Tutorials
Learning by doing. Start with Stand up the lab and have a working domain controller, seeded users, and a gated share in a few minutes.
General Hospital Lab
A self-contained Active Directory lab you can stand up in one command, themed as a small-city hospital and its specialty clinics.
Find your way around
Section titled “Find your way around”These docs follow the Diátaxis framework. Pick the box that matches what you need right now.
How-to guides
Task recipes for when you already know the lab. Seed users, build the clinics, publish printers in AD, inject printer faults.
Reference
The exact facts: every .env variable, every make target, the cast roster, the groups and shares, and the network map.
Explanation
Why it is built this way: host networking, the macvlan + bridge detour, the HIPAA group-nesting boundary, and a real upstream Samba bug.
What you get
Section titled “What you get”A real domain controller
Samba provisions a full AD domain on first boot: Kerberos, LDAP/LDAPS, DNS, SMB, the Global Catalog. Real Windows and Linux clients can join it.
A hospital that owns clinics
Users, OUs, managers, security groups, and group-gated file shares modelled as General Hospital and its specialty clinics. The HIPAA boundary is pure group math.
Print and fax, faithfully faked
A CUPS-backed print server stand-in with 77 queues, per-queue ACLs, AD publishing, plus SNMP and IPP device sidecars and controllable fault states.
A read-only replica
An optional RODC so you can exercise write-referral and credential-chaining behaviour, the edge cases a Windows-AD test rig should expose.