freeipa quadlet

freeipa.container

@@ -1,24 +1,39 @@
 [Unit]
-Description=FreeIPA Server
+Description=FreeIPA Server with Integrated DNS
 After=network-online.target
 
 [Container]
-Image=gitea.iot.cudanet.org/administrator/quadlets/freeipa-server:almalinux-9-4.12.2
+Image=gitea.iot.cudanet.org/administrator/quadlets/freeipa-server:fedora-rawhide-4.13.1
-ContainerName=freeipa-server
+ContainerName=freeipa
-Network=podman-bridge0:ip=10.0.0.141
+HostName=ipa.iot.cudanet.org
 
-# Remove all IPA_DM_PASSWORD, IPA_ADMIN_PASSWORD, and Exec lines.
+# Network Configuration
-# We want the container to see the volume and say "Ah, I'm already done."
+Network=podman-bridge0
-PodmanArgs=--systemd=always --hostname=ipa.iot.cudanet.org --cgroupns=host --security-opt label=disable --add-host ipa.iot.cudanet.org:10.0.0.141
+IP=10.0.0.141
+PublishPort=53/udp
+PublishPort=53/tcp
+PublishPort=80/tcp
+PublishPort=443/tcp
+PublishPort=389/tcp
+PublishPort=636/tcp
+PublishPort=88/tcp
+PublishPort=88/udp
+PublishPort=464/tcp
+PublishPort=464/udp
+PublishPort=123/udp
 
+# Security and Resources
+ReadOnly=true
+Sysctl=net.ipv4.ip_unprivileged_port_start=53
+Memory=4096m
 Volume=/var/podman/freeipa/data:/data:Z
-AddCapability=CAP_SYS_ADMIN
+
-AddCapability=CAP_NET_ADMIN
+# Arguments
+# Added --setup-dns and --forwarder (using common public DNS as examples)
+Exec=-U -n iot.cudanet.org -r IOT.CUDANET.ORG --hostname=ipa.iot.cudanet.org --setup-dns --forwarder=8.8.8.8 --forwarder=1.1.1.1 --no-host-dns --no-ntp -p e9532a79-417c-4689-b89e-fa9b61b40d4a -a e9532a79-417c-4689-b89e-fa9b61b40d4a --ip-address=10.0.0.141
 
 [Service]
-Notify=false
 Restart=always
-RestartSec=30
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target default.target