mirror of
https://github.com/funkypenguin/geek-cookbook/
synced 2026-09-22 18:27:08 +00:00
Correct spelling of recipes once and for all
This commit is contained in:
David Young
@@ -0,0 +1,100 @@
|
||||
don't use special characetrs in your password
|
||||
|
||||
|
||||
perl -pi -e "s/<termination (.*)>.*<\/termination>/<termination \1>${termination}<\/termination>/" /etc/loolwsd/loolwsd.xml
|
||||
|
||||
Cretaed /var/data/collabora/loolwsd.xml and bind-mounted it for editing ssl bool = false
|
||||
|
||||
docker-compose.yml
|
||||
|
||||
```
|
||||
version: "3.0"
|
||||
|
||||
services:
|
||||
local-collabora:
|
||||
image: funkypenguin/collabora
|
||||
# the funkypenguin version has a patch to include "termination" behind SSL-terminating reverse proxy (traefik)
|
||||
#image: collabora/code
|
||||
env_file: /var/data/config/collabora/collabora.env
|
||||
volumes:
|
||||
- /var/data/collabora/loolwsd.xml:/etc/loolwsd/loolwsd.xml
|
||||
cap_add:
|
||||
- MKNOD
|
||||
ports:
|
||||
- 9980:9980
|
||||
```
|
||||
|
||||
nginx.conf
|
||||
|
||||
```
|
||||
upstream collabora-upstream {
|
||||
# Run collabora under docker-compose, since it needs MKNOD cap, which can't be provided by Docker
|
||||
server 172.17.0.1:9980;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name collabora.observe.global;
|
||||
|
||||
# static files
|
||||
location ^~ /loleaflet {
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Host $http_host;
|
||||
}
|
||||
|
||||
# WOPI discovery URL
|
||||
location ^~ /hosting/discovery {
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Host $http_host;
|
||||
}
|
||||
|
||||
# Main websocket
|
||||
location ~ /lool/(.*)/ws$ {
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_read_timeout 36000s;
|
||||
}
|
||||
|
||||
# Admin Console websocket
|
||||
location ^~ /lool/adminws {
|
||||
proxy_buffering off;
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_read_timeout 36000s;
|
||||
}
|
||||
|
||||
# download, presentation and image upload
|
||||
location ~ /lool {
|
||||
proxy_pass https://collabora-upstream;
|
||||
proxy_set_header Host $http_host;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
collabora.yml
|
||||
```
|
||||
version: "3.0"
|
||||
|
||||
services:
|
||||
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
networks:
|
||||
- traefik_public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.frontend.rule=Host:collabora.observe.global
|
||||
- traefik.docker.network=traefik_public
|
||||
- traefik.port=80
|
||||
- traefik.frontend.passHostHeader=true
|
||||
volumes:
|
||||
- /var/data/collabora/nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
||||
|
||||
networks:
|
||||
traefik_public:
|
||||
external: true
|
||||
```
|
||||
@@ -0,0 +1,62 @@
|
||||
docker run -ti --rm \
|
||||
-v "$(pwd)"/letsencrypt:/etc/letsencrypt \
|
||||
-v "$(pwd)"/cloudflare.ini:/cloudflare.ini \
|
||||
certbot/dns-cloudflare \
|
||||
certonly \
|
||||
--dns-cloudflare \
|
||||
--dns-cloudflare-credentials=/cloudflare.ini \
|
||||
-d mail.observe.global
|
||||
|
||||
|
||||
|
||||
```
|
||||
root@cloud:/var/data/docker-mailserver# docker run -ti --rm -v "$(pwd)"/letsencrypt:/etc/letsencrypt -v "$(pwd)"/cloudflare.ini:/cloudflare.ini certbot/dns-cloudflare certonly --dns-cloudflare --dns-cloudflare-credentials=/cloudflare.ini -d mail.observe.global
|
||||
Saving debug log to /var/log/letsencrypt/letsencrypt.log
|
||||
Plugins selected: Authenticator dns-cloudflare, Installer None
|
||||
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
|
||||
cancel): cam@0sum.club
|
||||
|
||||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
Please read the Terms of Service at
|
||||
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
|
||||
agree in order to register with the ACME server at
|
||||
https://acme-v02.api.letsencrypt.org/directory
|
||||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
(A)gree/(C)ancel: A
|
||||
|
||||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
Would you be willing to share your email address with the Electronic Frontier
|
||||
Foundation, a founding partner of the Let's Encrypt project and the non-profit
|
||||
organization that develops Certbot? We'd like to send you email about our work
|
||||
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
|
||||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
(Y)es/(N)o: N
|
||||
Obtaining a new certificate
|
||||
Performing the following challenges:
|
||||
dns-01 challenge for mail.observe.global
|
||||
Unsafe permissions on credentials configuration file: /cloudflare.ini
|
||||
Waiting 10 seconds for DNS changes to propagate
|
||||
Waiting for verification...
