First commit
This commit is contained in:
@@ -0,0 +1,63 @@
|
||||
{
|
||||
"clientId": "OpenCloudAndroid",
|
||||
"name": "OpenCloud Android App",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"oc://android.opencloud.eu"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "false",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"post.logout.redirect.uris": "oc://android.opencloud.eu",
|
||||
"backchannel.logout.revoke.offline.tokens": "false",
|
||||
"saml.server.signature": "false",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"exclude.session.state.from.auth.response": "false",
|
||||
"backchannel.logout.session.required": "true",
|
||||
"client_credentials.use_refresh_token": "false",
|
||||
"saml_force_name_id_format": "false",
|
||||
"saml.client.signature": "false",
|
||||
"tls.client.certificate.bound.access.tokens": "false",
|
||||
"saml.authnstatement": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"saml.onetimeuse.condition": "false"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": true,
|
||||
"nodeReRegistrationTimeout": -1,
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"profile",
|
||||
"roles",
|
||||
"groups",
|
||||
"basic",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
],
|
||||
"access": {
|
||||
"view": true,
|
||||
"configure": true,
|
||||
"manage": true
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
{
|
||||
"clientId": "OpenCloudDesktop",
|
||||
"name": "OpenCloud Desktop Client",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"http://127.0.0.1",
|
||||
"http://localhost"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "false",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"post.logout.redirect.uris": "+",
|
||||
"backchannel.logout.revoke.offline.tokens": "false",
|
||||
"saml.server.signature": "false",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"exclude.session.state.from.auth.response": "false",
|
||||
"backchannel.logout.session.required": "true",
|
||||
"client_credentials.use_refresh_token": "false",
|
||||
"saml_force_name_id_format": "false",
|
||||
"saml.client.signature": "false",
|
||||
"tls.client.certificate.bound.access.tokens": "false",
|
||||
"saml.authnstatement": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"saml.onetimeuse.condition": "false"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": true,
|
||||
"nodeReRegistrationTimeout": -1,
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"profile",
|
||||
"roles",
|
||||
"groups",
|
||||
"basic",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
],
|
||||
"access": {
|
||||
"view": true,
|
||||
"configure": true,
|
||||
"manage": true
|
||||
}
|
||||
}
|
||||
63
opencloud-compose/config/keycloak/clients/OpenCloudIOS.json
Normal file
63
opencloud-compose/config/keycloak/clients/OpenCloudIOS.json
Normal file
@@ -0,0 +1,63 @@
|
||||
{
|
||||
"clientId": "OpenCloudIOS",
|
||||
"name": "OpenCloud iOS App",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"oc://ios.opencloud.eu"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "false",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"post.logout.redirect.uris": "oc://ios.opencloud.eu",
|
||||
"backchannel.logout.revoke.offline.tokens": "false",
|
||||
"saml.server.signature": "false",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"exclude.session.state.from.auth.response": "false",
|
||||
"backchannel.logout.session.required": "true",
|
||||
"client_credentials.use_refresh_token": "false",
|
||||
"saml_force_name_id_format": "false",
|
||||
"saml.client.signature": "false",
|
||||
"tls.client.certificate.bound.access.tokens": "false",
|
||||
"saml.authnstatement": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"saml.onetimeuse.condition": "false"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": true,
|
||||
"nodeReRegistrationTimeout": -1,
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"profile",
|
||||
"roles",
|
||||
"groups",
|
||||
"basic",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
],
|
||||
"access": {
|
||||
"view": true,
|
||||
"configure": true,
|
||||
"manage": true
|
||||
}
|
||||
}
|
||||
66
opencloud-compose/config/keycloak/clients/cyberduck.json
Normal file
66
