wmantly
5ef3e3fa8c
Two fresh-install fixes and promote the SSH jump host from opt-in to core. setup.sh: fix silent abort after "Minting per-app OpenBao tokens". env_get's grep|cut pipeline returns non-zero under set -euo pipefail when .env exists (created by the root VAULT_TOKEN env_upsert) but an app-token key is absent (the normal first-run state); the unguarded existing assignment from env_get then tripped set -e and killed the script before minting any token. env_get now always returns 0 (|| true). Reproduced + verified under the exact condition. jump host is no longer optional: - docker-compose.yml: drop profiles jump-host from the jump-host service (always started); rename the opt-in test fixture profile jump-host to ldap-test. - setup.sh: SUBMODULES always includes jump-host; build/start/register/summary no longer guarded by JUMP_ENABLED; drop the COMPOSE_PROFILES export. - bootstrap.js: jump provisioning + directory record run unconditionally. - setup.env.example/docs: drop optional/CFG_JUMP_HOST_ENABLED wording. Co-authored-by: Claude <noreply@anthropic.com>
103 lines
6.2 KiB
Bash
103 lines
6.2 KiB
Bash
# ─────────────────────────────────────────────────────────────────────────────
|
|
# setup.env — first-run setup for the theta-env stack.
|
|
#
|
|
# This file is used ONLY on the FIRST run of ./setup.sh, to generate
|
|
# ./config/sso-secrets.js + ./config/proxy-secrets.js with your domain filled
|
|
# in everywhere consistently. Once ./config/*.js exist they are operator-owned
|
|
# (edit them directly; setup.env is ignored on later runs).
|
|
#
|
|
# cp setup.env.example setup.env
|
|
# $EDITOR setup.env # set CFG_DOMAIN below to your domain
|
|
# ./setup.sh # generates ./config/ and builds the stack
|
|
#
|
|
# Copying this file to setup.env (gitignored) keeps your domain out of git.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# Your domain. THIS IS THE ONE PLACE THE DOMAIN IS ENTERED. Everything else
