Updated README.md

group_vars/all

@@ -133,7 +133,7 @@ whitelisted_anonymous_docker_volumes: []
 nginx_configuration_directory:  "/etc/nginx/conf.d/"                            # General configuration dir
 nginx_servers_directory:        "{{nginx_configuration_directory}}servers/"     # Contains server blogs
 nginx_maps_directory:           "{{nginx_configuration_directory}}maps/"        # Contains mappins
-nginx_upstreams_directory:      "{{nginx_configuration_directory}}upstreams/"   # Contains upstream configurations
+nginx_streams_directory:        "{{nginx_configuration_directory}}streams/"     # Contains streams configuration e.g. for ldaps
 nginx_well_known_root:          "/usr/share/nginx/well-known/"                  # Path where well-known files are stored
 nginx_homepage_root:            "/usr/share/nginx/homepage/"                    # Path where the static homepage files are stored
 

roles/docker-ldap/README.md

@@ -22,7 +22,6 @@ This Ansible role provides a streamlined implementation of an LDAP server with T
 
 ### Prerequisites
 - A valid domain name.
-- SSL/TLS certificates (e.g., from Let’s Encrypt).
 - Ansible installed on the deployment host.
 - Docker and Docker Compose installed on the target host.
 
@@ -56,6 +55,7 @@ roles/
       main.yml
     templates/
       docker-compose.yml.j2
+      nginx.stream.conf.j2
 ```
 
 ---
@@ -65,7 +65,7 @@ roles/
 Here’s an example playbook to use this role:
 
 ```yaml
-- name: Deploy LDAP with SSO
+- name: Deploy LDAP
   hosts: ldap_servers
   roles:
     - role: docker-ldap
@@ -100,7 +100,7 @@ Here’s an example playbook to use this role:
    - Configuration driven by environment variables.
 
 2. **phpLDAPadmin**
-   - Accessible on port 8080.
+   - Accessible on port 443.
    - Simplifies LDAP management via a web interface.
 
 3. **Healthchecks**
@@ -109,14 +109,12 @@ Here’s an example playbook to use this role:
 ### **Directory Structure**
 
 The following directories are mounted in the container:
-- **Certificates:** `{{cert_mount_directory}}` for TLS certificates.
 - **LDAP Data:** `data:/bitnami/openldap` for persistent data storage.
 
 ---
 
 ## 🔒 **Security Recommendations**
 - Always use strong passwords for `ldap_administrator_password`.
-- Ensure proper file permissions for mounted certificate files.
 - Restrict access to phpLDAPadmin by binding it to `127.0.0.1` or using a reverse proxy.
 
 ---
@@ -125,7 +123,6 @@ The following directories are mounted in the container:
 - [Bitnami OpenLDAP](https://hub.docker.com/r/bitnami/openldap)
 - [phpLDAPadmin Documentation](https://github.com/leenooks/phpLDAPadmin/wiki/Docker-Container)
 - [LDAP Account Manager](https://github.com/LDAPAccountManager/docker)
-
 ---
 
 
@@ -133,5 +130,4 @@ The following directories are mounted in the container:
 
 Kevin Veen-Birkenbach - [veen.world](https://www.veen.world)
 
-Feel free to report issues, suggest features, or contribute to the repository! 😊
+Feel free to report issues, suggest features, or contribute to the repository! 😊
-

roles/docker-ldap/tasks/main.yml

@@ -5,16 +5,18 @@
 - name: "include tasks nginx-docker-proxy-domain.yml"
   include_tasks: nginx-docker-proxy-domain.yml
 
+- name: create {{domain}}.conf
+  template: 
+    src:  "nginx.stream.conf.j2" 
+    dest: "{{nginx_streams_directory}}{{domain}}.conf"
+  notify: restart nginx
+
 - name: "create {{docker_compose_instance_directory}}"
   file:
     path: "{{docker_compose_instance_directory}}"
     state: directory
     mode: 0755
 
-- name: "include the nginx-docker-cert-deploy role"
-  include_role:
-    name: nginx-docker-cert-deploy
-
 - name: add docker-compose.yml
   template: 
     src:  "docker-compose.yml.j2" 