opencloud-compose/config/keycloak/clients/cyberduck.json
Normal file
@@ -0,0 +1,66 @@
|
||||
{
|
||||
"clientId": "Cyberduck",
|
||||
"name": "Cyberduck",
|
||||
"description": "File transfer utility client",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"x-cyberduck-action:oauth",
|
||||
"x-mountainduck-action:oauth"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "false",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"oauth2.device.authorization.grant.enabled": "false",
|
||||
"backchannel.logout.revoke.offline.tokens": "false",
|
||||
"saml.server.signature": "false",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"exclude.session.state.from.auth.response": "false",
|
||||
"oidc.ciba.grant.enabled": "false",
|
||||
"backchannel.logout.session.required": "true",
|
||||
"client_credentials.use_refresh_token": "false",
|
||||
"saml_force_name_id_format": "false",
|
||||
"saml.client.signature": "false",
|
||||
"tls.client.certificate.bound.access.tokens": "false",
|
||||
"saml.authnstatement": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"saml.onetimeuse.condition": "false"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": true,
|
||||
"nodeReRegistrationTimeout": -1,
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"profile",
|
||||
"roles",
|
||||
"groups",
|
||||
"basic",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
],
|
||||
"access": {
|
||||
"view": true,
|
||||
"configure": true,
|
||||
"manage": true
|
||||
}
|
||||
}
|
||||
74
opencloud-compose/config/keycloak/clients/web.json
Normal file
74
opencloud-compose/config/keycloak/clients/web.json
Normal file
@@ -0,0 +1,74 @@
|
||||
{
|
||||
"clientId": "web",
|
||||
"name": "OpenCloud Web App",
|
||||
"description": "",
|
||||
"rootUrl": "{{OC_URL}}",
|
||||
"adminUrl": "{{OC_URL}}",
|
||||
"baseUrl": "",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"{{OC_URL}}/",
|
||||
"{{OC_URL}}/oidc-callback.html",
|
||||
"{{OC_URL}}/oidc-silent-redirect.html"
|
||||
],
|
||||
"webOrigins": [
|
||||
"{{OC_URL}}"
|
||||
],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "false",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"post.logout.redirect.uris": "+",
|
||||
"oauth2.device.authorization.grant.enabled": "false",
|
||||
"backchannel.logout.revoke.offline.tokens": "false",
|
||||
"saml.server.signature": "false",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"exclude.session.state.from.auth.response": "false",
|
||||
"oidc.ciba.grant.enabled": "false",
|
||||
"backchannel.logout.url": "{{OC_URL}}/backchannel_logout",
|
||||
"backchannel.logout.session.required": "true",
|
||||
"client_credentials.use_refresh_token": "false",
|
||||
"saml_force_name_id_format": "false",
|
||||
"saml.client.signature": "false",
|
||||
"tls.client.certificate.bound.access.tokens": "false",
|
||||
"saml.authnstatement": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"saml.onetimeuse.condition": "false"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": true,
|
||||
"nodeReRegistrationTimeout": -1,
|
||||
"defaultClientScopes": [
|
||||
"web-origins",
|
||||
"profile",
|
||||
"roles",
|
||||
"groups",
|
||||
"basic",
|
||||
"email"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"address",
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt"
|
||||
],
|
||||
"access": {
|
||||
"view": true,
|
||||
"configure": true,
|
||||
"manage": true
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
printenv
|
||||
# replace openCloud domain and LDAP password in keycloak realm import
|
||||
mkdir /opt/keycloak/data/import
|
||||
sed -e "s/cloud.opencloud.test/${OC_DOMAIN}/g" -e "s/ldap-admin-password/${LDAP_ADMIN_PASSWORD:-admin}/g" /opt/keycloak/data/import-dist/openCloud-realm.json > /opt/keycloak/data/import/openCloud-realm.json
|
||||
|
||||
# run original docker-entrypoint
|
||||
/opt/keycloak/bin/kc.sh "$@"
|
||||
File diff suppressed because it is too large
Load Diff
3052
opencloud-compose/config/keycloak/opencloud-realm.dist.json
Normal file
3052
opencloud-compose/config/keycloak/opencloud-realm.dist.json
Normal file
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,9 @@
|
||||
#!/bin/bash
|
||||
echo "Running custom LDAP entrypoint script..."
