wmantly
28016376ad
Pass optional CFG_LDAPS_HOST from setup.env through setup.sh into the generated ./config/sso-secrets.js as ldap.ldapsHost. This lets operators advertise an internal-only LDAPS hostname (e.g. ldap.internal.example.com or sso-manager) on the SSO /integrations page instead of the public OAuth issuer, avoiding a public 636 port forward. - setup.env.example: add CFG_LDAPS_HOST - setup.sh: read/forward CFG_LDAPS_HOST into sso-secrets.js - config.example/sso-secrets.js.example: document ldapsHost/ldapsPort - .env.example: add LDAPS_HOST for legacy .env migrations - docker-compose.yml: comment warning against public 636 forwarding - README.md: explain CFG_LDAPS_HOST recommendation - CHANGELOG.md + bump version to 1.1.19 Co-authored-by: Claude <noreply@anthropic.com>
85 lines
4.3 KiB
Bash
85 lines
4.3 KiB
Bash
# theta-env — unified SSO Manager + Proxy deployment.
|
|
#
|
|
# Copy this file to `.env` and fill in the values, then run `./setup.sh`.
|
|
# All values are read by setup.sh / docker-compose / the bootstrap.
|
|
#
|
|
# Values may contain spaces. Quote them if they could be split by a shell,
|
|
# e.g. ORG_NAME="My Org" or SMTP_FROM="Theta SSO <noreply@example.com>".
|
|
# Quotes are optional but harmless — setup.sh + docker compose strip a single
|
|
# matching pair of outer quotes from any value.
|
|
|
|
# ── Directory / domain (REQUIRED-ish — set these) ────────────────────────────
|
|
|
|
# Your organization's LDAP base DN. Derives the LDAP domain + cert defaults.
|
|
LDAP_BASE_DN=dc=example,dc=com
|
|
# DNS domain (dc=foo,dc=bar -> foo.bar). Leave blank to derive from LDAP_BASE_DN.
|
|
LDAP_DOMAIN=
|
|
# LDAP admin password. MUST be changed. Leave blank and setup.sh will generate one.
|
|
LDAP_ADMIN_PASS=CHANGE-ME
|
|
ORG_NAME="My Org"
|
|
|
|
# ── Public hostnames (REQUIRED) ───────────────────────────────────────────────
|
|
# The proxy serves the SSO Manager UI at https://<SSO_HOST> and its own
|
|
# management UI at https://<PROXY_HOST>. Both must resolve (DNS or hosts file)
|
|
# to the host running this stack, and the proxy must be able to complete ACME
|
|
# (port 80 reachable) for real certs — or use the self-signed fallback on LAN.
|
|
SSO_HOST=sso.example.com
|
|
PROXY_HOST=proxy.example.com
|
|
|
|
# ── First admin (created in the SSO by the bootstrap) ───────────────────────
|
|
# The bootstrap creates this user in LDAP, adds them to app_sso_admin +
|
|
# app_sso_oauth_admin, and logs in as them to register the proxy OAuth client.
|
|
# Re-running setup.sh resets this password to BOOTSTRAP_ADMIN_PASS.
|
|
BOOTSTRAP_ADMIN_UID=admin
|
|
# First admin password. MUST be changed. Leave blank and setup.sh will generate one.
|
|
BOOTSTRAP_ADMIN_PASS=CHANGE-ME
|
|
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
|
|
|
|
# ── Proxy LDAP service account (created by the bootstrap) ────────────────────
|
|
# The proxy binds to LDAP as cn=ldapclient,ou=people,<base> with this password.
|
|
# Re-running setup.sh resets it to LDAP_SERVICE_PASS.
|
|
# LDAP service-account password. MUST be changed. Leave blank and setup.sh will generate one.
|
|
LDAP_SERVICE_PASS=CHANGE-ME
|
|
|
|
# ── OAuth JWT secret (REQUIRED — persist it) ────────────────────────────────
|
|
# Signs the SSO's access/refresh tokens. Generate with: openssl rand -hex 32
|
|
# Leave blank to auto-generate (NOT persisted across container recreation —
|
|
# set it explicitly for a stable install).
|
|
JWT_SECRET=
|
|
|
|
# ── Optional: outbound email (SSO password resets / invites) ─────────────────
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_FROM=
|
|
|
|
# ── Optional: host port overrides ───────────────────────────────────────────
|
|
# SSO web UI + proxy mgmt UI host ports.
|
|
SSO_PORT=3001
|
|
LDAPS_PORT=636
|
|
# Proxy listeners:
|
|
HTTP_PORT=80
|
|
HTTPS_PORT=443
|
|
HTTPS_ALT_PORT=4443
|
|
MGMT_PORT=3000
|
|
|
|
# ── Optional: bind address for the SSO UI (3001) + proxy mgmt UI (3000) ───────
|
|
# Default 0.0.0.0 = reachable on the LAN (convenient for first-run / admin from
|
|
# another machine). These UIs are login-protected, but exposing them widens the
|
|
# attack surface; once the proxy fronts both under TLS you can lock them to the
|
|
# host only by setting each to 127.0.0.1.
|
|
SSO_BIND=0.0.0.0
|
|
MGMT_BIND=0.0.0.0
|
|
|
|
# ── Optional: LDAP TLS cert CN (hostname LDAPS clients verify) ───────────────
|
|
# Defaults to LDAP_DOMAIN. Set to the hostname the proxy connects via
|
|
# (sso-manager inside the docker net uses the service name, which is in the
|
|
# cert's SAN, so the default is usually fine).
|
|
LDAP_CERT_CN=
|
|
|
|
# ── Optional: LDAPS hostname shown on the SSO /integrations page ────────────────
|
|
# Leave blank to derive from the public SSO host (SSO_HOST). Set an internal-only
|
|
# name like 'ldap.internal.example.com' or 'sso-manager' so direct-LDAP clients
|
|
# don't need a public 636 port forward. See docs/ldap.md for network layouts.
|
|
LDAPS_HOST= |