|
||||
Cleaning up challenges
|
||||
|
||||
IMPORTANT NOTES:
|
||||
- Congratulations! Your certificate and chain have been saved at:
|
||||
/etc/letsencrypt/live/mail.observe.global/fullchain.pem
|
||||
Your key file has been saved at:
|
||||
/etc/letsencrypt/live/mail.observe.global/privkey.pem
|
||||
Your cert will expire on 2019-01-30. To obtain a new or tweaked
|
||||
version of this certificate in the future, simply run certbot
|
||||
again. To non-interactively renew *all* of your certificates, run
|
||||
"certbot renew"
|
||||
- Your account credentials have been saved in your Certbot
|
||||
configuration directory at /etc/letsencrypt. You should make a
|
||||
secure backup of this folder now. This configuration directory will
|
||||
also contain certificates and private keys obtained by Certbot so
|
||||
making regular backups of this folder is ideal.
|
||||
- If you like Certbot, please consider supporting our work by:
|
||||
|
||||
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
|
||||
Donating to EFF: https://eff.org/donate-le
|
||||
|
||||
root@cloud:/var/data/docker-mailserver#
|
||||
```
|
||||
@@ -0,0 +1,122 @@
|
||||
https://edenmal.moe/post/2018/GitLab-Keycloak-SAML-2-0-OmniAuth-Provider/
|
||||
|
||||
OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL
|
||||
OAUTH_SAML_IDP_CERT_FINGERPRINT
|
||||
OAUTH_SAML_IDP_SSO_TARGET_URL
|
||||
OAUTH_SAML_ISSUER
|
||||
OAUTH_SAML_NAME_IDENTIFIER_FORMAT
|
||||
|
||||
|
||||
|
||||
|
||||
gitlab_rails['omniauth_enabled'] = true
|
||||
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
|
||||
gitlab_rails['omniauth_block_auto_created_users'] = false
|
||||
gitlab_rails['omniauth_auto_link_saml_user'] = true
|
||||
gitlab_rails['omniauth_providers'] = [
|
||||
{
|
||||
name: 'saml',
|
||||
label: 'SAML',
|
||||
args: {
|
||||
|
||||
|
||||
|
||||
|
||||
attribute_statements: { username: ['username'] }
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
OAUTH_BLOCK_AUTO_CREATED_USERS=false
|
||||
OAUTH_AUTO_SIGN_IN_WITH_PROVIDER=saml
|
||||
OAUTH_ALLOW_SSO=saml
|
||||
OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL=https://gitlab.observe.global/users/auth/saml/callback
|
||||
OAUTH_SAML_IDP_CERT_FINGERPRINT=41f1c588c928291c5dc30d11161d685231509ab8
|
||||
OAUTH_SAML_IDP_SSO_TARGET_URL=https://keycloak.observe.global/auth/realms/observe/protocol/sam
|
||||
OAUTH_SAML_ISSUER=https://gitlab.observe.global
|
||||
OAUTH_SAML_NAME_IDENTIFIER_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
|
||||
DISBALED_OAUTH_SAML_ATTRIBUTE_STATEMENTS_EMAIL=mail
|
||||
DISBALEDOAUTH_SAML_ATTRIBUTE_STATEMENTS_NAME=cnam
|
||||
DISBALEDOAUTH_SAML_ATTRIBUTE_STATEMENTS_FIRST_NAME=cname
|
||||
DISBALEDOAUTH_SAML_ATTRIBUTE_STATEMENTS_LAST_NAME=sn
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "https://gitlab.observe.global",
|
||||
"rootUrl": "https://gitlab.observe.global",
|
||||
"enabled": true,
|
||||
"redirectUris": [
|
||||
"https://gitlab.observe.global/*"
|
||||
],
|
||||
"protocol": "saml",
|
||||
"attributes": {
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "true",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"saml.server.signature": "true",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"saml.signature.algorithm": "RSA_SHA256",
|
||||
"saml_force_name_id_format": "false",
|
||||
"saml.client.signature": "false",
|
||||
"saml.authnstatement": "true",