|
||||
|
||||
if [ ! -f /opt/bitnami/openldap/share/openldap.key ]
|
||||
then
|
||||
openssl req -x509 -newkey rsa:4096 -keyout /opt/bitnami/openldap/share/openldap.key -out /opt/bitnami/openldap/share/openldap.crt -sha256 -days 365 -batch -nodes
|
||||
fi
|
||||
# run original docker-entrypoint
|
||||
/opt/bitnami/scripts/openldap/entrypoint.sh "$@"
|
||||
11
opencloud-compose/config/ldap/init-ldap-acls.sh
Executable file
11
opencloud-compose/config/ldap/init-ldap-acls.sh
Executable file
@@ -0,0 +1,11 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eu
|
||||
|
||||
# apply acls
|
||||
echo -n "Applying acls... "
|
||||
slapmodify -F /opt/bitnami/openldap/etc/slapd.d -b cn=config -l /opt/bitnami/openldap/etc/schema/50_acls.ldif
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "done."
|
||||
else
|
||||
echo "failed."
|
||||
fi
|
||||
24
opencloud-compose/config/ldap/ldif/10_base.ldif
Normal file
24
opencloud-compose/config/ldap/ldif/10_base.ldif
Normal file
@@ -0,0 +1,24 @@
|
||||
dn: dc=opencloud,dc=eu
|
||||
objectClass: organization
|
||||
objectClass: dcObject
|
||||
dc: opencloud
|
||||
o: openCloud
|
||||
|
||||
dn: ou=users,dc=opencloud,dc=eu
|
||||
objectClass: organizationalUnit
|
||||
ou: users
|
||||
|
||||
dn: cn=admin,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: person
|
||||
cn: admin
|
||||
sn: admin
|
||||
uid: ldapadmin
|
||||
|
||||
dn: ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: organizationalUnit
|
||||
ou: groups
|
||||
|
||||
dn: ou=custom,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: organizationalUnit
|
||||
ou: custom
|
||||
20
opencloud-compose/config/ldap/ldif/20_admin.ldif
Normal file
20
opencloud-compose/config/ldap/ldif/20_admin.ldif
Normal file
@@ -0,0 +1,20 @@
|
||||
dn: uid=admin,ou=users,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: organizationalPerson
|
||||
objectClass: person
|
||||
objectClass: top
|
||||
uid: admin
|
||||
givenName: Admin
|
||||
sn: Admin
|
||||
cn: admin
|
||||
displayName: Admin
|
||||
description: An admin for this OpenCloud instance.
|
||||
mail: admin@example.org
|
||||
userPassword:: e1NTSEF9UWhmaFB3dERydTUydURoWFFObDRMbzVIckI3TkI5Nmo==
|
||||
|
||||
dn: cn=administrators,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: administrators
|
||||
description: OpenCloud Administrators
|
||||
member: uid=admin,ou=users,dc=opencloud,dc=eu
|
||||
70
opencloud-compose/config/ldap/ldif/30_demo_users.ldif
Normal file
70
opencloud-compose/config/ldap/ldif/30_demo_users.ldif
Normal file
@@ -0,0 +1,70 @@
|
||||
# Start dn with uid (user identifier / login), not cn (Firstname + Surname)
|
||||
dn: uid=alan,ou=users,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: organizationalPerson
|
||||
objectClass: person
|
||||
objectClass: top
|
||||
uid: alan
|
||||
givenName: Alan
|
||||
sn: Turing
|
||||
cn: alan
|
||||
displayName: Alan Turing
|
||||
description: An English mathematician, computer scientist, logician, cryptanalyst, philosopher and theoretical biologist. He was highly influential in the development of theoretical computer science, providing a formalisation of the concepts of algorithm and computation with the Turing machine.
|
||||
mail: alan@example.org
|
||||
userPassword:: e1NTSEF9Y2ZMdVlqMTBDUFpLWE44VC9mQ0FzYnFHQmtyZExJeGg=
|
||||
|
||||
dn: uid=lynn,ou=users,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: organizationalPerson
|
||||
objectClass: person
|
||||
objectClass: top
|
||||
uid: lynn
|
||||
givenName: Lynn
|
||||
sn: Conway
|
||||
cn: lynn
|
||||
displayName: Lynn Conway
|
||||
description: An American computer scientist, electrical engineer, and transgender activist.
