I’m running mostly Apple stuff on one of my LANs, and while macOS has some limited support for running OpenDirectory as a server Apple abandoned Apple Server configuration support a long time ago. I would like to either modify Samba on Scale 25.10.3+ to act as a KDC (I don’t use AD), or perhaps create a custom app or container that would allow the TrueNAS server to be a KDC and TGT server.
This should be feasible, and would solve a lot of issues around both NFS security on TrueNAS as well as provide better cross-computer UID/GID management. Granted that the biggest hurdle seems to be insecure boots on TrueNAS CE and the lack of encrypted .ix-app folders, this seems like it could be implemented as a custom app or perhaps a VM container.
My system is TrueNAS Scale 25.10.3 currently, and the clock discipline is ≤ 5μs on an old N100 outfitted with GPS for Stratum 1 time service and a bunch of fixups via TrueNAS middleware that I optimized in the UI to improve Chrony accuracy at boot. This seems suitable for a KDC, but I can’t quite figure out how to properly implement this securely with the current app/container infrastructure.
Any advice from the community other than “don’t do it?”