wmantly
36e9d5b0b3
An SSH jump host that authenticates users against the shared LDAP directory, authorizes them from the SSO Manager's inventory graph, and bridges them to downstream hosts — auditing everything. - Username-grammar routing (uid_-_target@jump) + interactive TUI picker - Inbound LDAP auth (publickey / password with off|local|all policy) - Directory-driven access (LDAP groups x /api/discovery/resources?group=) - Per-user key injection into sshPublicKey, connects downstream as the user - Shell / exec / SFTP-subsystem bridging (WinSCP works) - Web UI + HTTP API (:3002) for audit + metrics; LDAP-admin gated - Packaged like proxy: ops/install.sh + systemd, all-in-one Docker, compose - Tests: 23 unit + 3 integration (node --test), all green Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
843 B
YAML
27 lines
843 B
YAML
# Standalone jump-host deployment. For the unified stack, see theta42/theta-env
|
|
# (this same service, gated behind the `jump-host` compose profile).
|
|
#
|
|
# Supply config either by bind-mounting a secrets file at
|
|
# /config/jump-secrets.js (the entrypoint picks it up) or via app_* env vars.
|
|
|
|
services:
|
|
jump-host:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
GIT_COMMIT: ${JUMP_GIT_COMMIT:-}
|
|
container_name: jump-host
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${JUMP_SSH_PORT:-2222}:2222" # SSH front door
|
|
- "${JUMP_WEB_BIND:-0.0.0.0}:${JUMP_WEB_PORT:-3002}:3002" # web UI/API
|
|
environment:
|
|
- NODE_ENV=production
|
|
volumes:
|
|
- ./config:/config:ro # optional: jump-secrets.js
|
|
- jump-data:/var/lib/jump-host # host keys persist across restarts
|
|
|
|
volumes:
|
|
jump-data:
|