wmantly
36e9d5b0b3
An SSH jump host that authenticates users against the shared LDAP directory, authorizes them from the SSO Manager's inventory graph, and bridges them to downstream hosts — auditing everything. - Username-grammar routing (uid_-_target@jump) + interactive TUI picker - Inbound LDAP auth (publickey / password with off|local|all policy) - Directory-driven access (LDAP groups x /api/discovery/resources?group=) - Per-user key injection into sshPublicKey, connects downstream as the user - Shell / exec / SFTP-subsystem bridging (WinSCP works) - Web UI + HTTP API (:3002) for audit + metrics; LDAP-admin gated - Packaged like proxy: ops/install.sh + systemd, all-in-one Docker, compose - Tests: 23 unit + 3 integration (node --test), all green Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
699 B
Plaintext
40 lines
699 B
Plaintext
# .git is intentionally NOT excluded — the gitinfo build stage reads it to
|
|
# bake the commit hash, then it's discarded before the final stage.
|
|
.gitignore
|
|
|
|
# Docs not needed in the image (README/CHANGELOG/DEPLOYMENT are copied explicitly).
|
|
docs/
|
|
*.md
|
|
!README.md
|
|
!CHANGELOG.md
|
|
!DEPLOYMENT.md
|
|
|
|
# Tests
|
|
nodejs/test/
|
|
|
|
# Host dependency tree — let the image run a clean npm ci.
|
|
nodejs/node_modules
|
|
|
|
# Local dev state
|
|
nodejs/data
|
|
data/
|
|
|
|
# Secrets (mount at runtime instead)
|
|
nodejs/conf/secrets.js
|
|
secrets.js
|
|
config/
|
|
|
|
# Docker (prevent recursive copy)
|
|
Dockerfile*
|
|
docker-compose.yml
|
|
.dockerignore
|
|
|
|
# Ops (systemd/install run on the host, not in the image)
|
|
ops/
|
|
|
|
# IDE / OS
|
|
.vscode
|
|
.idea
|
|
*.swp
|
|
.DS_Store
|