docs: group naming matches docs/GROUPS.md; roll up sso v1.27.0 (v1.37.0)

- GROUPS.md: per-resource groups are {site}_{kind}_{name}_{level}; site carries god + site-wide only
- gitlink: sso-manager-node e8d0420 (v1.27.0)

CHANGELOG.md

@@ -8,29 +8,6 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
-## [v1.41.0] - 2026-08-05
-
-### Fixed
-- **The Local Docker daemon discovery plugin no longer errors** — the sso-manager container had no access to the host docker socket, so the seeded `docker-local` plugin (socketPath `/var/run/docker.sock`) failed with `ENOENT` and showed "Last run: error". `docker-compose.yml` now mounts `/var/run/docker.sock` into the container. Recreate the container (`docker compose up -d sso-manager`) and hit "Run now" on the plugin.
-- **theta-agent ships the rebuilt binary with the heartbeat fix** (v1.3.1, gitlink `51750d0`) — the prebuilt `theta-agent-linux-amd64` predated the v1.3.0 `heartbeat_ack` fix, so the installed agent still logged "Unknown command type: heartbeat_ack". Now rebuilt + tested.
-
-## [v1.40.0] - 2026-08-05
-
-### Fixed
-- **No more spurious "Invalid Credentials, login failed" during LDAP enrollment** (ldap-client v1.25.0, gitlink `68fcdb5`) — `index.sh` self-registered the host in the Directory when `sso_token` was *declared but empty* (it checked `[[ -v ]]`), POSTing an empty Bearer token and getting a misleading `LDAPLoginFailed`. It now only registers with a real token; the stack host (already seeded by the bootstrap) skips registration.
-- **The `cn=ldapclient` service account now shows in the SSO Users UI** — it was created as a bare `organizationalRole` (invisible to the `posixAccount` user filter) and never joined `app_sso_service_account`, so it never appeared as a service account. The bootstrap now creates it as a `posixAccount` (uid 10001, above the regular-user reserved floor) and adds it to `app_sso_service_account`; for an existing account it best-effort adds the `posixAccount` shape (auxiliary, so it can't conflict with the structural `organizationalRole`) + the group membership.
-
-## [v1.39.0] - 2026-08-05
-
-### Fixed
-- **Plain LDAP (389) now reachable from the host** — `docker-compose.yml` published only LDAPS (636); plain LDAP (389) was deliberately not mapped, so the stack host's own enrollment (`setup.sh` → ldap-client, which configures sssd against `ldap://localhost:389` and `ldaps://localhost:636`) could not reach the directory over loopback. Both 389 and 636 are now published to the host (bind 0.0.0.0; `LDAP_BIND`/`LDAPS_BIND=127.0.0.1` to lock to the host only).
-
-## [v1.38.0] - 2026-08-04
-
-### Fixed
-- **LDAP enrollment no longer reaches for the public domain** — `setup.sh` generated `ldap.vars` with `ldap_host` defaulting to the public SSO host (`sso.<domain>`), which the NAT/firewall blocks on the LDAP ports (389/636). It now defaults to `localhost` (the LDAP server is co-located on the stack host; `ldap_tls_reqcert=never` makes this safe), overridable with `CFG_LDAPS_HOST` for an internal hostname/IP.
-- **SSH access groups match the SSO group model** (ldap-client v1.24.0) — the generated `sssd.conf` access filter and `ldap-ssh-key.sh` referenced the legacy names (`<location>_access`, `app_super_admin`); they now use `site_<location>_hosts_access` (all-hosts aggregate), `site_<location>_host_<hostname>_access`, and `god_admin`. GROUPS.md §8's example updated to match.
-
 ## [v1.37.0] - 2026-08-04
 
 ### Changed

README.md

@@ -129,15 +129,12 @@ see browser warnings.)
 
