wmantly
6920a9f9f0
Lossless upgrades + config story for the all-in-one image. Redis persistence (Part A): - Replace in-memory `--save "" --appendonly no` with AOF + RDB persisted to /data (--appendonly yes, periodic saves, --dbfilename dump.rdb). OAuth clients, tokens, and other model-redis state now survive container recreation. - Add the `sso-data` named volume -> /data in docker-compose.yml. Config from ./config/sso-secrets.js (Part B): - docker-entrypoint.sh: when /config/sso-secrets.js is mounted, symlink it to /app/conf/secrets.js and read the server-side LDAP vars (base DN, admin pass, org, domain, cert CN, JWT) from the file via one `node` call (base64-decoded, no eval/quoting hazards). No app_* env is exported in this mode, so the file is authoritative (@simpleworkjs/conf precedence: base < env < secrets.js < app_* env). Falls back to the existing LDAP_* env-var mode when the file is absent (standalone/bare-metal still works). - docker-compose.yml: trim `environment:` to NODE_ENV/NODE_PORT only and add `./config:/config:ro`. Removing the app_* env is required — any leftover app_* would silently override secrets.js. - secrets.js.example: add orchestrator-only `stack`, `bootstrap`, and `serviceAccountPass` keys (ignored by the app; read by the entrypoint, the theta-env bootstrap, and setup.sh). Backup/restore docs: - Full "Backups and restore" runbook in DEPLOYMENT.md (what lives where, manual backup, full / Redis-only / LDAP-only restore, AOF-vs-RDB note, upgrades). Restore uses slapadd -f (static slapd.conf), and RDB restore requires deleting the AOF first (AOF wins on startup). - Pointers in docs/deployment.md and docs/ldap.md; update the Docker Setup section for the new ./config/ approach (env vars now advanced/optional). Co-authored-by: Claude <noreply@anthropic.com>
67 lines
3.1 KiB
Plaintext
67 lines
3.1 KiB
Plaintext
'use strict';
|
|
|
|
// Example secrets configuration file (file-based config).
|
|
//
|
|
// Bare-metal: copy to nodejs/conf/secrets.js and fill in your values.
|
|
// Docker / unified stack: place at ./config/sso-secrets.js and bind-mount
|
|
// ./config at /config (see docker-compose.yml); docker-entrypoint.sh symlinks
|
|
// it into /app/conf/secrets.js so @simpleworkjs/conf reads it.
|
|
//
|
|
// Values here override conf/base.js and win over <environment>.js. `app_*` env
|
|
// vars (if any are set) override this file too — so the Docker stack passes NO
|
|
// app_* env, keeping this file authoritative.
|
|
//
|
|
// The app only reads the keys it knows (port, name, ldap, smtp, voipms, oauth).
|
|
// The extra `stack`, `bootstrap`, and `serviceAccountPass` keys below are read
|
|
// by the orchestrator (docker-entrypoint.sh, the bootstrap script, setup.sh)
|
|
// and ignored by the app — safe to leave them out for bare-metal use.
|
|
|
|
module.exports = {
|
|
port: 3001,
|
|
name: 'SSO Manager', // shown in UI and outbound email
|
|
ldap: {
|
|
url: 'ldap://localhost', // or ldaps://host:636 for TLS
|
|
bindDN: 'cn=admin,dc=example,dc=com',
|
|
bindPassword: 'your-ldap-password',
|
|
userBase: 'ou=people,dc=example,dc=com',
|
|
groupBase: 'ou=groups,dc=example,dc=com',
|
|
},
|
|
smtp: {
|
|
host: 'smtp.example.com',
|
|
port: 587,
|
|
secure: false, // true for 465, false for other ports
|
|
user: 'noreply@example.com',
|
|
pass: 'your-smtp-password',
|
|
from: 'SSO Manager <noreply@example.com>',
|
|
},
|
|
voipms: {
|
|
username: '', // VoIP.ms username (optional)
|
|
password: '', // VoIP.ms password (optional)
|
|
did: '', // VoIP.ms DID (optional)
|
|
},
|
|
oauth: {
|
|
issuer: '', // falls back to the request host at runtime
|
|
jwtSecret: 'generate-a-secure-random-string-here',
|
|
token_lifetime: {
|
|
access_token: 3600, // 1 hour in seconds
|
|
refresh_token: 2592000 // 30 days in seconds
|
|
}
|
|
},
|
|
|
|
// ── Orchestrator-only keys (ignored by the app) ──────────────────────────
|
|
// Read by docker-entrypoint.sh (server-side slapd config + validation), the
|
|
// superproject bootstrap script, and setup.sh. Omit for bare-metal use.
|
|
stack: {
|
|
ldapBaseDn: 'dc=example,dc=com', // slapd suffix (also drives seed OUs)
|
|
ldapDomain: 'example.com', // default cert CN + OAuth issuer host
|
|
ldapCertCn: '', // cert CN; empty -> defaults to ldapDomain
|
|
ssoHost: 'sso.example.com', // public SSO hostname (OAuth issuer URL)
|
|
proxyHost: 'proxy.example.com', // public proxy hostname
|
|
},
|
|
bootstrap: {
|
|
adminUid: 'admin', // initial SSO admin username
|
|
adminPass: 'change-me', // initial SSO admin password
|
|
adminEmail: 'admin@example.com', // initial SSO admin email
|
|
},
|
|
serviceAccountPass: 'change-me', // LDAP password the proxy binds with
|
|
}; |