From faf67d8ffcb35e77943691bfcb4443d027b19b92 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Thu, 23 Jul 2026 02:56:17 -0400 Subject: [PATCH] docs: direct LDAP binds are first-class, not "legacy" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Linux hosts authenticate against the directory (PAM/SSSD, sudoRole, sshPublicKey) — reframe the OpenLDAP seed comment and changelog entry accordingly. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 2 +- bootstrap/bootstrap.js | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c1b7859..e359414 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ for what changed inside the apps it composes. ## [Unreleased] ### Added -- The bootstrap now seeds the SSO directory with the stack's own resources: a site (from the configured domain), a "Stack host", and the SSO Manager + Proxy services (with their public URLs in metadata), linking the proxy's auto-registered OAuth client under its service. Also seeds the two non-obvious services the stack runs: the OpenLDAP directory (advertising the `ldaps://` endpoint legacy apps bind to, honoring `ldap.ldapsHost`) and the OpenResty edge (the 80/443 data plane every hostname flows through, with a wildcard `https://*.` address). The Directory page is populated out of the box instead of starting empty. Idempotent — resources whose slug already exists are operator-owned and never touched, and a seed failure only warns (never fails a bring-up, e.g. against an older sso-manager image without `/api/directory`). +- The bootstrap now seeds the SSO directory with the stack's own resources: a site (from the configured domain), a "Stack host", and the SSO Manager + Proxy services (with their public URLs in metadata), linking the proxy's auto-registered OAuth client under its service. Also seeds the two non-obvious services the stack runs: the OpenLDAP directory (advertising the `ldaps://` endpoint Linux hosts and LDAP-native apps bind to, honoring `ldap.ldapsHost`) and the OpenResty edge (the 80/443 data plane every hostname flows through, with a wildcard `https://*.` address). The Directory page is populated out of the box instead of starting empty. Idempotent — resources whose slug already exists are operator-owned and never touched, and a seed failure only warns (never fails a bring-up, e.g. against an older sso-manager image without `/api/directory`). ## [1.3.3] - 2026-07-23 diff --git a/bootstrap/bootstrap.js b/bootstrap/bootstrap.js index 36ad5cb..66ae296 100644 --- a/bootstrap/bootstrap.js +++ b/bootstrap/bootstrap.js @@ -327,8 +327,9 @@ async function seedDirectory(token, clientId) { // Proxy = the node management UI; OpenResty = the data plane every hostname // in the stack actually flows through (80/443). Two faces, two entries. const psvc = await ensure('service', 'Proxy', 'proxy', host.id, { address: `https://${PROXY_HOST}` }); - // OpenLDAP is independently consumed (direct LDAPS binds for legacy apps — - // see the SSO's /integrations page), so it gets its own entry. Advertise + // OpenLDAP is independently consumed — Linux hosts authenticate against it + // (PAM/SSSD, sudoRole, sshPublicKey) and LDAP-native apps bind directly + // (see the SSO's /integrations page) — so it gets its own entry. Advertise // the operator-configured LDAPS hostname when set, else the SSO host. const LDAPS_HOST = (sso.ldap && sso.ldap.ldapsHost) || SSO_HOST; await ensure('service', 'OpenLDAP Directory', 'openldap', host.id, {