@{
    Parameters = @{
        DomainLabel = @{
            Type = 'string'
            DefaultValue = ''
            Required = $false
            MinLength = 2
            MaxLength = 32
            Pattern = '^[A-Za-z][A-Za-z0-9_-]*$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'Kurzer logischer Bezeichner der Umgebung oder Domaene.'
                    'en-US' = 'Short logical identifier for the environment or domain.'
                }
            }
        }

        DomainFQDN = @{
            Type = 'string'
            DefaultValue = ''
            Required = $true
            Pattern = '^[A-Za-z0-9.-]+$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'Vollqualifizierter DNS-Name der Active-Directory-Domaene.'
                    'en-US' = 'Fully qualified DNS name of the Active Directory domain.'
                }
            }
        }

        DomainNetBIOS = @{
            Type = 'string'
            DefaultValue = ''
            Required = $true
            MinLength = 1
            MaxLength = 15
            Pattern = '^[A-Za-z0-9_-]+$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'NetBIOS-Name der Active-Directory-Domaene.'
                    'en-US' = 'NetBIOS name of the Active Directory domain.'
                }
            }
        }

        ForestMode = @{
            Type = 'string'
            DefaultValue = 'WinThreshold'
            AllowedValues = @(
                'Win2012R2',
                'WinThreshold'
            )
            Metadata = @{
                Description = @{
                    'de-DE' = 'Funktionsebene des Active-Directory-Forests.'
                    'en-US' = 'Functional level of the Active Directory forest.'
                }
            }
        }

        DomainMode = @{
            Type = 'string'
            DefaultValue = 'WinThreshold'
            AllowedValues = @(
                'Win2012R2',
                'WinThreshold'
            )
            Metadata = @{
                Description = @{
                    'de-DE' = 'Funktionsebene der Active-Directory-Domaene.'
                    'en-US' = 'Functional level of the Active Directory domain.'
                }
            }
        }

        DefaultSiteName = @{
            Type = 'string'
            DefaultValue = 'Default-First-Site-Name'
            Required = $true
            MinLength = 1
            MaxLength = 64
            Metadata = @{
                Description = @{
                    'de-DE' = 'Standard-AD-Sitename fuer Domaenencontroller und Subnetze.'
                    'en-US' = 'Default AD site name for domain controllers and subnets.'
                }
            }
        }

        DefaultSubnet = @{
            Type = 'string'
            DefaultValue = ''
            Required = $false
            Pattern = '^$|^\d{1,3}(\.\d{1,3}){3}/\d{1,2}$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'Optionales Standard-Subnetz im CIDR-Format.'
                    'en-US' = 'Optional default subnet in CIDR notation.'
                }
            }
        }

        DomainAdministratorCredentialName = @{
            Type = 'string'
            DefaultValue = 'DomainAdministrator'
            Required = $true
            Sensitive = $true
            Metadata = @{
                Description = @{
                    'de-DE' = 'Name der Credential-Referenz fuer den Domaenenadministrator.'
                    'en-US' = 'Name of the credential reference for the domain administrator.'
                }
            }
        }

        SafeModeAdministratorPasswordSecretName = @{
            Type = 'string'
            DefaultValue = 'SafeModeAdministratorPassword'
            Required = $true
            Sensitive = $true
            Metadata = @{
                Description = @{
                    'de-DE' = 'Name der Secret-Referenz fuer das Safe-Mode-Administrator-Kennwort.'
                    'en-US' = 'Name of the secret reference for the safe mode administrator password.'
                }
            }
        }
    }

    Resources = @{
    NonNodeData = @{
        RequiredModules = @(
            @{
                Name = 'ActiveDirectoryDsc'
                Version = '6.7.1'
            }
        )

        Services = @{
            ActiveDirectory = @{
                Domain = @{
                    Ensure = 'Present'

                    FQDN = "[parameters('DomainFQDN')]"
                    NetBIOS = "[parameters('DomainNetBIOS')]"

                    ForestMode = "[parameters('ForestMode')]"
                    DomainMode = "[parameters('DomainMode')]"

                    DnsDelegation = $false

                    Credentials = @{
                        DomainAdministrator = @{
                            CredentialName = "[parameters('DomainAdministratorCredentialName')]"
                        }

                        SafeModeAdministrator = @{
                            SecretName = "[parameters('SafeModeAdministratorPasswordSecretName')]"
                        }
                    }
                }

                DomainControllers = @(
                    @{
                        NodeName = '*'
                        Ensure = 'Present'
                        InstallDns = $true
                        IsGlobalCatalog = $true
                        SiteName = "[parameters('DefaultSiteName')]"
                    }
                )

                Sites = @(
                    @{
                        Name = "[parameters('DefaultSiteName')]"
                        Ensure = 'Present'
                    }
                )

                Subnets = @(
                    @{
                        Name = "[parameters('DefaultSubnet')]"
                        SiteName = "[parameters('DefaultSiteName')]"
                        Ensure = 'Present'
                    }
                )

                OrganizationalUnits = @(
                    @{
                        Name = 'Servers'
                        Path = "[concat('DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        ProtectedFromAccidentalDeletion = $true
                    }

                    @{
                        Name = 'Service Accounts'
                        Path = "[concat('DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        ProtectedFromAccidentalDeletion = $true
                    }

                    @{
                        Name = 'Groups'
                        Path = "[concat('DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        ProtectedFromAccidentalDeletion = $true
                    }
                )

                Groups = @(
                    @{
                        GroupName = 'GG-SharePoint-Admins'
                        Path = "[concat('OU=Groups,DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Scope = 'Global'
                        Category = 'Security'
                        Ensure = 'Present'
                        Members = @()
                    }
                )

                Users = @(
                    @{
                        UserName = 'SVC_SHP_Setup'
                        Path = "[concat('OU=Service Accounts,DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        Enabled = $true
                        Password = @{
                            SecretName = 'SVC_SHP_Setup'
                        }
                    }
                )

                Trusts = @()

                Dns = @{
                    Forwarders = @()
                    ReverseLookupZones = @()
                }
            }
        }
    }
}
}