%import os
%set %%rootpath=%%current_container.path
%set global %%transcript_ouinon = {'oui': 'yes', 'non': 'no'}
%def get_slave(%%slave, %%iterator, %%default)
 %if %%hasattr(%%iterator, %%slave)
%set %%value = %%getattr(%%iterator, %%slave)
 %else
%set %%value = %%default
 %end if
%return %%value
%end def
%def print_option(%%option, %%slave, %%iterator)
 %if %%hasattr(%%iterator, %%slave)
%set %%value = %%getattr(%%iterator, %%slave)
  %if %%value != None
   %if %%value in %%transcript_ouinon
%set %%value = %%transcript_ouinon[%%value]
   %end if
%return '  {} = {}'.format(%%option, %%value)
  %end if
 %end if
%end def

# Global parameters
[global]
%set %%global_vfs_objects = []
%set %%local_vfs_objects = []
  realm = %%ad_realm.upper()
  workgroup = %%ad_domain.upper()
  netbios name = %%ad_server_netbios_name.upper()
  interfaces = %slurp
%for %%interface in range(0, %%int(%%nombre_interfaces))
%%getVar('adresse_ip_eth' + %%str(%%interface))/%%getVar('adresse_netmask_eth' + %%str(%%interface)) %slurp
%end for

%if %%getVar('autoriser_netbios_ports', 'non') == 'oui'
  disable netbios = no
  smb ports = 445 139
%else
  # disable netbios legacy protocol, only port 445 !
  disable netbios = yes
  smb ports = 445
%end if

%if %%getVar('ad_custom_rpc_port', None) is not None
  rpc server port = %%ad_custom_rpc_port
%end if
%if %%getVar('ad_custom_netlogon_port', None) is not None
  rpc server port:netlogon = %%ad_custom_netlogon_port
%end if

  # protection contre 'rpcclient -U "" -c enumdomusers <ip>'
  restrict anonymous = 2

  # déactivation des partages utilsiateurs
  usershare max shares = 0

%set %%adhomeprefix = %%getVar('ad_home_share_with_domain_prefix', 'oui')
%if %%adhomeprefix == 'non'
  template homedir = /home/adhomes/%U
%end if
  map acl inherit = Yes
  winbind separator = /

%if %%ad_server_role == 'controleur de domaine'
%silent %%global_vfs_objects.append('dfs_samba4')
%silent %%global_vfs_objects.append('acl_xattr')
  # pas de ligne 'vfs objects = dfs_samba4 acl_xattr' sur un DC
  # pas de ligne 'store dos attributes = Yes' sur un DC

%set %%excluded_services = []
  server role = active directory domain controller
 %if %%getVar('ad_ro_dc', 'non') == 'oui'
%silent %%excluded_services.append('-kcc')
 %end if
 %if %%getVar('ad_internal_dns_backend', 'oui') == 'non'
%silent %%excluded_services.append('-dns')
 %else
  %if not %%is_empty(%%adresse_ip_dns)
  dns forwarder = %%custom_join(%%adresse_ip_dns, ' ')
  %end if
 %end if
 %if %%excluded_services
  server services = %%custom_join(%%excluded_services)
 %end if

  # active TLS (pour LDAPS et la maj des mot de passe !
  tls enabled = yes
 %if %%cert_type != 'letsencrypt'
  tls keyfile = /var/lib/samba/private/tls/private/addc.key
  tls certfile = /var/lib/samba/private/tls/certs/addc.crt
  %if os.path.isfile('{}/var/lib/samba/private/tls/certs/ca.pem'.format(%%getVar('container_path_domaine', '')))
  tls cafile = /var/lib/samba/private/tls/certs/ca.pem
  %else
  tls cafile =
  %end if
 %end if
 %if %%ad_hash_sha_256 == 'oui' or %%ad_hash_sha_512 == 'oui'
  password hash userPassword schemes = %slurp
  %if %%ad_hash_sha_256 == 'oui'
CryptSHA256%slurp
   %if not %%is_empty(%%ad_hash_sha_256_rounds)
:rounds=%%ad_hash_sha_256_rounds%slurp
   %end if
  %end if
  %if %%ad_hash_sha_512 == 'oui'
 CryptSHA512%slurp
   %if not %%is_empty(%%ad_hash_sha_512_rounds)
:rounds=%%ad_hash_sha_512_rounds%slurp
   %end if
  %end if
 %else
  #password hash userPassword schemes = CryptSHA256 CryptSHA512
 %end if

