theta-suite

theta42/theta-suite

Fork 0

Commit Graph

Author	SHA1	Message	Date
wmantly	1f8f4c70be	feat: optional SSH jump host component (theta42/jump-host) Adds jump-host as a third, opt-in submodule, wired behind CFG_JUMP_HOST_ENABLED (default off — existing installs unaffected): - .gitmodules + jump-host submodule pinned to v1.0.0 - setup.sh: resolves the enable flag early, adds jump-host to the submodule tag-update loop and activates the `jump-host` compose profile when enabled; builds/starts the service after the proxy, waits for its /health, and registers its web UI as a proxy Host; passes CFG_JUMP_HOST_ENABLED/CFG_JUMP_HOST to the bootstrap - docker-compose.yml: jump-host service with profiles:["jump-host"], depends_on sso-manager healthy, ports 2222 (SSH) + 3002 (web), ./config:ro + jump-data volume - bootstrap.js: when enabled, mints a directory API token and writes ./config/jump-secrets.js (binds as cn=admin so it can write the sshPublicKey attribute for key injection), and seeds a directory service entry for the jump host. Warn-only, idempotent. - setup.env.example: CFG_JUMP_HOST_ENABLED / CFG_JUMP_HOST / JUMP_SSH_PORT Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 15:55:40 -04:00
wmantly	9fb240ff45	theta-env: unified SSO Manager + Proxy stack with one-command setup Composes theta42/sso-manager-node and theta42/proxy (as git submodules) on a single Docker network and automates first-run wiring. - docker-compose.yml: sso-manager (build ./sso-manager-node/Dockerfile.openldap) + proxy (build ./proxy/Dockerfile) on theta-net; SSO UI + mgmt port bound to localhost, LDAPS published, proxy 80/443/4443 published. - setup.sh: idempotent one-command bring-up — validates .env, starts SSO, runs the bootstrap, writes ./proxy.env, starts the proxy, prints admin login. - bootstrap/bootstrap.js: runs inside the sso-manager container (self-contained, Node built-ins + fetch only) — creates the LDAP service account, first admin (+ app_sso_admin/app_sso_oauth_admin membership), registers the proxy as an OIDC client via the SSO HTTP API, emits CLIENT_ID/CLIENT_SECRET. - .env.example: all tunables (LDAP_BASE_DN, LDAP_ADMIN_PASS, JWT_SECRET, SSO_HOST, PROXY_HOST, BOOTSTRAP_ADMIN_, LDAP_SERVICE_PASS, SMTP_, ports). - README.md + docs/ (Jekyll site for GitHub Pages): quickstart, architecture, standalone usage. Co-Authored-By: Claude <noreply@anthropic.com>	2026-07-11 17:04:36 -04:00

Author

SHA1

Message

Date

wmantly

1f8f4c70be

feat: optional SSH jump host component (theta42/jump-host)

Adds jump-host as a third, opt-in submodule, wired behind
CFG_JUMP_HOST_ENABLED (default off — existing installs unaffected):

- .gitmodules + jump-host submodule pinned to v1.0.0
- setup.sh: resolves the enable flag early, adds jump-host to the
  submodule tag-update loop and activates the `jump-host` compose
  profile when enabled; builds/starts the service after the proxy,
  waits for its /health, and registers its web UI as a proxy Host;
  passes CFG_JUMP_HOST_ENABLED/CFG_JUMP_HOST to the bootstrap
- docker-compose.yml: jump-host service with profiles:["jump-host"],
  depends_on sso-manager healthy, ports 2222 (SSH) + 3002 (web),
  ./config:ro + jump-data volume
- bootstrap.js: when enabled, mints a directory API token and writes
  ./config/jump-secrets.js (binds as cn=admin so it can write the
  sshPublicKey attribute for key injection), and seeds a directory
  service entry for the jump host. Warn-only, idempotent.
- setup.env.example: CFG_JUMP_HOST_ENABLED / CFG_JUMP_HOST / JUMP_SSH_PORT

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 15:55:40 -04:00

wmantly

9fb240ff45

theta-env: unified SSO Manager + Proxy stack with one-command setup

Composes theta42/sso-manager-node and theta42/proxy (as git submodules) on a
single Docker network and automates first-run wiring.

- docker-compose.yml: sso-manager (build ./sso-manager-node/Dockerfile.openldap)
  + proxy (build ./proxy/Dockerfile) on theta-net; SSO UI + mgmt port bound to
  localhost, LDAPS published, proxy 80/443/4443 published.
- setup.sh: idempotent one-command bring-up — validates .env, starts SSO, runs
  the bootstrap, writes ./proxy.env, starts the proxy, prints admin login.
- bootstrap/bootstrap.js: runs inside the sso-manager container (self-contained,
  Node built-ins + fetch only) — creates the LDAP service account, first admin
  (+ app_sso_admin/app_sso_oauth_admin membership), registers the proxy as an
  OIDC client via the SSO HTTP API, emits CLIENT_ID/CLIENT_SECRET.
- .env.example: all tunables (LDAP_BASE_DN, LDAP_ADMIN_PASS, JWT_SECRET,
  SSO_HOST, PROXY_HOST, BOOTSTRAP_ADMIN_*, LDAP_SERVICE_PASS, SMTP_*, ports).
- README.md + docs/ (Jekyll site for GitHub Pages): quickstart, architecture,
  standalone usage.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-07-11 17:04:36 -04:00

2 Commits