jump-host/secrets.js.example

'use strict';
//
// jump-host secrets. Copy to your secrets file and fill in.
//   Bare metal:  /etc/jump-host/secrets.js  (install.sh seeds this)
//   Docker:      mount at /config/jump-secrets.js (the entrypoint points
//                CONF_SECRETS at it); or pass the same values as app_* env.
//
// Read by @simpleworkjs/conf via CONF_SECRETS. Precedence (later wins):
//   conf/base.js  <  conf/<NODE_ENV>.js  <  this file  <  app_* env vars.
//
module.exports = {
	name: 'My Org',

	// Standalone mode: run with no LDAP directory and no SSO Manager. When
	// enabled, user auth and host discovery use the ORM-backed stores below
	// instead of `ldap` + `sso` (both become unused). See the README's
	// "Standalone mode" section for how to add users/hosts.
	standalone: {
		enabled: false,
	},

	// ORM config for standalone mode (Sequelize — any dialect works, not just
	// sqlite). Ignored unless standalone.enabled is true.
	orm: {
		dialect: 'sqlite',
		storage: './data/standalone.sqlite',
		logging: false,
	},

	// The directory the users live in (the SSO Manager's OpenLDAP).
	// Unused when standalone.enabled is true.
	//
	// IMPORTANT: bindDN needs, beyond read on ou=people + ou=groups, WRITE on
	// the sshPublicKey attribute of user entries — the jump host injects its
	// own public key into each user's sshPublicKey on first use so it can
	// connect downstream AS that user. Grant it with an OpenLDAP ACL, e.g.:
	//
	//   access to attrs=sshPublicKey
	//       by dn.exact="cn=jumphost,ou=people,dc=example,dc=com" write
	//       by self write
	//       by * read
	//
	// (In the theta-env bundle this ACL is added by the bootstrap for the
	// shared cn=ldapclient service account.)
	ldap: {
		url: 'ldaps://sso.example.com:636',
		bindDN: 'cn=ldapclient,ou=people,dc=example,dc=com',
		bindPassword: 'CHANGE-ME',
		userBase: 'ou=people,dc=example,dc=com',
		groupBase: 'ou=groups,dc=example,dc=com',
		tlsOptions: { rejectUnauthorized: false },
	},

	// SSO Manager directory (inventory) API. apiToken is a personal access
	// token (sso_<id>_<secret>) of any user that can read /api/discovery/*.
	// Unused when standalone.enabled is true.
	sso: {
		url: 'https://sso.example.com',
		apiToken: 'sso_CHANGE_ME',
	},

	ssh: {
		listenPort: 2222,
		hostKeyPath: '/var/lib/jump-host/keys',
		banner: 'Theta42 Jump Host — authorized use only.\n',
		// 'off' = keys only (recommended for a public host); 'local' = passwords
		// only from loopback/RFC1918 clients, keys-only from the internet;
		// 'all' = passwords from anywhere.
		passwordAuth: 'off',
		allowRawIPs: false,
		connectTimeoutMs: 10000,
		idleTimeoutMs: 0,
		maxSessions: 100,
		// Comment on the injected key; also excludes that key from inbound auth.
		keyComment: 'jump-host@my-org',
	},

	web: { port: 3002 },

	// Web UI/API login. Same model as the proxy: OIDC against the SSO for
	// normal users, plus a local anti-lockout admin. Set enabled:true and fill
	// in the endpoints + client creds to turn on "Log in with SSO" (in the
	// theta-env bundle these are provisioned for you).
	oidc: {
		enabled: false,
		issuer: 'https://sso.example.com',
		authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
		tokenEndpoint: 'http://sso-manager:3001/oauth/token',
		userinfoEndpoint: 'http://sso-manager:3001/oauth/userinfo',
		clientId: 'CHANGE_ME',
		clientSecret: 'CHANGE_ME',
		redirectUri: 'https://jump.example.com/api/auth/oidc/callback',
		scopes: ['openid', 'profile', 'email', 'groups'],
		groupsClaim: 'groups',
		usernameClaim: 'preferred_username',
	},

	auth: {
		// OIDC group memberships that grant web UI/API admin access.
		adminGroups: ['app_sso_admin'],
		// Local anti-lockout admin — the first name is bootstrapped as a
		// redis-backed user on first boot (password from localAdminPass below,
		// or a random one printed to the log once). Works even if OIDC is down.
		adminUsers: ['jumpadmin'],
		localAdminPass: 'CHANGE_ME',
	},

	redis: {
		prefix: 'jump_host_',
		redisConf: { url: 'redis://127.0.0.1:6379' },
	},
};