From b25fb56a0d1f97163b3bb84cacd3b0bce955cad9 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Thu, 23 Jul 2026 16:17:14 -0400 Subject: [PATCH] docs: add the optional SSH jump host to the theta-env Pages site - index: mention the jump host as an optional third component (intro, What-you-get, Related projects) - quickstart: CFG_JUMP_HOST_ENABLED / CFG_JUMP_HOST / JUMP_SSH_PORT - reframe "legacy LDAP clients" -> "direct LDAP clients" (Linux hosts are first-class consumers) Co-Authored-By: Claude Opus 4.8 --- docs/architecture.md | 2 +- docs/index.md | 12 ++++++++++-- docs/quickstart.md | 3 +++ 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/docs/architecture.md b/docs/architecture.md index 2bce8e4..3b123ed 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -31,7 +31,7 @@ fetches all three in one step; `git submodule update --remote` bumps them. ``` ┌──────────────────────────────────────────────┐ - │ your browser / apps / legacy LDAP clients │ + │ your browser / apps / direct LDAP clients │ └───────────────┬──────────────────────────────┘ │ https (:443) ldaps (:636) ┌─────────▼─────────┐ diff --git a/docs/index.md b/docs/index.md index 1ee3ce2..0f9bec2 100644 --- a/docs/index.md +++ b/docs/index.md @@ -15,7 +15,9 @@ LDAP directory) and [Proxy](https://theta42.github.io/proxy/) (an OIDC-protected reverse proxy that can also look users up directly in LDAP) — and automates the fiddly part: registering the proxy as an OIDC client of the SSO and pointing it at the right LDAP directory, with hostnames and secrets -generated from one `setup.env`. +generated from one `setup.env`. An optional third component, the +[Jump Host](https://theta42.github.io/jump-host/), adds directory-driven SSH +access to your machines through one public entry point. ## Screenshots @@ -41,7 +43,11 @@ snapshots state before every rebuild. - **SSO Manager**, fronted by the proxy under TLS — manage users, groups, and OAuth clients. - **Proxy** — add the hosts you want to protect with OIDC login. -- **LDAPS** for legacy apps that bind directly. +- **LDAPS** for direct binds — Linux hosts (PAM/SSSD, sudo, SSH keys) and + LDAP-native apps authenticate against the same directory. +- **SSH Jump Host** *(optional)* — `ssh uid_-_host@jump.` (WinSCP-friendly) + or an interactive picker; access is driven by directory group membership, with + a web UI for audit + metrics. Enable with `CFG_JUMP_HOST_ENABLED=true`. - **Self-service API tokens** in both apps' UIs, for scripting/CI without a browser session. - **Multi-Site Support (Geo-Location Scaling)** — built-in support for N-Way Multi-Master LDAP replication across physical locations. @@ -67,3 +73,5 @@ architecture, and running each project standalone, see the provider + LDAP directory this stack runs. - **[Proxy](https://theta42.github.io/proxy/)** — the reverse proxy this stack runs in front of it. +- **[Jump Host](https://theta42.github.io/jump-host/)** — the optional SSH jump + host this stack can bring up (`CFG_JUMP_HOST_ENABLED=true`). diff --git a/docs/quickstart.md b/docs/quickstart.md index a7fb1de..fb6997d 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -60,6 +60,9 @@ setups `CFG_DOMAIN` is the only value you set: | `CFG_ADMIN_UID` | `admin` | optional, defaults to `admin` | | `CFG_ADMIN_EMAIL` | `admin@` | optional | | `CFG_BASE_DN` | `dc=lab,dc=local` | advanced: override the derived LDAP base DN | +| `CFG_JUMP_HOST_ENABLED` | `true` | optional: bring up the [SSH jump host](https://theta42.github.io/jump-host/) (default off) | +| `CFG_JUMP_HOST` | `jump.lab.local` | optional, defaults to `jump.` | +| `JUMP_SSH_PORT` | `2222` | optional: host port for the jump host's SSH (never 22 by default) | `setup.env` is used **only on the first run** to generate `./config/`; after that `./config/*.js` are operator-owned and `setup.env` is ignored. Secrets