wmantly
e46768bb68
- CHANGELOG.md now embeds full app-level release notes for submodule bumps. - .env.example uses explicit CHANGE-ME placeholders instead of realistic-looking defaults. - config.example comments describe the actual CONF_SECRETS mechanism. - setup.sh summary no longer prints generated passwords to stdout. - bootstrap.js fails hard instead of falling back to weak default passwords. Note: submodule pins will be updated to v1.1.16 after the app PRs merge. Co-Authored-By: Claude <noreply@anthropic.com>
45 lines
2.1 KiB
Plaintext
45 lines
2.1 KiB
Plaintext
'use strict';
|
|
// Example SSO secrets for the theta-env unified stack. Copy to
|
|
// ./config/sso-secrets.js (NOT this file — ./config/ is gitignored) and edit.
|
|
// `./setup.sh` generates ./config/sso-secrets.js for you on first run; this file
|
|
// documents the shape for manual editing / reference.
|
|
//
|
|
// The SSO app reads this via @simpleworkjs/conf (docker-entrypoint.sh sets
|
|
// CONF_SECRETS to point at it). The app ignores the extra stack/bootstrap/
|
|
// serviceAccountPass keys (read by the orchestrator). Back this up off-host —
|
|
// it holds all SSO secrets. Never commit ./config/.
|
|
|
|
module.exports = {
|
|
name: 'SSO Manager', // shown in UI + outbound email
|
|
ldap: {
|
|
url: 'ldap://localhost:389', // the bundled slapd (in-container)
|
|
bindDN: 'cn=admin,dc=example,dc=com', // slapd root DN
|
|
bindPassword: 'CHANGE-ME', // slapd root + app bind password
|
|
userBase: 'ou=people,dc=example,dc=com',
|
|
groupBase: 'ou=groups,dc=example,dc=com',
|
|
},
|
|
smtp: { // optional; leave host '' to skip
|
|
host: '', port: 587, secure: false,
|
|
user: '', pass: '', from: '',
|
|
},
|
|
oauth: {
|
|
issuer: 'https://sso.example.com', // browser-facing SSO URL
|
|
jwtSecret: 'CHANGE-ME', // signs all tokens — keep secret
|
|
token_lifetime: { access_token: 3600, refresh_token: 2592000 },
|
|
},
|
|
|
|
// ── Orchestrator-only (ignored by the app; read by setup.sh + bootstrap) ──
|
|
stack: {
|
|
ldapBaseDn: 'dc=example,dc=com', // slapd suffix (drives seed OUs)
|
|
ldapDomain: 'example.com', // default cert CN + issuer host
|
|
ldapCertCn: '', // cert CN; '' -> defaults to ldapDomain
|
|
ssoHost: 'sso.example.com', // public SSO hostname
|
|
proxyHost: 'proxy.example.com', // public proxy hostname
|
|
},
|
|
bootstrap: {
|
|
adminUid: 'admin', // first SSO admin username
|
|
adminPass: 'CHANGE-ME', // first SSO admin password
|
|
adminEmail: 'admin@proxy.example.com', // first SSO admin email
|
|
},
|
|
serviceAccountPass: 'CHANGE-ME', // LDAP password the proxy binds with
|
|
}; |