|
||||
"saml_name_id_format": "username",
|
||||
"saml.onetimeuse.condition": "false",
|
||||
"saml_signature_canonicalization_method": "http://www.w3.org/2001/10/xml-exc-c14n#"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "email",
|
||||
"protocol": "saml",
|
||||
"protocolMapper": "saml-user-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"attribute.name": "email"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "first_name",
|
||||
"protocol": "saml",
|
||||
"protocolMapper": "saml-user-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"attribute.name": "first_name"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "last_name",
|
||||
"protocol": "saml",
|
||||
"protocolMapper": "saml-user-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"attribute.name": "last_name"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "username",
|
||||
"protocol": "saml",
|
||||
"protocolMapper": "saml-user-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "username",
|
||||
"attribute.name": "username"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICnTCCAYUCBgFmyRcGiTANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdvYnNlcnZlMB4XDTE4MTAzMTA3NDUyMVoXDTI4MTAzMTA3NDcwMVowEjEQMA4GA1UEAwwHb2JzZXJ2ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI/quQQfWBuQgvxpkcqzkPmXmiO/XE9KmSLcoIOJuDMXXmev9WFtXYbKfozjrZgC4P0uPQLAXJU+2hO7U5fkaG2IuORCK/fKp+cD3GXVO38mxpGFdk3k2eTLUOFfVAUXpPT9dYPSs3EpiB/llslErBBG7bkfwHr06xjU2sMqo/pRbKDLvrqAaBMuHlgOHhAVWWxyzQuUF0kxHxsAbpOnzpiMMOZxhKKZiNEpozIOESplIKFsEYiS4w60z5ROmYEBVqMKP5rsEop9XgS+JNaqfjDbW/NOgT13bvxiA6HxEB0UGt2tWxVsnxpzp3v5rxnXzo1wZQO5KQYWNxJT9Wb9sy8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAIyrT5q/TC3CVF7YOAIrPCq+TEANnoaTUuq2BCG6ory+cnnI9T/qoW9c2GVYSrmdQraY8H3o4J+Trjz2OCmuk4Xdp326Lz7hGPuF6i2p9Dmbu696WDlwZHMm+Dn6lMegGb1WKJGAIB9JBss5lHqGbrAxUav9pWukKBZaNsFVnycOMGLQJuROf3jh/MNd7tcIhxAXQxWf//ZfYH7JfeK973L27oGyK+CrxGwsHIsuwSrkJVAPvWPADiPQFqExK/bC1DPGQO4YAV5rCJPTIwXL5I6l5Al2hw1FcAMND2bTA3MgYzg1aQvAJGO7+wQNQYOPkuhR1Hhb1JWGYj1YOdPnG+g==
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
|
||||
https://edenmal.moe/post/2018/GitLab-Keycloak-SAML-2-0-OmniAuth-Provider/
|
||||
@@ -0,0 +1,170 @@
|
||||
# KeyCloak
|
||||
|
||||
!!! warning
|
||||
While this could stand on its own as a standalone recipe, it's a component of the [sso-stack](/recipes/sso-stack/) "_uber-recipe_", and is written in the expectation that the entire SSO stack is being deployed.
|
||||
|
||||
|
||||
|
||||
## Ingredients
|
||||
|
||||
1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
|
||||
2. [Traefik](/ha-docker-swarm/traefik_public) configured per design
|
||||
3. DNS entry for the hostname you intend to use, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
|
||||
|
||||
## Preparation
|
||||
|
||||
### Setup data locations
|
||||
|
||||
We'll need several directories to bind-mount into our container for both runtime and backup data, so create them as follows
|
||||
|
||||
```
|
||||
mkdir /var/data/runtime/keycloak/database
|
||||
mkdir /var/data/keycloak/database-dump
|
||||
```
|
||||
|
||||
### Prepare environment
|
||||
|
||||
Create /var/data/keycloak/keycloak.env, and populate with the following variables, customized for your own domain struction. Take care with LDAP_DOMAIN, this is core to the rest of the [sso-stack](/recipes/sso-stack/), and can't easily be changed later.
