Q: What software and roles are OK to install on a domain controller (DC)?

A: There is no definite right or wrong here (unless you want to install a major application, such as Exchange, on your DC). Generally, you want a DC to be just a DC, with nothing else, because this reduces possible resource conflicts and exploit vulnerabilities and minimizes patching of other applications that might cause downtime. Ideally, a DC should be easy to replace, just by standing up another DC. When you put other software and roles on a DC, you make it harder to replace it.

There are certain pieces of software and roles you probably will run on your domain controllers which are normal:

While not recommended necessarily, you may also see the following on DCs, and they shouldn't be huge problems:

This isn't exhaustive, but should give you the right ideas about what is common. Just remember to keep your DCs light so they're easy to replace.