 Optional extra ports (only if you need them):
 - **4443** — alternate HTTPS listener (e.g. if 443 is taken by something else).
-- **389** (LDAP) + **636** (LDAPS) — direct-LDAP access. The stack host's **own**
-  enrollment (`setup.sh` → ldap-client) configures its sssd against
-  `ldap://localhost:389` / `ldaps://localhost:636`, so both ports are published
-  to the host by default (bind 0.0.0.0; set `LDAP_BIND`/`LDAPS_BIND=127.0.0.1` to
-  lock to the host). LAN clients (Linux hosts via PAM/SSSD, LDAP-native apps) can
-  bind over either; the proxy itself reaches LDAP over the internal Docker
-  network and doesn't need them.
-  **Do not forward 389/636 to the public internet.** If you need LAN clients to
-  bind LDAP, set `CFG_LDAPS_HOST=ldap.internal.example.com` (or `sso-manager` for
+- **636** (LDAPS) — for direct-LDAP clients on other machines (Linux hosts
+  via PAM/SSSD, LDAP-native apps). The proxy itself reaches LDAP over the
+  internal Docker network, so you do **not** need to expose 636 for the stack
+  to work.
+  **Do not forward 636 to the public internet.** If you need LAN clients to bind
+  LDAP, set `CFG_LDAPS_HOST=ldap.internal.example.com` (or `sso-manager` for
   same-host Docker clients) in `setup.env` and use an internal DNS record / cert
   SAN. The default shows the public SSO hostname, which implies a public route.
 

bootstrap/bootstrap.js

@@ -178,88 +178,31 @@ function ldapModify(ldif) {
 }
 
 // ── 1. LDAP service account for the proxy ───────────────────────────────────
-// The proxy / ldap-client bind as cn=ldapclient. For it to SHOW in the SSO Users
-// UI as a service account it must (a) match the user filter (posixAccount) and
-// (b) be a member of app_sso_service_account (that membership is what the Users
-// page marks as a non-person/service account). Older bootstraps created it as a
-// bare organizationalRole (invisible to the Users list) and never joined the
-// group, so it never appeared. Both are fixed here; the existing-path shape add
-// is best-effort so a pre-existing account still binds even if the upgrade add
-// fails.
 function ensureServiceAccount() {
 	const pw = hashPasswordSSHA512(SVC_PASS);
-	const uidNum = '10001'; // distinct from the bootstrap admin's 10000; above uidGidReservedFloor so regular-user id allocation ignores it
 	if (entryExists(SVC_DN)) {
-		log(`Service account ${SVC_DN} exists — ensuring service-account shape + password`);
-		// Add the auxiliary posixAccount objectClass + required attrs so the entry
-		// matches the Users list filter. inetOrgPerson is deliberately NOT added:
-		// it is structural and would conflict with the existing organizationalRole.
-		const shape = [
-			`dn: ${SVC_DN}`,
-			'changetype: modify',
-			'add: objectClass',
-			'objectClass: posixAccount',
-			'-',
-			'add: uid',
-			'uid: ldapclient',
-			'-',
-			'add: uidNumber',
-			`uidNumber: ${uidNum}`,
-			'-',
-			'add: gidNumber',
-			`gidNumber: ${uidNum}`,
-			'-',
-			'add: homeDirectory',
-			'homeDirectory: /nonexistent',
-			'-',
-			'add: description',
-			'description: LDAP bind service account (proxy / ldap-client)',
-			'',
-		].join('\n');
-		const rs = ldapModify(shape);
-		if (rs.code !== 0 && !/already exists|Type or value exists/i.test(rs.stderr)) {
-			log('  service-account shape warning (account still binds):', rs.stderr.trim());
-		}
-		const rp = ldapModify([
+		log(`Service account ${SVC_DN} exists — resetting password to ./config`);
+		const r = ldapModify([
 			`dn: ${SVC_DN}`,
 			'changetype: modify',
 			'replace: userPassword',
 			`userPassword: ${pw}`,
 			'',
 		].join('\n'));
-		if (rp.code !== 0) log('  password reset warning:', rp.stderr.trim());
-	} else {
-		log(`Creating service account ${SVC_DN}`);
-		const entry = [
-			`dn: ${SVC_DN}`,
-			'objectClass: inetOrgPerson',
-			'objectClass: posixAccount',
-			'objectClass: top',
-			'cn: ldapclient',
-			'sn: ldapclient',
-			'uid: ldapclient',
-			`uidNumber: ${uidNum}`,
-			`gidNumber: ${uidNum}`,
-			'homeDirectory: /nonexistent',
-			'description: LDAP bind service account (proxy / ldap-client)',
-			`userPassword: ${pw}`,
-			'',
-		].join('\n');
-		const r = ldapAdd(entry);
-		if (r.code !== 0) throw new Error(`ldapadd service account failed: ${r.stderr.trim()}`);
+		if (r.code !== 0) log('  password reset warning:', r.stderr.trim());
+		return;
 	}
-	// Mark it as a service account (the Users UI's service-account signal).
-	const gdn = `cn=app_sso_service_account,ou=groups,${BASE_DN}`;
-	const rm = ldapModify([
-		`dn: ${gdn}`,
-		'changetype: modify',
-		'add: member',
-		`member: ${SVC_DN}`,
+	log(`Creating service account ${SVC_DN}`);
+	const r = ldapAdd([
+		`dn: ${SVC_DN}`,
+		'objectClass: organizationalRole',
+		'objectClass: simpleSecurityObject',
+		'objectClass: top',
+		'cn: ldapclient',
+		`userPassword: ${pw}`,
 		'',
 	].join('\n'));
-	if (rm.code === 0) log(`  marked ${SVC_DN} as a service account`);
-	else if (/already exists|Type or value exists/i.test(rm.stderr)) log(`  ${SVC_DN} already in app_sso_service_account`);
-	else log(`  app_sso_service_account membership warning:`, rm.stderr.trim());
+	if (r.code !== 0) throw new Error(`ldapadd service account failed: ${r.stderr.trim()}`);
 }
 
