wmantly
ace7b441c2
Everything shipped this pass (live replication, master/spoke join, gateway-to-gateway WireGuard mesh) had real spec docs in the repo (docs/MULTI_SITE_SPEC.md, sso-manager-node's docs/site-join.md) but nothing on the actual published docs site (theta42.github.io/theta-suite/) -- a reader landing there would find no mention of it at all beyond a vague, unlinked "multi-site replication" bullet on the homepage. - New docs/sso/multi-site.md: the operator-facing master/spoke join guide (why, how, promoting a spoke, what replicates, current limits), with an explicit section distinguishing it from the pre-existing N-way LDAP MMR replication page (replication.html) -- two different mechanisms that were at real risk of being conflated with nothing to tell them apart. - New docs/jump-host/mesh.md: the gateway-to-gateway WireGuard mesh guide, linked from a "WireGuard mesh routing" bullet that already existed on the jump-host homepage but pointed nowhere. - docs/sso/index.md, docs/jump-host/index.md: link the new pages from each component's Features list. - docs/index.md: replaced the oversold, unlinked "multi-site replication running in seconds" homepage copy with an accurate, linked claim.
3.7 KiB
3.7 KiB
layout, title, description
| layout | title | description |
|---|---|---|
| default | Home | Theta Directory — the OpenID Connect provider, bundled OpenLDAP directory, and resource inventory at the core of theta-suite. One login for your modern apps, one LDAP directory for the rest, no phone-home. |
Theta Directory
The identity and directory component of theta-suite: an OpenID Connect provider, a bundled OpenLDAP directory, and a resource inventory & IAM engine, all behind one web console.
One place to manage your users and groups, one login (OIDC) your modern apps can use, and one LDAP directory your older or odder apps can bind to directly — plus a graph of every site, host, and service you run, with auto-provisioned access groups. Everything runs on your own hardware; no phone-home, no hosted control plane, no per-user pricing.
Theta Directory is deployed as part of theta-suite, alongside Proxy and Jump Host — it isn't installed or run on its own. See the Quickstart to stand up the whole stack with one command.
Screenshots
(click any screenshot to view full size)
Features
- OpenID Connect / OAuth 2.0 provider — your own access/refresh/ID
tokens; standard discovery document at
/.well-known/openid-configuration. - Bundled OpenLDAP directory — users, groups, POSIX accounts, SSH public
keys, and sudo roles, with
memberOf+ referential-integrity overlays. - Web management UI — users, groups, and OAuth clients from a browser; invite and password-reset flows over email; self-service profile + API tokens.
- Direct LDAP binds — anything that binds LDAP directly (Linux hosts via PAM/SSSD, Gitea, Emby, …) uses LDAPS/StartTLS against the same directory.
- Multi-Site — one master site, any number of read-only spokes that join with a single key and stay live-synced, with god_admin-gated promotion if the master goes down for good.
- Geo-Location Scaling — built-in support for N-Way Multi-Master OpenLDAP replication across physical sites (a different, lower-level mechanism — see Multi-Site for how the two compare).
- Directory & Inventory — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-suite's agents and discovery plugins. Drives directory-aware tools like the SSH jump host.
- Subtype metrics & lifecycle drivers — telemetry, log streaming, and remote control for resources tagged with a
subType(systemd,docker,proxmox,wireguard,postgresql,redis,k8s, …). - OpenBao-backed secrets — per-resource and per-user secrets with explicit upward inheritance (
Resource → Host → Cluster → Site).