|
|
# derives from it: the SSO/proxy hostnames default to sso.<domain> /
|
|
# proxy.<domain>, and the LDAP base DN is built from it (example.com becomes
|
|
# dc=example,dc=com; a 3-label domain like myhost.duckdns.org becomes
|
|
# dc=myhost,dc=duckdns,dc=org — any number of labels works). Required —
|
|
# setup.sh refuses to run without it.
|
|
CFG_DOMAIN=example.com
|
|
|
|
# Site name for the SSO directory — the root node this stack registers itself
|
|
# under on the Directory page, and the default "Location (Site)" that Linux
|
|
# hosts joined via ldap-client attach to (parent slug: site_<name>).
|
|
# Optional — defaults to "local".
|
|
#CFG_SITE_NAME=local
|
|
|
|
# Public hostnames. Optional — default to sso.<domain> / proxy.<domain> derived
|
|
# from CFG_DOMAIN above. Uncomment and set only if your hostnames differ
|
|
# (e.g. a different subdomain, or the domain isn't the bare apex):
|
|
#CFG_SSO_HOST=sso.example.com
|
|
#CFG_PROXY_HOST=proxy.example.com
|
|
|
|
# ── SSH jump host (always installed) ─────────────────────────────────────────
|
|
# The theta42/jump-host component is installed and started by default — a
|
|
# public SSH jump host that authenticates users against the directory and
|
|
# bridges them to downstream hosts (ssh uid_-_target@jump, or an interactive
|
|
# picker). setup.sh clones/builds the jump-host submodule, the bootstrap mints
|
|
# its directory API token + writes ./config/jump-secrets.js, and it's registered
|
|
# in the proxy + directory. See jump-host's README for the LDAP write-ACL note
|
|
# (the bundled deployment binds as cn=admin).
|
|
#CFG_JUMP_HOST=jump.example.com # defaults to jump.<domain>
|
|
#JUMP_SSH_PORT=2222 # host port mapped to the jump host's SSH (never 22 by default)
|
|
|
|
# Advanced: override the derived LDAP base DN directly (e.g. to namespace
|
|
# under an OU-style prefix). Leave unset to use the DN built from CFG_DOMAIN:
|
|
#CFG_BASE_DN=dc=example,dc=com
|
|
|
|
# ── Optional outbound HTTP(S) proxy ──────────────────────────────────────────
|
|
# For an isolated/offline/corporate-network test host that only reaches the
|
|
# internet through an upstream HTTP proxy — NOT the theta42 "proxy" app.
|
|
# Wired into every service's docker build (npm/apt) AND its running container
|
|
# (SMTP, ACME/Let's Encrypt, DNS provider calls, the jump-host directory API
|
|
# client). Leave unset to disable (the default); CFG_HTTPS_PROXY falls back to
|
|
# CFG_HTTP_PROXY if unset, and CFG_NO_PROXY defaults to covering the stack's
|
|
# own internal service names so container-to-container traffic never goes
|
|
# through the proxy.
|
|
#CFG_HTTP_PROXY=http://proxy.example.com:3128
|
|
#CFG_HTTPS_PROXY=http://proxy.example.com:3128
|
|
#CFG_NO_PROXY=localhost,127.0.0.1,sso-manager,proxy,jump-host
|
|
|
|
# Optional — sensible defaults if left blank:
|
|
#CFG_ORG=SSO Manager # app display name + outbound email org
|
|
#CFG_ADMIN_UID=admin # initial SSO admin username
|
|
#CFG_ADMIN_EMAIL=admin@proxy.example.com # defaults to admin@<proxyHost>
|
|
#CFG_LDAP_CERT_CN= # LDAP TLS cert CN; empty -> defaults to the domain
|
|
#
|
|
# Hostname advertised on the SSO /integrations page for direct LDAPS binds.
|
|
# Leave blank to derive it from the public SSO host (same as oauth.issuer).
|
|
# Recommended: set an internal-only name like 'ldap.internal.example.com' or
|
|
# 'sso-manager' so clients don't need a public 636 port forward. See docs.
|
|
#CFG_LDAPS_HOST=
|
|
|
|
# Optional SMTP (outbound email from the SSO app). Leave blank to disable:
|
|
#CFG_SMTP_HOST=smtp.example.com
|
|
#CFG_SMTP_PORT=587
|
|
#CFG_SMTP_USER=noreply@example.com
|
|
#CFG_SMTP_PASS=your-smtp-password
|
|
#CFG_SMTP_FROM=SSO Manager <noreply@example.com>
|
|
|
|
# ── DO NOT put secrets here ──────────────────────────────────────────────────
|
|
# The LDAP admin password, JWT secret, admin password, LDAP service-account
|
|
# password, and the proxy's local admin password are all GENERATED (random)
|
|
# into ./config/sso-secrets.js + ./config/proxy-secrets.js on first run.
|
|
# Change them later by editing those files directly (the proxy's local admin
|
|
# password is the exception — see ./config/proxy-secrets.js's auth.localAdminPass
|
|
# comment for how to actually change it after the account exists). Do NOT set
|
|
# CFG_LDAP_ADMIN_PASS / CFG_JWT_SECRET / CFG_ADMIN_PASS / CFG_SVC_PASS /
|
|
# CFG_PROXY_ADMIN_PASS here.
|
|
|
|
# ── Geo-Location Scaling (N-Way Multi-Master LDAP) ───────────────────────────
|
|
# If deploying this stack across multiple physical sites to provide local HA
|
|
# for directory services, you can enable N-Way Multi-Master OpenLDAP replication.
|
|
# This requires assigning a unique ID to each site and listing the LDAPS URLs
|
|
# of all OTHER sites in the cluster.
|
|
#
|
|
# Each site MUST have a unique LDAP_SERVER_ID (e.g. 1, 2, 3).
|
|
# LDAP_REPLICATION_HOSTS is a space-separated list of the other sites' LDAP URLs.
|
|
# Example for Site 1:
|
|
#LDAP_SERVER_ID=1
|
|
#LDAP_REPLICATION_HOSTS="ldaps://sso.site2.com:636 ldaps://sso.site3.com:636" |