wmantly
20a586de4f
The first-run flow generated ./config/*.js with example.com/dc=example,dc=com defaults and then exit 0'd, telling the operator to hand-edit. The domain/base DN was repeated across ~9 fields in each secrets file; on the deploy host only the stack block was updated (to dc=718it,dc=biz) while ldap.* DNs stayed at dc=example,dc=com, so slapd's root DN didn't match the app's bindDN and bootstrap failed with 401 Invalid Credentials. Enter the domain once: a new setup.env (gitignored; setup.env.example is the committed template) holds the essential, non-repeating first-run info — the domain as an LDAP base DN (CFG_BASE_DN). setup.sh reads it ONLY on first run (when ./config/*.js don't exist), derives hostnames (sso.<domain> / proxy.<domain>) and all LDAP DNs from it, generates both secrets files with the real domain filled in everywhere + random secrets, and proceeds to build in the same run (no edit-and-re-run step). After first run the secrets files are operator-owned and setup.env is ignored — the apps and secrets files are unchanged. - setup.sh ensure_config: source setup.env -> bind CFG_* to empty (set -u safe) -> unchanged .env/proxy.env legacy migration -> derive from base DN (no example.com defaults; die with a helpful msg if CFG_BASE_DN blank) -> generate + proceed. Header comments updated. - setup.env.example: committed template; secrets stay out (generated into ./config/*.js). - .gitignore: ignore setup.env (per-deployment). - README.md + docs/quickstart.md: Quickstart now cp setup.env.example -> set CFG_BASE_DN -> ./setup.sh; domain-asked-once note in "Before you begin". - Bump sso-manager-node gitlink to 11fb2c0 (docs PR #37: base-DN-is-the-one- domain-value note in sso-manager README/DEPLOYMENT/secrets.js.example). Co-authored-by: Claude <noreply@anthropic.com>
45 lines
2.7 KiB
Bash
45 lines
2.7 KiB
Bash
# ─────────────────────────────────────────────────────────────────────────────
|
|
# setup.env — first-run setup for the theta-env stack.
|
|
#
|
|
# This file is used ONLY on the FIRST run of ./setup.sh, to generate
|
|
# ./config/sso-secrets.js + ./config/proxy-secrets.js with your domain filled
|
|
# in everywhere consistently. Once ./config/*.js exist they are operator-owned
|
|
# (edit them directly; setup.env is ignored on later runs).
|
|
#
|
|
# cp setup.env.example setup.env
|
|
# $EDITOR setup.env # set CFG_BASE_DN below to your domain
|
|
# ./setup.sh # generates ./config/ and builds the stack
|
|
#
|
|
# Copying this file to setup.env (gitignored) keeps your domain out of git.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# Your domain, as an LDAP base DN. THIS IS THE ONE PLACE THE DOMAIN IS ENTERED.
|
|
# Everything else derives from it: the SSO/proxy hostnames default to
|
|
# sso.<domain> / proxy.<domain>, and the LDAP DNs are cn=admin,<dn>,
|
|
# ou=people,<dn>, ou=groups,<dn>. Required — setup.sh refuses to run without it.
|
|
CFG_BASE_DN=dc=example,dc=com
|
|
|
|
# Public hostnames. Optional — default to sso.<domain> / proxy.<domain> derived
|
|
# from CFG_BASE_DN above. Uncomment and set only if your hostnames differ
|
|
# (e.g. a different subdomain, or the domain isn't the bare apex):
|
|
#CFG_SSO_HOST=sso.example.com
|
|
#CFG_PROXY_HOST=proxy.example.com
|
|
|
|
# Optional — sensible defaults if left blank:
|
|
#CFG_ORG=SSO Manager # app display name + outbound email org
|
|
#CFG_ADMIN_UID=admin # initial SSO admin username
|
|
#CFG_ADMIN_EMAIL=admin@proxy.example.com # defaults to admin@<proxyHost>
|
|
#CFG_LDAP_CERT_CN= # LDAP TLS cert CN; empty -> defaults to the domain
|
|
|
|
# Optional SMTP (outbound email from the SSO app). Leave blank to disable:
|
|
#CFG_SMTP_HOST=smtp.example.com
|
|
#CFG_SMTP_PORT=587
|
|
#CFG_SMTP_USER=noreply@example.com
|
|
#CFG_SMTP_PASS=your-smtp-password
|
|
#CFG_SMTP_FROM=SSO Manager <noreply@example.com>
|
|
|
|
# ── DO NOT put secrets here ──────────────────────────────────────────────────
|
|
# The LDAP admin password, JWT secret, admin password, and LDAP service-account
|
|
# password are GENERATED (random) into ./config/sso-secrets.js on first run.
|
|
# Change them later by editing ./config/sso-secrets.js directly. Do NOT set
|
|
# CFG_LDAP_ADMIN_PASS / CFG_JWT_SECRET / CFG_ADMIN_PASS / CFG_SVC_PASS here. |