wmantly
3287777b9b
Rename the project to theta-suite (it is now an integrated suite of four apps around a shared OpenBao secrets store, not a two-project env). - theta-env -> theta-suite across the superproject: _config.yml (title + baseurl /theta-suite + repo URLs), README, setup.sh (incl. the THETA_SUITE_REEXECED self-update sentinel), docker-compose.yml, bootstrap.js, lint.yml, config.example/*, docs/robots.txt, all docs, this changelog. - architecture.md rewritten: real 4-service + ldap-client topology, OpenBao secrets section, OpenBao-aware config flow; removed "two containers" / "three repos" / LDAP-"legacy" framing. - index.md: integrated-suite framing + secrets/OpenBao + ldap-client. - standalone.md + README: standalone reframed as advanced opt-in. - sso-manager-node submodule -> v1.16.1 (401 fix on /conf and /vault). Co-authored-by: Claude <noreply@anthropic.com>
58 lines
2.8 KiB
Plaintext
58 lines
2.8 KiB
Plaintext
'use strict';
|
|
// Example SSO secrets for the theta-suite unified stack. Copy to
|
|
// ./config/sso-secrets.js (NOT this file — ./config/ is gitignored) and edit.
|
|
// `./setup.sh` generates ./config/sso-secrets.js for you on first run; this file
|
|
// documents the shape for manual editing / reference.
|
|
//
|
|
// The SSO app reads this via @simpleworkjs/conf (docker-entrypoint.sh sets
|
|
// CONF_SECRETS to point at it). The app ignores the extra stack/bootstrap/
|
|
// serviceAccountPass keys (read by the orchestrator). Back this up off-host —
|
|
// it holds all SSO secrets. Never commit ./config/.
|
|
|
|
module.exports = {
|
|
name: 'SSO Manager', // shown in UI + outbound email
|
|
ldap: {
|
|
url: 'ldap://localhost:389', // the bundled slapd (in-container)
|
|
bindDN: 'cn=admin,dc=example,dc=com', // slapd root DN
|
|
bindPassword: 'CHANGE-ME', // slapd root + app bind password
|
|
userBase: 'ou=people,dc=example,dc=com',
|
|
groupBase: 'ou=groups,dc=example,dc=com',
|
|
// ldapsHost: 'ldap.internal.example.com', // optional: internal-only hostname
|
|
// shown on /integrations for direct LDAPS binds. Empty -> derive from issuer.
|
|
// ldapsPort: 636,
|
|
},
|
|
smtp: { // optional; leave host '' to skip
|
|
host: '', port: 587, secure: false,
|
|
user: '', pass: '', from: '',
|
|
},
|
|
oauth: {
|
|
issuer: 'https://sso.example.com', // browser-facing SSO URL
|
|
jwtSecret: 'CHANGE-ME', // signs all tokens — keep secret
|
|
token_lifetime: { access_token: 3600, refresh_token: 2592000 },
|
|
},
|
|
// Without this, @simpleworkjs/orm falls back to './config/inventory.sqlite'
|
|
// (relative to the app's /app cwd) -- inside the container's ephemeral
|
|
// layer, not any mounted volume, so every Resource/site/host/service/oauth
|
|
// row (the whole Directory Management page) would be silently wiped on
|
|
// every container recreate. /data is already a persisted volume (Redis
|
|
// lives there too), so this just co-locates the sqlite file with it.
|
|
orm: {
|
|
dialect: 'sqlite',
|
|
storage: '/data/inventory.sqlite',
|
|
},
|
|
|
|
// ── Orchestrator-only (ignored by the app; read by setup.sh + bootstrap) ──
|
|
stack: {
|
|
ldapBaseDn: 'dc=example,dc=com', // slapd suffix (drives seed OUs)
|
|
ldapDomain: 'example.com', // default cert CN + issuer host
|
|
ldapCertCn: '', // cert CN; '' -> defaults to ldapDomain
|
|
ssoHost: 'sso.example.com', // public SSO hostname
|
|
proxyHost: 'proxy.example.com', // public proxy hostname
|
|
},
|
|
bootstrap: {
|
|
adminUid: 'admin', // first SSO admin username
|
|
adminPass: 'CHANGE-ME', // first SSO admin password
|
|
adminEmail: 'admin@proxy.example.com', // first SSO admin email
|
|
},
|
|
serviceAccountPass: 'CHANGE-ME', // LDAP password the proxy binds with
|
|
}; |