%set %%log_level = [%%ad_log_global_level]
%silent %%log_level.extend(['{}:{}'.format(ll, ll.ad_log_specific_level) for ll in %%ad_log_specific_event])
  log level = %%custom_join(%%log_level, ' ')

%else
  # serveur membre, pas de server role !
  security = ADS

 %if %%getVar('ad_utiliser_xattr', 'non') == 'oui'
%silent %%global_vfs_objects.append('acl_xattr')
 %end if
  map acl inherit = Yes
  store dos attributes = Yes

 %if %%getVar('ad_idmap_config_auto', 'oui') == 'non'
  # désactivation onglet sécurité sur le poste client
  nt acl support = no
 %end if
%end if
 %for %%i in %%list_files(%%rootpath + "/etc/samba/conf.d/", '*.global', basename=True)
  include = /etc/samba/conf.d/%%i
 %end for
%if %%ad_idmap_config == 'oui'
 %if %%ad_idmap_config_auto == 'non'
  idmap config * : backend = tdb
  idmap config * : range = %%{ad_idmap_config_tdb_low}-%%{ad_idmap_config_tdb_high}
  %for %%idmap_config_domain in %%ad_idmap_config_domain

  idmap config %%idmap_config_domain:backend = %%idmap_config_domain.ad_idmap_config_backend
  idmap config %%idmap_config_domain:range = %%{idmap_config_domain.ad_idmap_config_low}-%%{idmap_config_domain.ad_idmap_config_high}
  %end for
 %else
  idmap config *:backend = tdb
  idmap config *:range = 2000-999999
  idmap config %%ad_domain.upper():backend = rid
  idmap config %%ad_domain.upper():range = 1000000-1999999
 %end if
%end if

%if %%ad_log_vfs == 'oui' and (not %%is_empty(%%full_audit_on_success) or not %%is_empty(%%full_audit_on_failure))
%silent %%local_vfs_objects.append('full_audit')
%set %%on_success_operations = 'none'
%set %%on_failure_operations = 'none'
 %if %%os.path.isfile(%%rootpath + '/var/lib/samba/.instance_ok')
  %if not %%is_empty(%%full_audit_on_success)
   %set %%on_success_operations = %%custom_join(set(%%full_audit_on_success), ' ')
  %end if
  %if not %%is_empty(%%full_audit_on_failure)
   %set %%on_failure_operations = %%custom_join(set(%%full_audit_on_failure), ' ')
  %end if
 %end if
  full_audit:prefix = %%full_audit_prefix
  full_audit:priority = %%full_audit_priority
  full_audit:facility = %%full_audit_facility
  full_audit:success = %%on_success_operations
  full_audit:failure = %%on_failure_operations
%end if
%if %%global_vfs_objects or %%local_vfs_objects
  vfs objects = %%custom_join(set(%%local_vfs_objects).union(set(%%global_vfs_objects)), ' ')
%end if

  # Tunning options for winbind (cf #31929)
  winbind max clients = %%ad_winbind_max_clients
  winbind request timeout = %%ad_winbind_request_timeout
%if %%ad_enum_users_groups == 'oui'
  winbind enum users  = yes
  winbind enum groups = yes
%end if
  winbind refresh tickets = Yes

%if %%ad_wide_link == 'oui'

  wide links = yes
  unix extensions = no
%end if
%if %%ad_hide_desktop == 'oui'

  hide files = /desktop.ini/
%end if
%if %%ad_remove_oplocks == 'oui'

  oplocks = no
  level2 oplocks = no
%end if
%if %%os.path.isfile(%%rootpath + '/var/lib/samba/.instance_ok')
 %if %%ad_domain_admin_are_admin == 'oui'

  admin users = @"Domain Admins"
 %end if
%end if
%if %%ad_allow_execute == 'oui'