roles/docker-ldap/templates/docker-compose.yml.j2

@@ -16,30 +16,24 @@ services:
       driver: journald
     restart: {{docker_restart_policy}}
     ports:
-      - '127.0.0.1:389:389'   # Expose just on local host for security reasons, phpLDAPadmin requires this
+      - 127.0.0.1:{{ldap_localhost_port}}:{{ldap_localhost_port}}               # Expose just on localhost so that nginx stream proxy can use it
-      - '636:636'             # Expose to internet
+      - 127.0.0.1:{{ldap_secure_localhost_port}}:{{ldap_secure_localhost_port}} # Expose just on localhost
     environment:
       # @See https://hub.docker.com/r/bitnami/openldap
-
+      
       # GENERAL
-      LDAP_ADMIN_USERNAME:    {{ldap_administrator_username}} # LDAP database admin user.
+      LDAP_ADMIN_USERNAME:      {{ldap_administrator_username}} # LDAP database admin user.
-      LDAP_ADMIN_PASSWORD:    {{ldap_administrator_password}} # LDAP database admin password.
+      LDAP_ADMIN_PASSWORD:      {{ldap_administrator_password}} # LDAP database admin password.
-      #LDAP_USERS:            user01,user02                   # Comma separated list of LDAP users to create in the default LDAP tree. Default: user01,user02
+      #LDAP_USERS:              user01,user02                   # Comma separated list of LDAP users to create in the default LDAP tree. Default: user01,user02
-      #LDAP_PASSWORDS:        password1,password2             # Comma separated list of passwords to use for LDAP users. Default: bitnami1,bitnami 
+      #LDAP_PASSWORDS:          password1,password2             # Comma separated list of passwords to use for LDAP users. Default: bitnami1,bitnami 
-      LDAP_ROOT:              {{ldap_root}}                   # LDAP baseDN (or suffix) of the LDAP tree. Default: dc=example,dc=org
+      LDAP_ROOT:                {{ldap_root}}                   # LDAP baseDN (or suffix) of the LDAP tree. Default: dc=example,dc=org
-      LDAP_ADMIN_DN:          {{ldap_admin_dn}}
+      LDAP_ADMIN_DN:            {{ldap_admin_dn}}
-      LDAP_PORT_NUMBER:       389                             # Route to default port
+      LDAP_PORT_NUMBER:         {{ldap_localhost_port}}         # Route to default port
 
       # TLS
-      LDAP_ENABLE_TLS:          yes                         # Whether to enable TLS for traffic or not. Defaults to no
+      LDAP_ENABLE_TLS:          no                              # Using nginx proxy
-      LDAP_REQUIRE_TLS:         no                          # Deactivated so that it can be accessed on the server itself via phpldapadmin
+      LDAP_LDAPS_PORT_NUMBER:   {{ldap_secure_localhost_port}}  # Port used for TLS secure traffic. Priviledged port is supported (e.g. 636). Default: 1636 (non privileged port).
-      LDAP_LDAPS_PORT_NUMBER:   636                         # Port used for TLS secure traffic. Priviledged port is supported (e.g. 636). Default: 1636 (non privileged port).
-      LDAP_TLS_CERT_FILE:       /certs/cert.pem             # File containing the certificate file for the TLS traffic. No defaults.
-      LDAP_TLS_KEY_FILE:        /certs/key.pem              # File containing the key for certificate. No defaults.
-      LDAP_TLS_CA_FILE:         /certs/chain.pem            # File containing the CA of the certificate. No defaults.
-      #LDAP_TLS_DH_PARAMS_FILE:                             # File containing the DH parameters. No defaults.
     volumes:
-      - {{cert_mount_directory}}:/certs:ro
       - 'data:/bitnami/openldap'
     healthcheck:
       test: >

roles/docker-ldap/templates/nginx.stream.conf.j2

@@ -0,0 +1,10 @@
+server {
+    listen {{ldap_secure_internet_port}} ssl;
+    proxy_pass 127.0.0.1:{{ldap_localhost_port}};
+
+    # SSL Configuration for LDAPS
+    ssl_certificate /etc/letsencrypt/live/{{domain}}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{domain}}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+}

roles/docker-ldap/vars/main.yml

@@ -1,4 +1,6 @@
 docker_compose_project_name:  "ldap"
 ldap_root:                    "dc={{primary_domain_sld}},dc={{primary_domain_tld}}"
 ldap_admin_dn:                "cn={{ldap_administrator_username}},{{ldap_root}}"
-cert_mount_directory:         "{{docker_compose_instance_directory}}/certs/"
+ldap_secure_localhost_port:   1636
+ldap_secure_internet_port:    636
+ldap_localhost_port:          389

roles/nginx/tasks/main.yml

@@ -19,7 +19,7 @@
   loop:
     - "{{nginx_servers_directory}}"
     - "{{nginx_maps_directory}}"
-    - "{{nginx_upstreams_directory}}"
+    - "{{nginx_streams_directory}}"
   when: run_once_nginx is not defined
 
 - name: create nginx config file

roles/nginx/templates/nginx.conf.j2

@@ -33,8 +33,12 @@ http
   gzip_min_length 256;
   gzip_types application/atom+xml application/javascript application/xml+rss application/x-javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy text/javascript text/xml;
 
-  types_hash_max_size 4096;
+  types_hash_max_size 4096;  
-  include {{nginx_upstreams_directory}}*.conf;
   include {{nginx_maps_directory}}*.conf;
   include {{nginx_servers_directory}}*.conf;
 }
+
+# For port proxies
+stream{
+  include {{nginx_streams_directory}}*.conf;
+}