|
||||
mail: lynn@example.org
|
||||
userPassword:: e1NTSEF9Y2ZMdVlqMTBDUFpLWE44VC9mQ0FzYnFHQmtyZExJeGg=
|
||||
|
||||
dn: uid=mary,ou=users,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: organizationalPerson
|
||||
objectClass: person
|
||||
objectClass: top
|
||||
uid: mary
|
||||
givenName: Mary
|
||||
sn: Kenneth Keller
|
||||
cn: mary
|
||||
displayName: Mary Kenneth Keller
|
||||
description: Mary Kenneth Keller of the Sisters of Charity of the Blessed Virgin Mary was a pioneer in computer science.
|
||||
mail: mary@example.org
|
||||
userPassword:: e1NTSEF9Y2ZMdVlqMTBDUFpLWE44VC9mQ0FzYnFHQmtyZExJeGg=
|
||||
|
||||
dn: uid=margaret,ou=users,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: organizationalPerson
|
||||
objectClass: person
|
||||
objectClass: top
|
||||
uid: margaret
|
||||
givenName: Margaret
|
||||
sn: Hamilton
|
||||
cn: margaret
|
||||
displayName: Margaret Hamilton
|
||||
description: A director of the Software Engineering Division of the MIT Instrumentation Laboratory, which developed on-board flight software for NASA's Apollo program.
|
||||
mail: margaret@example.org
|
||||
userPassword:: e1NTSEF9Y2ZMdVlqMTBDUFpLWE44VC9mQ0FzYnFHQmtyZExJeGg=
|
||||
|
||||
dn: uid=dennis,ou=users,dc=opencloud,dc=eu
|
||||
objectClass: inetOrgPerson
|
||||
objectClass: organizationalPerson
|
||||
objectClass: person
|
||||
objectClass: top
|
||||
uid: dennis
|
||||
givenName: Dennis
|
||||
sn: Ritchie
|
||||
cn: dennis
|
||||
displayName: Dennis Ritchie
|
||||
description: American computer scientist. He created the C programming language and the Unix operating system and B language with long-time colleague Ken Thompson.
|
||||
mail: dennis@example.org
|
||||
userPassword:: e1NTSEF9Y2ZMdVlqMTBDUFpLWE44VC9mQ0FzYnFHQmtyZExJeGg=
|
||||
70
opencloud-compose/config/ldap/ldif/40_demo_groups.ldif
Normal file
70
opencloud-compose/config/ldap/ldif/40_demo_groups.ldif
Normal file
@@ -0,0 +1,70 @@
|
||||
dn: cn=users,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: users
|
||||
description: Users
|
||||
member: uid=alan,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=mary,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=margaret,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=dennis,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=lynn,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=admin,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=chess-lovers,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: chess-lovers
|
||||
description: Chess lovers
|
||||
member: uid=alan,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=machine-lovers,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: machine-lovers
|
||||
description: Machine Lovers
|
||||
member: uid=alan,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=bible-readers,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: bible-readers
|
||||
description: Bible readers
|
||||
member: uid=mary,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=apollos,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: apollos
|
||||
description: Contributors to the Apollo mission
|
||||
member: uid=margaret,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=unix-lovers,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: unix-lovers
|
||||
description: Unix lovers
|
||||
member: uid=dennis,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=basic-haters,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: basic-haters
|
||||
description: Haters of the Basic programming language
|
||||
member: uid=dennis,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=vlsi-lovers,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: vlsi-lovers
