source='smb-ad.conf' mkdir='True' rm='True'/>
        <file filelist='ad-files' name='/etc/eole/samba4-vars.conf'
              rm='True'/>
        <file filelist='ad-files' name='/etc/krb5.conf' mkdir='True' rm='True'/>
        <file filelist='ad-files'
              name='/usr/share/eole/bastion/data/90-samba_dynamic_rules'
              mode='0755'
              rm='True'/>
        <file name='/etc/nsswitch.conf'/>
        <!--  https://wiki.samba.org/index.php/Samba_AD_DC_port_usage  -->
        <service_access service='samba'>
            <!-- DNS
                 User and Computer Authentication, Name Resolution, Trusts
            -->
            <port protocol='udp'>53</port>
            <port protocol='tcp'>53</port>

            <!-- Kerberos
                 Usage : User and Computer Authentication, Forest Level Trusts
            -->
            <port protocol='tcp'>88</port>
            <port protocol='udp'>88</port>

            <!-- End Point Mapper (DCE/RPC Locator Service)
                 Replication
            -->
            <port protocol='tcp'>135</port>

            <!-- NetBIOS Name Service -->
            <port protocol='udp'>137</port>

            <!-- NetBIOS Datagram -->
            <port protocol='udp'>138</port>

            <!-- NetBIOS Session -->
            <port protocol='tcp'>139</port>

            <!-- LDAP
                 Usage: Directory, Replication, User and Computer Authentication, Group Policy, Trusts
            -->
            <port protocol='udp'>389</port>
            <port protocol='tcp'>389</port>

            <!-- SMB over TCP
                 Replication, User and Computer Authentication, Group Policy, Trusts
            -->
            <port protocol='tcp'>445</port>

            <!-- Kerberos kpasswd
                 Replication, User and Computer Authentication, Trusts
            -->
            <port protocol='udp'>464</port>
            <port protocol='tcp'>464</port>

            <!-- LDAPS (only if "tls enabled = yes") -->
            <port protocol='tcp'>636</port>

            <!-- Dynamic RPC Ports -->
            <!--
                <port>1024-5000</port> This Range needs to be Open !
            -->

            <!-- RSYNC pour synchronise SysVol ! -->
            <port protocol='tcp'>873</port>

            <!-- Global Cataloge -->
            <port protocol='tcp'>3268</port>

            <!-- Global Cataloge SSL (only if "tls enabled = yes" -->
            <port protocol='tcp'>3269</port>

            <!-- Multicast DNS -->
            <port protocol='tcp'>5353</port>
            <port protocol='udp'>5353</port>

            <!-- RPC, DFSR (SYSVOL)
                 File Replication
            -->
            <port protocol='tcp'>5722</port>
            <port protocol='udp'>5722</port>

            <tcpwrapper>samba</tcpwrapper>

        </service_access>

        <service_access service='samba-member'>
            <!-- End Point Mapper (DCE/RPC Locator Service)
                 Replication
            -->
            <port protocol='tcp'>135</port>

            <!-- NetBIOS Name Service -->
            <port protocol='udp'>137</port>

            <!-- NetBIOS Datagram -->
            <port protocol='udp'>138</port>

            <!-- NetBIOS Session -->
            <port protocol='tcp'>139</port>
            <!-- SMB over TCP
                 Replication, User and Computer Authentication, Group Policy, Trusts
            -->
            <port protocol='tcp'>445</port>
            <tcpwrapper>samba</tcpwrapper>
        </service_access>

        <service servicelist='samba' >samba-ad-dc</service>
        <service servicelist='samba-membre' >smbd</service>
        <service servicelist='samba-membre' >nmbd</service>
        <service servicelist='samba-membre' >winbind</service>
        <service_restriction service='sshd'>
            <ip interface='auto' netmask='255.255.255.255' ip_type='SymLinkOption'>ad_additional_dc_ip</ip>
        </service_restriction>

    </files>

    <variables>

        <family name='Interface-0'>
            <variable name='eth0_method' hidden='True' redefine='True'/>
            <!--
            <variable name='adresse_ip_eth0' auto_freeze='True' redefine='True'/>
            <variable name='adresse_netmask_eth0' auto_freeze='True' redefine='True'/>
            -->
        </family>

        <family name='général'>
            <variable name='nom_machine' auto_freeze='True' redefine='True'/>
            <variable name='nom_domaine_local' auto_freeze='True' redefine='True'/>
        </family>

        <family name='services'>
            <variable name='activer_ad_smb' type='oui/non' description='Activer Samba Active Directory' hidden='True'>
                <value>oui</value>
            </variable>

        </family>

        <family name='Active Directory' icon='group'>

            <variable name="ad_realm" type="domain_strict" description="Nom complet du domaine racine de la forêt"
                      mandatory='True'/>

            <variable name="ad_domain" type="string" description="Nom du domaine"
                      mandatory="True" />

            <variable name="ad_server_role" type="string"
                      description="Rôle du serveur"
                      auto_freeze="True">
                <value>controleur de domaine</value>
            </variable>

            <variable name='ad_additional_dc_ip' type='ip'
                      description="Adresse IP des contrôleurs de domaine faisant partie du même domaine Active Directory"
                      multi='True'>
            </variable>

