wmantly
1df9916c91
ops/backup.sh snapshots Redis (BGSAVE, dynamic RDB path lookup) and ./config for standalone deployments, with retention. A background service polls GitHub releases every 24h and surfaces an admin-only banner in the UI when a newer version is published.
95 lines
3.1 KiB
JavaScript
95 lines
3.1 KiB
JavaScript
'use strict';
|
|
// Using https://github.com/simpleworkjs/conf to handle configuration
|
|
|
|
module.exports = {
|
|
userModel: 'redis', // pam, redis, ldap
|
|
ldap: {
|
|
url: 'ldap://192.168.1.55:389',
|
|
bindDN: 'cn=ldapclient service,ou=people,dc=theta42,dc=com',
|
|
bindPassword: '__IN SRECREST FILE__',
|
|
searchBase: 'ou=people,dc=theta42,dc=com',
|
|
userFilter: '(objectClass=inetOrgPerson)',
|
|
userNameAttribute: 'uid'
|
|
},
|
|
socketFile: '/var/run/proxy_lookup.socket',
|
|
redis: {
|
|
prefix: 'proxy_'
|
|
},
|
|
|
|
// Lifetime, in seconds, of on-demand wildcard-subdomain cache entries
|
|
// (the is_cache Host records created by Host.addCache). They expire on
|
|
// their own via redis TTL so they stop accumulating and stale routes
|
|
// self-correct. 0 disables expiry (entries live until bustCache/clearCache).
|
|
cacheTTL: 3600,
|
|
|
|
// OpenID Connect login against the SSO. Endpoints come from the SSO's
|
|
// /.well-known/openid-configuration. clientSecret lives in secrets.js.
|
|
// redirectUri MUST be registered on the SSO client and match exactly.
|
|
oidc: {
|
|
enabled: true,
|
|
issuer: 'https://sso.theta42.com',
|
|
authorizationEndpoint: 'https://sso.theta42.com/oauth/authorize',
|
|
tokenEndpoint: 'https://sso.theta42.com/oauth/token',
|
|
userinfoEndpoint: 'https://sso.theta42.com/oauth/userinfo',
|
|
endSessionEndpoint: 'https://sso.theta42.com/oauth/logout',
|
|
clientId: '__SET_ME__',
|
|
// Where the SSO sends the user back. Must be an absolute URL reachable
|
|
// by the browser and registered on the SSO client.
|
|
redirectUri: 'http://localhost:3000/api/auth/oidc/callback',
|
|
scopes: ['openid', 'profile', 'email', 'groups'],
|
|
// Claim on the userinfo response that carries group membership.
|
|
groupsClaim: 'groups',
|
|
// Claim used as the local username.
|
|
usernameClaim: 'preferred_username',
|
|
},
|
|
|
|
// Authorization: how groups map to roles, and which groups are global admin.
|
|
// Per-user overrides are Grant records managed in the app.
|
|
auth: {
|
|
// Members of these SSO/LDAP groups are always global admins.
|
|
adminGroups: [],
|
|
// Optional default role mapping for groups, e.g.
|
|
// { 'dns-team': { role: 'manager', scope: 'domain', domain: 'foo.com' } }
|
|
// { 'proxy-viewers': { role: 'viewer', scope: 'global' } }
|
|
groupRoleMap: {},
|
|
// Local users always treated as global admin (anti-lockout bootstrap).
|
|
adminUsers: ['proxyadmin2'],
|
|
},
|
|
|
|
service:{
|
|
hostScheduler:{
|
|
enabled: true,
|
|
initial: 30000,
|
|
interval: 86400000,
|
|
},
|
|
dynamicDns:{
|
|
enabled: true,
|
|
initial: 15000, // first refresh 15s after start
|
|
interval: 14400000, // then every 4 hours
|
|
},
|
|
updateCheck:{
|
|
enabled: true,
|
|
initial: 30000, // first check 30s after start
|
|
interval: 86400000, // then every 24h
|
|
},
|
|
},
|
|
|
|
// Dynamic DNS: services queried (in order) to learn this box's public IP.
|
|
dynamicDns:{
|
|
ipServices: [
|
|
'https://api.ipify.org',
|
|
'https://icanhazip.com',
|
|
'https://ifconfig.me/ip',
|
|
],
|
|
},
|
|
|
|
// Per-host SSO (#57). Reuses conf.oidc for the identity provider. Sessions
|
|
// are Redis-backed and read directly by OpenResty; the cookie only carries a
|
|
// random session id.
|
|
hostSso:{
|
|
enabled: true,
|
|
sessionTtl: 28800, // 8 hours, in seconds
|
|
cookieName: '__proxy_sso',
|
|
},
|
|
};
|