wmantly
9fb240ff45
Composes theta42/sso-manager-node and theta42/proxy (as git submodules) on a single Docker network and automates first-run wiring. - docker-compose.yml: sso-manager (build ./sso-manager-node/Dockerfile.openldap) + proxy (build ./proxy/Dockerfile) on theta-net; SSO UI + mgmt port bound to localhost, LDAPS published, proxy 80/443/4443 published. - setup.sh: idempotent one-command bring-up — validates .env, starts SSO, runs the bootstrap, writes ./proxy.env, starts the proxy, prints admin login. - bootstrap/bootstrap.js: runs inside the sso-manager container (self-contained, Node built-ins + fetch only) — creates the LDAP service account, first admin (+ app_sso_admin/app_sso_oauth_admin membership), registers the proxy as an OIDC client via the SSO HTTP API, emits CLIENT_ID/CLIENT_SECRET. - .env.example: all tunables (LDAP_BASE_DN, LDAP_ADMIN_PASS, JWT_SECRET, SSO_HOST, PROXY_HOST, BOOTSTRAP_ADMIN_*, LDAP_SERVICE_PASS, SMTP_*, ports). - README.md + docs/ (Jekyll site for GitHub Pages): quickstart, architecture, standalone usage. Co-Authored-By: Claude <noreply@anthropic.com>
4.2 KiB
layout, title
| layout | title |
|---|---|
| default | Home |
theta-env
A single repo that runs the whole theta42 identity + access stack — SSO Manager (OIDC provider + LDAP) and the theta42/proxy (OIDC-protected reverse proxy) — together, with one command, for home labs and small businesses.
It exists for people whose needs are met by these two projects and who want to run them "very simply." Each project still works standalone; this repo just wires them together and automates the first-run glue.
Quick start
git clone --recursive https://github.com/theta42/theta-env.git
cd theta-env
cp .env.example .env # edit the REQUIRED values (below)
./setup.sh
You need Docker + Docker Compose. ./setup.sh is idempotent — re-run any
time to converge the stack to your .env.
See the Quickstart Guide for a walkthrough of every .env
value and what setup.sh does, Architecture for how the
pieces fit together, and Standalone for running each project
on its own.
What you get
- SSO Manager at
https://<SSO_HOST>— log in as your first admin to manage users, groups, and OAuth clients. Fronted by the proxy under TLS. - Proxy at
https://<PROXY_HOST>— add the Host records you want to protect with OIDC login. - LDAPS at
ldaps://<host>:636— legacy apps can bind directly (admin or the read-onlycn=ldapclientservice account the bootstrap creates).
The .env values you must set
| Key | What it is |
|---|---|
LDAP_BASE_DN |
Directory base, e.g. dc=lab,dc=local. |
LDAP_ADMIN_PASS |
LDAP root password. Save it. |
JWT_SECRET |
Signs the SSO's tokens. Leave blank to auto-generate + persist. Save it. |
SSO_HOST |
Public hostname the proxy serves the SSO UI at. |
PROXY_HOST |
Public hostname the proxy serves its own mgmt UI at. |
BOOTSTRAP_ADMIN_UID / BOOTSTRAP_ADMIN_PASS |
Your first admin login. |
See .env.example for the full list (SMTP, port overrides, LDAP cert CN, …).
Architecture
┌──────────────────────────────────────────────┐
│ your browser / apps │
└───────────────┬──────────────────────────────┘
│ https
┌─────────▼─────────┐
│ proxy │ OpenResty :80/:443/:4443
│ (OIDC + LDAP) │ mgmt app :3000 (localhost)
└─────────┬─────────┘ bundled redis
┌─────────────┼──────────────────────┐
│ ldaps:636 │ http:3001 (internal)│ OIDC token/userinfo
▼ ▼ │
┌──────────────────────────┐ │
│ sso-manager │◄────────────────┘
│ OIDC provider + OpenLDAP │ bundled redis
│ web UI :3001 (localhost) │
│ ldaps :636 (LAN clients) │
└───────────────────────────┘
The proxy is both an OIDC client of the SSO (for login) and a direct LDAP client (for user lookups). See Architecture for the full diagram + the first-run bootstrap flow.
Documentation
- Quickstart Guide — full walkthrough of
.env+setup.sh. - Architecture — the 3-repo + submodule + 2-container design, and how the bootstrap wires the proxy into a fresh SSO.
- Standalone — running SSO Manager or the proxy on its own.
Community
License
MIT License — see the repository for details.