            <variable name="ad_additional_dc" type="oui/non"
                      description="Définir le contrôleur de domaine comme additionnel">
                <value>non</value>
            </variable>

            <variable name='ad_dc_sysvol_ref' type='ip'
                      description="Adresse IP du contrôleur de référence pour le volume SYSVOL" />

            <variable name="ad_ro_dc" type="oui/non" mode="expert" hidden='True'
                      description="Paramétrer le contrôleur en lecture seule">
                <value>non</value>
            </variable>

            <variable name="activer_ad_homes_share" type="oui/non" description='Créer le partage "homes" ("\\serveur\&lt; login&gt;)' mode="basic">
                <value>oui</value>
            </variable>

            <variable name="activer_ad_profiles_share" type="oui/non" description='Créer le partage "profiles" ("\\serveur\profiles")' mode="basic">
                <value>oui</value>
            </variable>

            <variable name='ad_home_share_path' type='filename'
                      description="Chemin des répetoires personnels des utilisateurs" mode='expert'>
                <value>/home/adhomes</value>
            </variable>

            <variable name='ad_profile_share_path' type='filename'
                      description="Chemin des répetoires contenant les profils des utilisateurs" mode='expert'>
                <value>/home/adprofiles</value>
            </variable>

        </family>

        <separators>
            <separator name='ad_server_role'>Rôle du serveur Active Directory</separator>
            <separator name='activer_ad_homes_share'>Partage de fichiers</separator>
        </separators>

    </variables>

    <constraints>

        <auto name='calc_val' target='ad_realm'>
            <param type='eole' name='valeur'>nom_domaine_local</param>
        </auto>

        <auto name='extract_ad_domain_from_realm' target='ad_domain'>
            <param type='eole' name='realm'>ad_realm</param>
        </auto>

        <check name="valid_enum" target="ad_server_role">
            <param>["controleur de domaine", "membre"]</param>
        </check>

        <condition name='disabled_if_in' source='activer_ad_smb'>
            <param>non</param>
            <target type='filelist'>ad-files</target>
            <target type='servicelist'>samba</target>
            <target type='family'>Active Directory</target>
        </condition>

        <condition name='disabled_if_not_in' source='ad_server_role'>
            <param>controleur de domaine</param>
            <target type='variable'>ad_additional_dc</target>
            <!--Cette variable est hidden pour l'instant...
            <target type='variable'>ad_ro_dc</target>
            -->
            <target type='variable'>ad_additional_dc_ip</target>
        </condition>

        <condition name='disabled_if_in' source='ad_server_role'>
            <param>membre</param>
            <target type='servicelist'>samba</target>
        </condition>

        <condition name='disabled_if_in' source='ad_server_role'>
            <param>controleur de domaine</param>
            <target type='servicelist'>samba-membre</target>
        </condition>

        <condition name='disabled_if_in' source="ad_additional_dc">
            <param>non</param>
            <target type='variable'>ad_dc_sysvol_ref</target>
        </condition>

        <fill name='calc_multi_condition' target='adresse_ip_dns_dhcp'>
            <param>membre</param>
            <param type="eole" name="condition_1" optional="True">ad_server_role</param>
            <param name='default_match'>None</param>
            <param type='eole' name='mismatch'>adresse_ip_eth0</param>
        </fill>

        <condition name='disabled_if_in' source='activer_ad_homes_share'>
            <param>non</param>
            <target type='variable'>ad_home_share_path</target>
        </condition>

        <condition name='disabled_if_in' source='activer_ad_profiles_share'>
            <param>non</param>
            <target type='variable'>ad_profile_share_path</target>
        </condition>

    </constraints>

    <help>
        <family name='Active Directory'>Configuration du serveur Active Directory</family>
        <variable name='activer_ad_smb'>Faire de votre serveur un contrôleur de domaine ou un membre d'un domaine Active Directory</variable>
        <variable name="ad_realm">Nom complètement qualifié de la racine de la forêt Active Directory</variable>
        <variable name="ad_domain">Nom du domaine Active Directory</variable>
        <variable name="ad_server_role">Rôle du serveur (contrôleur de domain, serveur membre)</variable>
        <variable name="ad_additional_dc">Le serveur est un contrôleur de domaine qui sera joint à un domaine existant</variable>
        <variable name='ad_additional_dc_ip'>Les contrôleurs de domaine (DC) doivent connaitre les adresses IP des autres DC faisant partie du même domaine AD pour avoir une liste bien ordonnée des DNS</variable>
        <variable name='ad_dc_sysvol_ref'>Adresse IP d’un contrôleur de domaine utilisé comme référence SYSVOL</variable>
        <variable name='ad_home_share_path'>Répertoire de destination des dossiers personnels des utilisateurs de l'AD</variable>
        <variable name="activer_ad_homes_share">Créer le partage hébergeant les dossiers personnels (Home Directory) des utilisateurs</variable>
        <variable name="activer_ad_profiles_share">Créer les partages hébergeant le dossiers contenant les profils Windows (Profile Path) des utilisateurs</variable>
    </help>

</creole>