|
||||
```
|
||||
# Technically, this could be auto-detected, but we prefer to be prescriptive
|
||||
DB_VENDOR=postgres
|
||||
DB_DATABASE=keycloak
|
||||
DB_ADDR=db
|
||||
DB_USER=keycloak
|
||||
DB_PASSWORD=myuberpassword
|
||||
KEYCLOAK_USER=admin
|
||||
KEYCLOAK_PASSWORD=ilovepasswords
|
||||
|
||||
# This is required to run keycloak behind traefik
|
||||
PROXY_ADDRESS_FORWARDING=true
|
||||
|
||||
# What's our hostname?
|
||||
KEYCLOAK_HOSTNAME=cloud.example.com
|
||||
|
||||
# Tell Postgress what user/password to create
|
||||
POSTGRES_USER=keycloak
|
||||
POSTGRES_PASSWORD=myuberpassword
|
||||
```
|
||||
|
||||
Create /var/data/keycloak/keycloak-backup.env, and populate with the following, so that your database can be backed up to the filesystem, daily:
|
||||
|
||||
```
|
||||
PGHOST=db
|
||||
PGUSER=keycloak
|
||||
PGPASSWORD=myuberpassword
|
||||
BACKUP_NUM_KEEP=7
|
||||
BACKUP_FREQUENCY=1d
|
||||
```
|
||||
|
||||
### Setup Docker Swarm
|
||||
|
||||
Create a docker swarm config file in docker-compose syntax (v3), something like this:
|
||||
|
||||
!!! tip
|
||||
I share (_with my [patreon patrons](https://www.patreon.com/funkypenguin)_) a private "_premix_" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a ```git pull``` and a ```docker stack deploy``` 👍
|
||||
```
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
keycloak:
|
||||
image: jboss/keycloak
|
||||
env_file: /var/data/config/keycloak/keycloak.env
|
||||
networks:
|
||||
- traefik_public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.frontend.rule=Host:keycloak.cloud.example.com
|
||||
- traefik.port=8080
|
||||
- traefik.docker.network=traefik_public
|
||||
|
||||
db:
|
||||
env_file: /var/data/config/keycloak/keycloak.env
|
||||
image: postgres:10.1
|
||||
volumes:
|
||||
- /var/data/runtime/keycloak/database:/var/lib/postgresql/data
|
||||
networks:
|
||||
- traefik_public
|
||||
|
||||
db-backup:
|
||||
image: postgres:10.1
|
||||
env_file: /var/data/config/keycloak/keycloak-backup.env
|
||||
volumes:
|
||||
- /var/data/keycloak/database-dump:/dump
|
||||
# - /etc/localtime:/etc/localtime:ro
|
||||
entrypoint: |
|
||||
bash -c 'bash -s <<EOF
|
||||
trap "break;exit" SIGHUP SIGINT SIGTERM
|
||||
sleep 2m
|
||||
while /bin/true; do
|
||||
pg_dump -Fc > /dump/dump_\`date +%d-%m-%Y"_"%H_%M_%S\`.psql
|
||||
(ls -t /dump/dump*.psql|head -n $$BACKUP_NUM_KEEP;ls /dump/dump*.psql)|sort|uniq -u|xargs rm -- {}
|
||||
sleep $$BACKUP_FREQUENCY
|
||||
done
|
||||
EOF'
|
||||
networks:
|
||||
- traefik_public
|
||||
|
||||
networks:
|
||||
traefik_public:
|
||||
external: true
|
||||
internal:
|
||||
driver: overlay
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.16.39.0/24
|
||||
```
|
||||
|
||||
!!! note
|
||||
Setup unique static subnets for every stack you deploy. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.
|
||||
|
||||
|
||||
## Serving
|
||||
|
||||
### Launch OpenLDAP stack
|
||||
|
||||
Launch the OpenLDAP stack by running ```docker stack deploy keycloak -c <path -to-docker-compose.yml>```
|
||||
|
||||
Log into your new instance at https://**YOUR-FQDN**, and login with the user/password you defined in keycloak.env.
