mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-30 08:06:47 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
31 lines
1.3 KiB
YAML
31 lines
1.3 KiB
YAML
network:
|
|
local: True # Activates local network. Necessary for LDIF import routines
|
|
docker: True # Activates docker network to allow other docker containers to connect
|
|
public: False # Set to true in inventory file if you want to expose the LDAP port to the internet
|
|
docker:
|
|
services:
|
|
openldap:
|
|
image: "bitnamilegacy/openldap"
|
|
name: "openldap"
|
|
version: "latest"
|
|
cpus: 1.25
|
|
# Optimized up to 5k user
|
|
mem_reservation: 1g
|
|
mem_limit: 1.5g
|
|
pids_limit: 1024
|
|
network: "openldap"
|
|
volumes:
|
|
data: "openldap_data"
|
|
features:
|
|
ldap: true
|
|
provision:
|
|
# Here it's possible to define what should be imported and updated.
|
|
# It doesn't make sense to let the import run everytime because its very time consuming
|
|
configuration: true # E.g. MemberOf and Hashed Password Configuration
|
|
credentials: true # Administrator Password
|
|
schemas: true # E.g. Nextcloud, Openssl
|
|
users: true # E.g. User, group and role entries
|
|
groups: true # Roles and Groups import
|
|
update: true # User Class updates
|
|
reserved: false # Reserved Users aren't provisioned
|