 // ── 2. First admin user ─────────────────────────────────────────────────────

docker-compose.yml

@@ -52,16 +52,12 @@ services:
       # the UI is reachable on the LAN during setup). Set SSO_BIND=127.0.0.1 to
       # lock it to localhost once the proxy fronts it at https://<SSO_HOST>.
       - "${SSO_BIND:-0.0.0.0}:${SSO_PORT:-3001}:3001"
-      # LDAPS (636) + plain LDAP (389) for direct-LDAP clients AND for the stack
-      # host's OWN enrollment: setup.sh / ldap-client configure the host's sssd
-      # against ldap://localhost and ldaps://localhost, and the LDAP server is
-      # co-located on this host, so BOTH ports must be reachable from the host
-      # over loopback — not only over the docker network. Bind 0.0.0.0 (default)
-      # so LAN clients can use the host's local IP too; set LDAP_BIND and/or
-      # LDAPS_BIND=127.0.0.1 to lock either to the host only. Prefer an internal
-      # hostname (CFG_LDAPS_HOST) and do NOT forward 389/636 to the public internet.
-      - "${LDAP_BIND:-0.0.0.0}:${LDAP_PORT:-389}:389"
-      - "${LDAPS_BIND:-0.0.0.0}:${LDAPS_PORT:-636}:636"
+      # LDAPS for EXTERNAL direct-LDAP clients (legacy apps). The proxy itself
+      # reaches LDAPS over theta-net (sso-manager:636) without this host mapping.
+      # Prefer an internal-only hostname (set CFG_LDAPS_HOST in setup.env / ldapsHost
+      # in sso-secrets.js) and do NOT forward 636 to the public internet.
+      - "${LDAPS_PORT:-636}:636"
+      # Plain LDAP (389) is NOT mapped — direct-LDAP clients should use LDAPS.
     environment:
       # Config (LDAP, OAuth, SMTP, ...) is loaded by @simpleworkjs/conf from
       # ./config/sso-secrets.js (see volumes), then @simpleworkjs/bao-conf
@@ -81,10 +77,6 @@ services:
       - HTTPS_PROXY=${CFG_HTTPS_PROXY:-}
       - NO_PROXY=${CFG_NO_PROXY:-}
     volumes:
-      # The host docker socket so the bundled Docker discovery plugin (seeded as
-      # 'docker-local' with socketPath /var/run/docker.sock) can list containers.
-      # Without this the plugin errors with ENOENT and shows 'Last run: error'.
-      - /var/run/docker.sock:/var/run/docker.sock
       # Operator-edited SSO secrets (sso-secrets.js). Read-WRITE so the bootstrap
       # can write the generated OAuth client creds into proxy-secrets.js. The
       # entrypoint points CONF_SECRETS at /config/sso-secrets.js.