|
||||
|
||||
You start in the "Master" realm - but mouseover the realm name, to a dropdown box allowing you add an new realm:
|
||||
|
||||
|
||||
|
||||
Enter a name for your new realm, and click "_Create_":
|
||||
|
||||
|
||||
|
||||
Once in the desired realm, click on **User Federation**, and click **Add Provider**. On the next page ("_Required Settings_"), set the following:
|
||||
|
||||
* **Edit Mode** : Writeable
|
||||
* **Vendor** : Other
|
||||
* **Connection URL** : ldap://openldap
|
||||
* **Users DN** : ou=People,<your base DN>
|
||||
* **Authentication Type** : simple
|
||||
* **Bind DN** : cn=admin,<your base DN>
|
||||
* **Bind Credential** : <your chosen admin password>
|
||||
|
||||
Save your changes, and then navigate back to "User Federation" > Your LDAP name > Mappers:
|
||||
|
||||
|
||||
|
||||
For each of the following names, click the name, and set the "_Read Only_" flag to "_Off_" (_this enables 2-way sync between KeyCloak and OpenLD_AP)
|
||||
|
||||
* last name
|
||||
* username
|
||||
* email
|
||||
* first name
|
||||
|
||||
|
||||
|
||||
Proceed to setting up [Email](/recipes/sso-stack/docker-mailserver/)...
|
||||
|
||||
## Chef's Notes
|
||||
|
||||
1. I wanted to be able to add multiple networks to KeyCloak (i.e., a dedicated overlay network for LDAP authentication), but the entrypoint used by the container produces an error when more than one network is configured. This could theoretically be corrected in future, with a PR.
|
||||
|
||||
### Tip your waiter (donate) 👏
|
||||
|
||||
Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
|
||||
|
||||
### Your comments? 💬
|
||||
@@ -0,0 +1,403 @@
|
||||
# OpenLDAP with LAM
|
||||
|
||||
!!! warning
|
||||
While this could stand on its own as a standalone recipe, it's a component of the [sso-stack](/recipes/sso-stack/) "_uber-recipe_", and is written in the expectation that the entire SSO stack is being deployed.
|
||||
|
||||
|
||||
|
||||
## Ingredients
|
||||
|
||||
1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
|
||||
2. [Traefik](/ha-docker-swarm/traefik_public) configured per design
|
||||
3. DNS entry for the hostname you intend to use, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
|
||||
|
||||
## Preparation
|
||||
|
||||
### Setup data locations
|
||||
|
||||
We'll need several directories to bind-mount into our container, so create them in /var/data/openldap:
|
||||
|
||||
```
|
||||
mkdir /var/data/openldap/openldap
|
||||
mkdir /var/data/runtime/openldap/
|
||||
```
|
||||
|
||||
### Prepare environment
|
||||
|
||||
Create /var/data/openldap/openldap.env, and populate with the following variables, customized for your own domain struction. Take care with LDAP_DOMAIN, this is core to the rest of the [sso-stack](/recipes/sso-stack/), and can't easily be changed later.
|
||||
```
|
||||
LDAP_DOMAIN=batcave.gotham
|
||||
LDAP_ORGANISATION=BatCave Inc
|
||||
LDAP_ADMIN_PASSWORD=supermansucks
|
||||
LDAP_TLS=false
|
||||
|
||||
# Setup for github
|
||||
OAUTH2_PROXY_CLIENT_ID=
|
||||
OAUTH2_PROXY_CLIENT_SECRET=
|
||||
OAUTH2_PROXY_COOKIE_SECRET=
|
||||
```
|
||||
|
||||
Create ```authenticated-emails.txt```, and populate with the email addresses (matched to GitHub user accounts, in my case) which you want to grant access, using OAuth2.
