kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-01-24 07:52:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Optimized ldap configuration

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach 2025-01-22 11:08:33 +01:00
parent f64da37d92
commit d8afb2ec87
2 changed files with 28 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
group_vars/all
View File

@ -245,10 +245,11 @@ keycloak_version: "latest"
keycloak_administrator_username: "{{administrator_username}}" keycloak_administrator_username: "{{administrator_username}}"
#### LDAP #### LDAP
ldap_version: "latest" ldap_version: "latest"
ldap_admin_version: "2.0.0-dev" # @todo Attention: Change this as fast as released to latest ldap_admin_version: "2.0.0-dev" # @todo Attention: Change this as fast as released to latest
ldap_administrator_username: "{{administrator_username}}" ldap_administrator_username: "{{administrator_username}}"
ldap_administrator_password: "{{user_administrator_initial_password}}" #CHANGE for security reasons ldap_administrator_password: "{{user_administrator_initial_password}}" #CHANGE for security reasons
ldap_administrator_database_password: "{{user_administrator_initial_password}}" #CHANGE for security reasons
#### Listmonk #### Listmonk
listmonk_admin_username: "{{administrator_username}}" listmonk_admin_username: "{{administrator_username}}"

35
roles/docker-ldap/templates/docker-compose.yml.j2
View File

@ -22,22 +22,33 @@ services:
# @See https://hub.docker.com/r/bitnami/openldap # @See https://hub.docker.com/r/bitnami/openldap
# GENERAL # GENERAL
LDAP_ADMIN_USERNAME: {{ldap_administrator_username}} # LDAP database admin user. ## Database
LDAP_ADMIN_PASSWORD: {{ldap_administrator_password}} # LDAP database admin password. LDAP_ADMIN_USERNAME: {{ldap_administrator_username}} # LDAP database admin user.
#LDAP_USERS: user01,user02 # Comma separated list of LDAP users to create in the default LDAP tree. Default: user01,user02 LDAP_ADMIN_PASSWORD: {{ldap_administrator_database_password}} # LDAP database admin password.
#LDAP_PASSWORDS: password1,password2 # Comma separated list of passwords to use for LDAP users. Default: bitnami1,bitnami
LDAP_ROOT: {{ldap_root}} # LDAP baseDN (or suffix) of the LDAP tree. Default: dc=example,dc=org ## Users
LDAP_ADMIN_DN: {{ldap_admin_dn}} #LDAP_USERS: ' ' # Comma separated list of LDAP users to create in the default LDAP tree. Default: user01,user02
LDAP_PORT_NUMBER: {{ldap_localhost_port}} # Route to default port #LDAP_PASSWORDS: ' ' # Comma separated list of passwords to use for LDAP users. Default: bitnami1,bitnami2
LDAP_ROOT: {{ldap_root}} # LDAP baseDN (or suffix) of the LDAP tree. Default: dc=example,dc=org
# TLS
LDAP_ENABLE_TLS: no # Using nginx proxy ## Admin
LDAP_LDAPS_PORT_NUMBER: {{ldap_secure_localhost_port}} # Port used for TLS secure traffic. Priviledged port is supported (e.g. 636). Default: 1636 (non privileged port). LDAP_ADMIN_DN: {{ldap_admin_dn}} # Not well documented. Don't know if this has an effect
LDAP_CONFIG_ADMIN_ENABLED: yes
LDAP_CONFIG_ADMIN_USERNAME: {{ldap_administrator_username}}
LDAP_CONFIG_ADMIN_PASSWORD: {{ldap_administrator_password}}
# Network
LDAP_PORT_NUMBER: {{ldap_localhost_port}} # Route to default port
LDAP_ENABLE_TLS: no # Using nginx proxy for tls
LDAP_LDAPS_PORT_NUMBER: {{ldap_secure_localhost_port}} # Port used for TLS secure traffic. Priviledged port is supported (e.g. 636). Default: 1636 (non privileged port).
# Security
LDAP_ALLOW_ANON_BINDING: yes # Allow anonymous bindings to the LDAP server. Default: yes.
volumes: volumes:
- 'data:/bitnami/openldap' - 'data:/bitnami/openldap'
healthcheck: healthcheck:
test: > test: >
ldapsearch -x -H ldap://localhost:389 -b "{{ldap_root}}" -D "{{ldap_admin_dn}}" -w "{{ldap_administrator_password}}" ldapsearch -x -H ldap://localhost:389 -b "{{ldap_root}}" -D "{{ldap_admin_dn}}" -w "{{ldap_administrator_database_password}}"
interval: 30s interval: 30s
timeout: 10s timeout: 10s
retries: 3 retries: 3