docs/GROUPS.md

@@ -232,12 +232,12 @@ Key ideas:
 A host should import its **own** resource groups (plus any explicitly granted
 ones). Because the schema is predictable, `ldap-client` can generate the per-host
 `ldap_group_search_filter` from the enrolled host's identity, e.g. a host `web01`
-at site `main-office` (site resource slug `site_main-office`) imports:
+at site `main-office` imports:
 
 ```
-(&(objectClass=groupOfNames)(|(cn=site_main-office_host_web01_access)
-                               (cn=site_main-office_host_web01_admin)
-                               (cn=site_main-office_host_web01_sudo)))
+(&(objectClass=groupOfNames)(|(cn=main-office_host_web01_access)
+                               (cn=main-office_host_web01_admin)
+                               (cn=main-office_host_web01_sudo)))
 ```
 
 So the operator (or ldap-client) selects a small allowlist of the host's `_access`

setup.sh

@@ -1288,13 +1288,8 @@ if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]] && [[ -x /usr/local/bin/theta-agent ]]
 			ldap_site="${CFG_SITE_NAME:-$(sso_secrets_get siteName)}"
 			ldap_bind_pass="${CFG_SVC_PASS:-$(sso_secrets_get_top serviceAccountPass)}"
 			sso_host="${CFG_SSO_HOST:-$(sso_secrets_get ssoHost)}"
-			# The LDAP server is co-located with the stack on THIS host, so the
-			# host must reach it over the loopback / a local address -- NEVER the
-			# public domain (sso.<domain>), which cannot route back to the 389/636
-			# ports through NAT. localhost is fine because the generated sssd.conf
-			# sets ldap_tls_reqcert=never (hostname verification is off). An
-			# operator may override with CFG_LDAPS_HOST (an internal hostname/IP).
-			ldaps_host="${CFG_LDAPS_HOST:-localhost}"
+			ldaps_host="${CFG_LDAPS_HOST:-}"
+			[[ -n "$ldaps_host" ]] || ldaps_host="${sso_host:-}"
 			cat > ldap-client/ldap.vars <<LDAPVARS
 export ldap_host="${ldaps_host}"
 export ldap_base_dn="${ldap_base_dn}"
@@ -1303,9 +1298,7 @@ export ldap_bind_password="${ldap_bind_pass}"
 export sso_url="https://${sso_host}"
 export sso_token=""
 export ldap_location="${ldap_site:-local}"
-# Groups that grant SSH/access on this host (docs/GROUPS.md §8): the site's
-# all-hosts aggregate, this host's own access group, and god_admin.
-ldap_access_groups=( "site_\${ldap_location}_hosts_access" "site_\${ldap_location}_host_\$(hostname)_access" "god_admin" )
+ldap_access_groups=( "\${ldap_location}_access" "\${ldap_location}_host_\$(hostname)_access" "god_admin" )
 LDAPVARS
 		else
 			info "  ldap-client/ldap.vars exists -- keeping it"