|
||||
|
||||
### Create config.cfg
|
||||
|
||||
```
|
||||
|
||||
# password to add/delete/rename configuration profiles (default: lam)
|
||||
password: {SSHA}54haBZN/kfgNVJ+W3YJrI2dCic4= iCXkNA==
|
||||
|
||||
# default profile, without ".conf"
|
||||
default: observeglobal
|
||||
|
||||
# log level
|
||||
logLevel: 4
|
||||
|
||||
# log destination
|
||||
logDestination: SYSLOG
|
||||
|
||||
|
||||
# session timeout in minutes
|
||||
sessionTimeout: 30
|
||||
|
||||
# list of hosts which may access LAM
|
||||
allowedHosts:
|
||||
|
||||
# list of hosts which may access LAM Pro self service
|
||||
allowedHostsSelfService:
|
||||
|
||||
# encrypt session data
|
||||
encryptSession: true
|
||||
|
||||
# Password: minimum password length
|
||||
passwordMinLength: 0
|
||||
|
||||
# Password: minimum uppercase characters
|
||||
passwordMinUpper: 0
|
||||
|
||||
# Password: minimum lowercase characters
|
||||
passwordMinLower: 0
|
||||
|
||||
# Password: minimum numeric characters
|
||||
passwordMinNumeric: 0
|
||||
|
||||
# Password: minimum symbolic characters
|
||||
passwordMinSymbol: 0
|
||||
|
||||
# Password: minimum character classes (0-4)
|
||||
passwordMinClasses: 0
|
||||
|
||||
# Password: checked rules
|
||||
checkedRulesCount: -1
|
||||
|
||||
# Password: must not contain part of user name
|
||||
passwordMustNotContain3Chars: false
|
||||
|
||||
# Password: must not contain user name
|
||||
passwordMustNotContainUser: false
|
||||
|
||||
# Email format (default/unix)
|
||||
mailEOL: default
|
||||
|
||||
# PHP error reporting (default/system)
|
||||
errorReporting: default
|
||||
|
||||
# License
|
||||
license:
|
||||
```
|
||||
|
||||
### Create <profile>.cfg
|
||||
|
||||
```
|
||||
# LDAP Account Manager configuration
|
||||
#
|
||||
# Please do not modify this file manually. The configuration can be done completely by the LAM GUI.
|
||||
#
|
||||
###################################################################################################
|
||||
|
||||
# server address (e.g. ldap://localhost:389 or ldaps://localhost:636)
|
||||
ServerURL: ldap://openldap:389
|
||||
|
||||
# list of users who are allowed to use LDAP Account Manager
|
||||
# names have to be seperated by semicolons
|
||||
# e.g. admins: cn=admin,dc=yourdomain,dc=org;cn=root,dc=yourdomain,dc=org
|
||||
Admins: cn=admin,dc=observe,dc=global
|
||||
|
||||
# password to change these preferences via webfrontend (default: lam)
|
||||
Passwd: {SSHA}h39N9+gg/Qf1K/986VkKrjWlkcI= S/IAUQ==
|
||||
|
||||
# suffix of tree view
|
||||
# e.g. dc=yourdomain,dc=org
|
||||
treesuffix: dc=observe,dc=global
|
||||
|
||||
# default language (a line from config/language)
|
||||
defaultLanguage: en_GB.utf8
|
||||
|
||||
# Path to external Script
|
||||
scriptPath:
|
||||
|
||||
# Server of external Script
|
||||
scriptServer:
