Dockerize SSO Manager (all-in-one image) + GitHub Pages docs

All-in-one Dockerfile.openldap bundling the app + OpenLDAP + Redis in one
container, plus an idempotent bare-metal install.sh, and a Jekyll docs site
for GitHub Pages:
- Dockerfile.openldap (node:20-alpine; openldap + pw-sha2/ppolicy/memberof/
  refint; dumb-init PID 1; npm ci --omit=dev; tos.md copied to /).
- docker-entrypoint.sh: generate slapd.conf (mdb + overlays + TLS + indexes +
  access), self-signed LDAPS cert, seed directory tree + required groups,
  bundled redis, export app_* config, exec node.
- docker-compose.yml, .dockerignore, DEPLOYMENT.md, secrets.js.example.
- install.sh: idempotent Debian/Ubuntu bare-metal installer (Node 20.x,
  OpenLDAP, Redis, systemd unit) with flags + --dry-run/--skip-ldap/--skip-app.
- ops/ldif/: memberof/refint/tls/index/nodes/logging LDIFs.
- nodejs/conf/base.js: generic defaults (dc=example,dc=com / localhost /
  SSO Manager) so per-deployment values move to secrets.js or app_* env.
- nodejs/package.json: bump @simpleworkjs/conf to ^1.1.0 (app_* env overrides).
- nodejs/routes/index.js: /health endpoint for healthchecks.
- docs/: _config.yml + index/deployment/configuration/oauth/ldap pages
  (jekyll-theme-cayman) for GitHub Pages from /docs.

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/conf/base.js

@@ -1,22 +1,29 @@
 'use strict';
 
+// Base configuration — generic defaults usable by anyone.
+//
+// These are NON-secret defaults. Per-deployment values (LDAP bind DN, user/group
+// bases, SMTP host/user, OAuth issuer, sender address) should be overridden via
+// conf/secrets.js or `app_*` environment variables (see @simpleworkjs/conf).
+// Secret values (passwords, JWT secret, API keys) MUST come from secrets.js or
+// `app_*` env vars — never commit them here.
 module.exports = {
-	name: "Theta42 SSO",
+	name: "SSO Manager", // displayed in the UI and outbound email
 	userModel: 'ldap', // pam, redis, ldap
 	redis: {
 		prefix: 'sso_manager_'
 	},
 	ldap: {
-		url: 'ldaps://ldap.internal.theta42.com:636',
-		bindDN: 'cn=admin,dc=theta42,dc=com',
-		bindPassword: '__IN SRECREST FILE__',
-		userBase: 'ou=people,dc=theta42,dc=com',
-		groupBase: 'ou=groups,dc=theta42,dc=com',		
+		url: 'ldap://localhost',
+		bindDN: 'cn=admin,dc=example,dc=com',
+		bindPassword: '__in secrets file__',
+		userBase: 'ou=people,dc=example,dc=com',
+		groupBase: 'ou=groups,dc=example,dc=com',
 		userFilter: '(objectClass=posixAccount)',
 		userNameAttribute: 'uid'
 	},
 	oauth: {
-		issuer: 'https://sso.theta42.com',
+		issuer: '', // falls back to the request host at runtime (routes/index.js)
 		jwtSecret: '__in secrets file__',
 		token_lifetime: {
 			access_token: 3600,     // 1 hour (seconds)
@@ -29,11 +36,11 @@ module.exports = {
 		did:      '__in secrets file__',
 	},
 	smtp: {
-		host: 'mail.wgnode.com',
+		host: 'localhost',
 		port: 587,
 		secure: false,
-		user: 'noreply@users.theta42.com',
+		user: 'noreply@example.com',
 		pass: '__in secrets file__',
-		from: 'Theta42 Accounts <noreply@users.theta42.com>',
+		from: 'SSO Manager <noreply@example.com>',
 	},
-};
+};

nodejs/package-lock.json

@@ -11,7 +11,7 @@
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@popperjs/core": "^2.11.8",
-        "@simpleworkjs/conf": "^1.0.0",
+        "@simpleworkjs/conf": "^1.1.0",
         "bcrypt": "^6.0.0",
         "bootstrap": "^5.3.8",
         "ejs": "^3.1.10",
@@ -1126,9 +1126,9 @@
       }
     },
     "node_modules/@simpleworkjs/conf": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.0.0.tgz",
-      "integrity": "sha512-p1dQAELW0oUBRpDoz260TYw18IMI/Y11xYAb17P1MEPjsTAUB0LWE/6ZeA2VQmpU/LXoRnDysg0G/oASGILyUA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.1.0.tgz",
+      "integrity": "sha512-MKRQQ4JAH2tbEm87NdkmfikTT58Tyk/SFbvCC7zKja0bK6j8zYyBXTQUJ0rnvFOVEalDWd/au4AEiptOCEqgvA==",
       "license": "MIT",
       "dependencies": {
         "extend": "^3.0.2"

nodejs/package.json

@@ -23,7 +23,7 @@
   "dependencies": {
     "@fortawesome/fontawesome-free": "^7.3.0",
     "@popperjs/core": "^2.11.8",
-    "@simpleworkjs/conf": "^1.0.0",
+    "@simpleworkjs/conf": "^1.1.0",
     "bcrypt": "^6.0.0",
     "bootstrap": "^5.3.8",
     "ejs": "^3.1.10",

nodejs/routes/index.js

@@ -39,6 +39,11 @@ frontEndModules.forEach(dep => {
 // local folder.
 router.use('/static', express.static(path.join(__dirname, '../public')))
 
+// Public health endpoint for container/orchestration healthchecks.
+// Mounted at / (no auth) in app.js, so this is intentionally unauthenticated.
+router.get('/health', function(req, res) {
+  res.json({ status: 'ok' });
+});
 
 router.get('/tos', function(req, res) {
   res.render('tos', {...values, tosHtml});