# FreeIPA — domain-controller.sweet.home

FreeIPA 4.x identity management server providing Kerberos, LDAP, and
integrated DNS for the `sweet.home` LAN. Runs on Rocky Linux 9 in a
Proxmox VM (VMID 108 on `pve1.sweet.home`).

## Quick status

| Item | Value |
|------|-------|
| Host | `domain-controller.sweet.home` |
| IP | `192.168.2.253` (static) |
| Realm | `SWEET.HOME` |
| Domain | `sweet.home` |
| IPA version | 4.13.x (Rocky Linux 9) |
| Web UI | `https://domain-controller.sweet.home/ipa/ui/` |
| VMID | 108 on `pve1.sweet.home` |
| OS | Rocky Linux 9 (GenericCloud image) |

## What it provides

- **Kerberos KDC** — SSO tickets for the `SWEET.HOME` realm
- **LDAP directory** — centralised user/group/host store (389-ds)
- **Integrated DNS** — authoritative for `sweet.home` and primary LAN
  resolver for all hosts, forwarding everything else to the LAN gateway
- **CA** — self-signed CA issuing certs for IPA services
- **Web UI** — at `https://domain-controller.sweet.home/ipa/ui/`

## First-time use

```bash
# SSH to the server
ssh wayne@domain-controller

# Get a Kerberos ticket as admin
kinit admin

# List IPA users
ipa user-find

# Add a user
ipa user-add jdoe --first=John --last=Doe --password

# Check service health
ipactl status
```

## Credentials

The `admin` Kerberos password and Directory Manager password were
generated at install time. They are **not stored in this repo** — keep
them in your password manager.

- **admin** — used for day-to-day IPA management (`kinit admin`)
- **Directory Manager** — low-level LDAP root, rarely needed

To reset the admin password (requires being logged in as admin):
```bash
kinit admin
ipa passwd admin
```

## Ports required (firewalld)

FreeIPA's firewalld config is applied by `ipa-server-install` automatically.
The following ports must be reachable from LAN clients:

| Port | Proto | Service |
|------|-------|---------|
| 80 | TCP | HTTP (redirect to HTTPS) |
| 443 | TCP | HTTPS / Web UI |
| 389 | TCP | LDAP |
| 636 | TCP | LDAPS |
| 88 | TCP+UDP | Kerberos |
| 464 | TCP+UDP | Kerberos password change |
| 53 | TCP+UDP | DNS |

## Reproducing this setup

See `docs/install.md` for the full step-by-step install procedure,
or run `scripts/install.sh` on a fresh Rocky Linux 9 VM with the
correct hostname and IP already set.

## Backup

The CA certificates (required for replicas) are at `/root/cacert.p12`
on the server, encrypted with the Directory Manager password.
Back these up to a secure location.