|
||||
|
||||
# Access rights for home directories
|
||||
scriptRights: 750
|
||||
|
||||
# Number of minutes LAM caches LDAP searches.
|
||||
cachetimeout: 5
|
||||
|
||||
# LDAP search limit.
|
||||
searchLimit: 0
|
||||
|
||||
# Module settings
|
||||
|
||||
modules: posixAccount_user_minUID: 10000
|
||||
modules: posixAccount_user_maxUID: 30000
|
||||
modules: posixAccount_host_minMachine: 50000
|
||||
modules: posixAccount_host_maxMachine: 60000
|
||||
modules: posixGroup_group_minGID: 10000
|
||||
modules: posixGroup_group_maxGID: 20000
|
||||
modules: posixGroup_pwdHash: SSHA
|
||||
modules: posixAccount_pwdHash: SSHA
|
||||
|
||||
# List of active account types.
|
||||
activeTypes: user,group
|
||||
|
||||
|
||||
types: suffix_user: ou=People,dc=observe,dc=global
|
||||
types: attr_user: #uid;#givenName;#sn;#uidNumber;#gidNumber
|
||||
types: modules_user: inetOrgPerson,posixAccount,shadowAccount
|
||||
|
||||
types: suffix_group: ou=Groups,dc=observe,dc=global
|
||||
types: attr_group: #cn;#gidNumber;#memberUID;#description
|
||||
types: modules_group: posixGroup
|
||||
|
||||
# Password mail subject
|
||||
lamProMailSubject: Your password was reset
|
||||
|
||||
# Password mail text
|
||||
lamProMailText: Dear @@givenName@@ @@sn@@,+::++::+your password was reset to: @@newPassword@@+::++::++::+Best regards+::++::+deskside support+::+
|
||||
|
||||
|
||||
|
||||
serverDisplayName:
|
||||
|
||||
|
||||
# enable TLS encryption
|
||||
useTLS: no
|
||||
|
||||
|
||||
# follow referrals
|
||||
followReferrals: false
|
||||
|
||||
|
||||
# paged results
|
||||
pagedResults: false
|
||||
|
||||
referentialIntegrityOverlay: false
|
||||
|
||||
|
||||
# time zone
|
||||
timeZone: Europe/London
|
||||
|
||||
scriptUserName:
|
||||
|
||||
scriptSSHKey:
|
||||
|
||||
scriptSSHKeyPassword:
|
||||
|
||||
|
||||
# Access level for this profile.
|
||||
accessLevel: 100
|
||||
|
||||
|
||||
# Login method.
|
||||
loginMethod: list
|
||||
|
||||
|
||||
# Search suffix for LAM login.
|
||||
loginSearchSuffix: dc=yourdomain,dc=org
|
||||
|
||||
|
||||
# Search filter for LAM login.
|
||||
loginSearchFilter: uid=%USER%
|
||||
|
||||
|
||||
# Bind DN for login search.
|
||||
loginSearchDN:
|
||||
|
||||
|
||||
# Bind password for login search.
|
||||
loginSearchPassword:
|
||||
|
||||
|
||||
# HTTP authentication for LAM login.
|
||||
httpAuthentication: false
|
||||
|
||||
|
||||
# Password mail from
|
||||
lamProMailFrom:
|
||||
|
||||
|
||||
# Password mail reply-to
|
||||
lamProMailReplyTo:
|
||||
|
||||
|
||||
# Password mail is HTML
|
||||
lamProMailIsHTML: false
|
||||
|
||||
|
||||
# Allow alternate address
|
||||
lamProMailAllowAlternateAddress: true
|
||||
|
||||
jobsBindPassword:
|
||||
|
||||
jobsBindUser:
|
||||
|
||||
jobsDatabase:
|
||||
|
||||
jobsDBHost:
|
||||
|
||||
jobsDBPort:
|
||||
|
||||
jobsDBUser:
|
||||
|
||||
jobsDBPassword:
|
||||
|
||||
jobsDBName:
|
||||
|
||||
jobToken: 190339140545
|
||||
|
||||
pwdResetAllowSpecificPassword: true
|
||||
|
||||
pwdResetAllowScreenPassword: true
|
||||
|
||||
pwdResetForcePasswordChange: true
|
||||
|
||||
pwdResetDefaultPasswordOutput: 2
|
||||
|
||||
twoFactorAuthentication: none
|
||||
|
||||
twoFactorAuthenticationURL: https://localhost
|
||||
|
||||
twoFactorAuthenticationInsecure:
|
||||
|
||||
twoFactorAuthenticationLabel:
|
||||
|
||||
twoFactorAuthenticationOptional:
|
||||
|
||||
twoFactorAuthenticationCaption:
|
||||
tools: tool_hide_toolOUEditor: false
|
||||
tools: tool_hide_toolProfileEditor: false
|
||||
tools: tool_hide_toolSchemaBrowser: false
|
||||
tools: tool_hide_toolServerInformation: false
|
||||
tools: tool_hide_toolTests: false
|
||||
tools: tool_hide_toolPDFEditor: false
|
||||
tools: tool_hide_toolFileUpload: false
|
||||
tools: tool_hide_toolMultiEdit: false
|
||||
```
|
||||
|
||||
### Setup Docker Swarm
|
||||
|
||||
