wmantly
e46768bb68
- CHANGELOG.md now embeds full app-level release notes for submodule bumps. - .env.example uses explicit CHANGE-ME placeholders instead of realistic-looking defaults. - config.example comments describe the actual CONF_SECRETS mechanism. - setup.sh summary no longer prints generated passwords to stdout. - bootstrap.js fails hard instead of falling back to weak default passwords. Note: submodule pins will be updated to v1.1.16 after the app PRs merge. Co-Authored-By: Claude <noreply@anthropic.com>
49 lines
2.0 KiB
Plaintext
49 lines
2.0 KiB
Plaintext
'use strict';
|
|
// Example proxy secrets for the theta-env unified stack. Copy to
|
|
// ./config/proxy-secrets.js (NOT this file — ./config/ is gitignored) and edit.
|
|
// `./setup.sh` generates ./config/proxy-secrets.js for you on first run and the
|
|
// bootstrap writes the OAuth client clientId/clientSecret back into it; this
|
|
// file documents the shape for manual editing / reference.
|
|
//
|
|
// The proxy app reads this via @simpleworkjs/conf (docker-entrypoint.sh sets
|
|
// CONF_SECRETS to point at it). Never commit ./config/.
|
|
|
|
module.exports = {
|
|
oidc: {
|
|
enabled: true,
|
|
issuer: 'https://sso.example.com',
|
|
authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
|
|
// token/userinfo use the internal docker-network URL (no TLS hairpin):
|
|
tokenEndpoint: 'http://sso-manager:3001/oauth/token',
|
|
userinfoEndpoint: 'http://sso-manager:3001/oauth/userinfo',
|
|
endSessionEndpoint: 'https://sso.example.com/oauth/logout',
|
|
clientId: 'FILLED-IN-BY-BOOTSTRAP', // leave as-is; bootstrap sets it
|
|
clientSecret: 'FILLED-IN-BY-BOOTSTRAP', // leave as-is; bootstrap sets it
|
|
redirectUri: 'https://proxy.example.com/api/auth/oidc/callback',
|
|
scopes: ['openid', 'profile', 'email', 'groups'],
|
|
groupsClaim: 'groups',
|
|
usernameClaim: 'preferred_username',
|
|
},
|
|
ldap: {
|
|
// LDAPS over the docker network; the SSO's self-signed cert is trusted
|
|
// via tlsOptions.rejectUnauthorized:false.
|
|
url: 'ldaps://sso-manager:636',
|
|
bindDN: 'cn=ldapclient,ou=people,dc=example,dc=com',
|
|
// MUST equal serviceAccountPass in sso-secrets.js (the proxy binds as
|
|
// that service account). setup.sh keeps them in sync on generation.
|
|
bindPassword: 'CHANGE-ME',
|
|
searchBase: 'ou=people,dc=example,dc=com',
|
|
userFilter: '(objectClass=posixAccount)',
|
|
userNameAttribute: 'uid',
|
|
tlsOptions: { rejectUnauthorized: false },
|
|
},
|
|
auth: {
|
|
adminGroups: ['app_sso_admin'], // SSO group -> global proxy admin
|
|
adminUsers: ['proxyadmin2'], // local anti-lockout admin
|
|
groupRoleMap: {},
|
|
},
|
|
stack: {
|
|
ssoHost: 'sso.example.com',
|
|
proxyHost: 'proxy.example.com',
|
|
},
|
|
}; |