wmantly
3287777b9b
Rename the project to theta-suite (it is now an integrated suite of four apps around a shared OpenBao secrets store, not a two-project env). - theta-env -> theta-suite across the superproject: _config.yml (title + baseurl /theta-suite + repo URLs), README, setup.sh (incl. the THETA_SUITE_REEXECED self-update sentinel), docker-compose.yml, bootstrap.js, lint.yml, config.example/*, docs/robots.txt, all docs, this changelog. - architecture.md rewritten: real 4-service + ldap-client topology, OpenBao secrets section, OpenBao-aware config flow; removed "two containers" / "three repos" / LDAP-"legacy" framing. - index.md: integrated-suite framing + secrets/OpenBao + ldap-client. - standalone.md + README: standalone reframed as advanced opt-in. - sso-manager-node submodule -> v1.16.1 (401 fix on /conf and /vault). Co-authored-by: Claude <noreply@anthropic.com>
49 lines
2.0 KiB
Plaintext
49 lines
2.0 KiB
Plaintext
'use strict';
|
|
// Example proxy secrets for the theta-suite unified stack. Copy to
|
|
// ./config/proxy-secrets.js (NOT this file — ./config/ is gitignored) and edit.
|
|
// `./setup.sh` generates ./config/proxy-secrets.js for you on first run and the
|
|
// bootstrap writes the OAuth client clientId/clientSecret back into it; this
|
|
// file documents the shape for manual editing / reference.
|
|
//
|
|
// The proxy app reads this via @simpleworkjs/conf (docker-entrypoint.sh sets
|
|
// CONF_SECRETS to point at it). Never commit ./config/.
|
|
|
|
module.exports = {
|
|
oidc: {
|
|
enabled: true,
|
|
issuer: 'https://sso.example.com',
|
|
authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
|
|
// token/userinfo use the internal docker-network URL (no TLS hairpin):
|
|
tokenEndpoint: 'http://sso-manager:3001/oauth/token',
|
|
userinfoEndpoint: 'http://sso-manager:3001/oauth/userinfo',
|
|
endSessionEndpoint: 'https://sso.example.com/oauth/logout',
|
|
clientId: 'FILLED-IN-BY-BOOTSTRAP', // leave as-is; bootstrap sets it
|
|
clientSecret: 'FILLED-IN-BY-BOOTSTRAP', // leave as-is; bootstrap sets it
|
|
redirectUri: 'https://proxy.example.com/api/auth/oidc/callback',
|
|
scopes: ['openid', 'profile', 'email', 'groups'],
|
|
groupsClaim: 'groups',
|
|
usernameClaim: 'preferred_username',
|
|
},
|
|
ldap: {
|
|
// LDAPS over the docker network; the SSO's self-signed cert is trusted
|
|
// via tlsOptions.rejectUnauthorized:false.
|
|
url: 'ldaps://sso-manager:636',
|
|
bindDN: 'cn=ldapclient,ou=people,dc=example,dc=com',
|
|
// MUST equal serviceAccountPass in sso-secrets.js (the proxy binds as
|
|
// that service account). setup.sh keeps them in sync on generation.
|
|
bindPassword: 'CHANGE-ME',
|
|
searchBase: 'ou=people,dc=example,dc=com',
|
|
userFilter: '(objectClass=posixAccount)',
|
|
userNameAttribute: 'uid',
|
|
tlsOptions: { rejectUnauthorized: false },
|
|
},
|
|
auth: {
|
|
adminGroups: ['app_sso_admin'], // SSO group -> global proxy admin
|
|
adminUsers: ['proxyadmin2'], // local anti-lockout admin
|
|
groupRoleMap: {},
|
|
},
|
|
stack: {
|
|
ssoHost: 'sso.example.com',
|
|
proxyHost: 'proxy.example.com',
|
|
},
|
|
}; |