Create a docker swarm config file in docker-compose syntax (v3), something like this:
|
||||
|
||||
!!! tip
|
||||
I share (_with my [patreon patrons](https://www.patreon.com/funkypenguin)_) a private "_premix_" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a ```git pull``` and a ```docker stack deploy``` 👍
|
||||
```
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
openldap:
|
||||
image: osixia/openldap
|
||||
env_file: /var/data/config/openldap/openldap.env
|
||||
networks:
|
||||
- traefik_public
|
||||
volumes:
|
||||
- /var/data/openldap/openldap/:/var/lib/ldap
|
||||
- /var/data/runtime/openldap/:/etc/ldap/slapd.d
|
||||
|
||||
lam:
|
||||
image: jacksgt/ldap-account-manager
|
||||
networks:
|
||||
- traefik_public
|
||||
#volumes:
|
||||
#- /var/data/openldap/lam/config/lam.conf:/var/www/html/config/lam.conf
|
||||
|
||||
|
||||
proxy:
|
||||
image: funkypenguin/oauth2_proxy
|
||||
env_file: /var/data/config/openldap/openldap.env
|
||||
networks:
|
||||
- traefik_public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.frontend.rule=Host:lam.example.com
|
||||
- traefik.port=4180
|
||||
volumes:
|
||||
- /var/data/config/openldap/authenticated-emails.txt:/authenticated-emails.txt
|
||||
command: |
|
||||
-cookie-secure=false
|
||||
-upstream=http://lam:8080
|
||||
-redirect-url=https://lam.example.com
|
||||
-http-address=http://0.0.0.0:4180
|
||||
-email-domain=example.com
|
||||
-provider=github
|
||||
-authenticated-emails-file=/authenticated-emails.txt
|
||||
|
||||
|
||||
networks:
|
||||
traefik_public:
|
||||
external: true
|
||||
```
|
||||
|
||||
## Serving
|
||||
|
||||
### Launch OpenLDAP stack
|
||||
|
||||
Launch the OpenLDAP stack by running ```docker stack deploy openldap -c <path -to-docker-compose.yml>```
|
||||
|
||||
Log into your new instance at https://**YOUR-FQDN**. You'll hit the LDAP Account Manager login page, which will look like this:
|
||||
|
||||
|
||||
|
||||
Click on "LAM Configuration" to add a profile.
|
||||
|
||||
|
||||
|
||||
Enter a profile name, and a profile password (twice). Leave the template at "_unix_":
|
||||
|
||||
|
||||
|
||||
When prompted to save your new profile, enter the "master password" ("lam")
|
||||
|
||||
You've created a "profile". Now to configure your profile... Start with "Server Settings", and change your **server address** to ```ldap://openldap:389```, and your **tree suffix** to the base DN you setup in the openldap.env file (above).
|
||||
|
||||
|
||||
|
||||
Under **Security Settings**, alter the list of valid users to "**cn=admin\<your-base-dn\>**"
|
||||
|
||||
|
||||
|
||||
After you save, you'll be redirected to the profile login page, where you'll need to enter the profile details and password you create above.
|
||||
|
||||
Once logged in, click on the "**Account Types"** tab...
|
||||
|
||||
|
||||
|
||||
And for both "_Users_" and "_Groups_", edit the "LDAP Suffix" to match your chosen Base DN, and save your changes:
|
||||
|
||||
|
||||
|
||||
After saving changes to your LAM profile, you'll be redirected to the LAM admin page. Enter your credentials (default admin/admin) to login. On first login, you'll be prompted to create the "ou=People" and "ou=Group" elements. Proceed to create these.
|
||||
|
||||
You've now setup your OpenLDAP directory structure, and hopefully won't have to interact with the "special" LDAP Account Manager interface much again!
|
||||
|
||||
Proceed to setting up [KeyCloak](/recipes/sso-stack/keycloak/)...
|
||||
|
||||
## Chef's Notes
|
||||
|
||||
1. What's not yet documented here is how to make the LAM "profile" configuration persistent. I.e., after each container reload, it's currently necessary to repeat the steps above.
|
||||
|
||||
### Tip your waiter (donate) 👏
|
||||
|
||||
Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
|
||||
|
||||
### Your comments? 💬
|
||||
Reference in New Issue
Block a user