  # REF #22902
  acl allow execute always = True
%end if

%if %%ad_deadtime != 0

  deadtime = %%ad_deadtime
%end if

%if %%getVar('activer_cups', 'non') == 'oui'
 %if %%mode_conteneur_actif == "non" or %%ad_server_role != 'controleur de domaine'
  # impression
  cups server = /var/run/cups/cups.sock:631

[printers]
        comment = All Printers
        path = /var/spool/samba
        #desactivation (#2522)
        #print command = lpr-cups -P %p -o raw %s -r # Utilise le Driver de la station
        printable = yes
        browseable = yes
        available = yes

[print$]
        browseable = yes
        # fixes #1104
        vfs objects =
        path = %%ad_printers_drivers_path
  %if %%ad_control_print_access_with_acl == 'oui'
        read only = no
  %else
        read only = yes
        valid users = @"Print Operators" @"Domain Users"
        write list = @"Print Operators"
        create mask = 0664
        directory mask = 0775
        force group = "Print Operators"
  %end if
 %end if
%end if

%if %%ad_server_role == 'controleur de domaine'
[netlogon]
  comment = Network Logon Service
  path = /home/sysvol/%%ad_realm/scripts
  read only = No
  guest ok = yes
  vfs objects = dfs_samba4 acl_xattr

[sysvol]
  comment = Sysvol Service
  path = /home/sysvol
  read only = No
  guest ok = yes
  vfs objects = dfs_samba4 acl_xattr

%end if

%if %%activer_ad_homes_share == 'oui'
[homes]
%set %%home_vfs_objects = []
%if %%getVar('ad_utiliser_xattr', 'non') == 'oui'
%silent %%home_vfs_objects.append('acl_xattr')
%end if
%if %%getVar('ad_homes_share_recycle', 'non') == 'oui'
%silent %%home_vfs_objects.append('recycle')
  include = /etc/samba/recycle.conf
%end if
%if set(%%home_vfs_objects).difference(%%global_vfs_objects)
  vfs objects = %%custom_join(set(%%home_vfs_objects).union(set(%%global_vfs_objects)), ' ')
%end if
%if %%adhomeprefix == 'oui'
  path = "%%ad_home_share_path/%u"
  root preexec = /usr/share/eole/sbin/create_adhome.sh "%u" "%%ad_home_share_path"
%else
  path = "%%ad_home_share_path/%U"
  root preexec = /usr/share/eole/sbin/create_adhome.sh "%U" "%%ad_home_share_path"
%end if
  comment = Home Directories
  browseable = no
  read only = no
%end if

%if %%activer_ad_profiles_share == 'oui'
[profiles]
  comment = Profiles
  path = "%%ad_profile_share_path"
  read only = No
  # The only way we found ta make Roaming Profile to work (#28551)
  nt acl support = yes
%end if

%if %%ad_additional_share == 'oui'
%for %%share in %%ad_additional_share_name
[%%share]
%set %%share_vfs_objects = []
%if %%getVar('ad_utiliser_xattr', 'non') == 'oui'
%silent %%share_vfs_objects.append('acl_xattr')
%end if
%if %%get_slave('ad_additional_share_recycle', %%share, 'non') == 'oui'
%silent %%share_vfs_objects.append('recycle')
  include = /etc/samba/recycle.conf
%end if
%if set(%%share_vfs_objects).difference(%%global_vfs_objects)
  vfs objects = %%custom_join(set(%%share_vfs_objects).union(set(%%global_vfs_objects)), ' ')
%end if
  path = %%share.ad_additional_share_path
%%print_option('comment', 'ad_additional_share_comment', %%share)
%%print_option('writeable', 'ad_additional_share_writeable', %%share)
%%print_option('browseable', 'ad_additional_share_browseable', %%share)
%%print_option('create mask', 'ad_additional_share_create_mask', %%share)
%%print_option('directory mask', 'ad_additional_share_directory_mask', %%share)
%end for
%end if

%for %%i in %%list_files(%%rootpath + "/etc/samba/conf.d/", '*.conf', basename=True)
include = /etc/samba/conf.d/%%i
%end for