|
||||
description: Lovers of VLSI microchip design
|
||||
member: uid=lynn,ou=users,dc=opencloud,dc=eu
|
||||
|
||||
dn: cn=programmers,ou=groups,dc=opencloud,dc=eu
|
||||
objectClass: groupOfNames
|
||||
objectClass: top
|
||||
cn: programmers
|
||||
description: Computer Programmers
|
||||
member: uid=alan,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=margaret,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=dennis,ou=users,dc=opencloud,dc=eu
|
||||
member: uid=lynn,ou=users,dc=opencloud,dc=eu
|
||||
9
opencloud-compose/config/ldap/ldif/50_acls.ldif
Normal file
9
opencloud-compose/config/ldap/ldif/50_acls.ldif
Normal file
@@ -0,0 +1,9 @@
|
||||
# OpenCloud ldap acl file which gets applied during the first db initialisation
|
||||
dn: olcDatabase={2}mdb,cn=config
|
||||
changetype: modify
|
||||
replace: olcAccess
|
||||
olcAccess: {0}to dn.subtree="dc=opencloud,dc=eu" attrs=entry,uid,objectClass,entryUUID
|
||||
by * read
|
||||
olcAccess: {1}to attrs=userPassword
|
||||
by self write
|
||||
by * auth
|
||||
@@ -0,0 +1,39 @@
|
||||
# This LDIF files describes the OpenCloud schema
|
||||
dn: cn=opencloud,cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: opencloud
|
||||
olcObjectIdentifier: openCloudOid 1.3.6.1.4.1.63016
|
||||
# We'll use openCloudOid:1 subarc for LDAP related stuff
|
||||
# openCloudOid:1.1 for AttributeTypes and openCloudOid:1.2 for ObjectClasses
|
||||
olcAttributeTypes: ( openCloudOid:1.1.1 NAME 'openCloudUUID'
|
||||
DESC 'A non-reassignable and persistent account ID)'
|
||||
EQUALITY uuidMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.1.16.1 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( openCloudOid:1.1.2 NAME 'openCloudExternalIdentity'
|
||||
DESC 'A triple separated by "$" representing the objectIdentity resource type of the Graph API ( signInType $ issuer $ issuerAssignedId )'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( openCloudOid:1.1.3 NAME 'openCloudUserEnabled'
|
||||
DESC 'A boolean value indicating if the user is enabled'
|
||||
EQUALITY booleanMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE)
|
||||
olcAttributeTypes: ( openCloudOid:1.1.4 NAME 'openCloudUserType'
|
||||
DESC 'User type (e.g. Member or Guest)'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( openCloudOid:1.1.5 NAME 'openCloudLastSignInTimestamp'
|
||||
DESC 'The timestamp of the last sign-in'
|
||||
EQUALITY generalizedTimeMatch
|
||||
ORDERING generalizedTimeOrderingMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
|
||||
olcObjectClasses: ( openCloudOid:1.2.1 NAME 'openCloudObject'
|
||||
DESC 'OpenCloud base objectclass'
|
||||
AUXILIARY
|
||||
MAY ( openCloudUUID ) )
|
||||
olcObjectClasses: ( openCloudOid:1.2.2 NAME 'openCloudUser'
|
||||
DESC 'OpenCloud User objectclass'
|
||||
SUP openCloudObject
|
||||
AUXILIARY
|
||||
MAY ( openCloudExternalIdentity $ openCloudUserEnabled $ openCloudUserType $ openCloudLastSignInTimestamp) )
|
||||
@@ -0,0 +1,80 @@
|
||||
set -e
|
||||
|
||||
printenv
|
||||
# Function to add arguments to the command
|
||||
add_arg() {
|
||||
TRAEFIK_CMD="$TRAEFIK_CMD $1"
|
||||
}
|
||||
|
||||
# Initialize the base command
|
||||
TRAEFIK_CMD="traefik"
|
||||
|
||||
# Base Traefik arguments (from your existing configuration)
|
||||
add_arg "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
|
||||
# enable dashboard
|
||||
add_arg "--api.dashboard=true"
|
||||
# define entrypoints
|
||||
add_arg "--entryPoints.http.address=:${TRAEFIK_PORT_HTTP:-80}"
|
||||
add_arg "--entryPoints.http.http.redirections.entryPoint.to=https"
|
||||
add_arg "--entryPoints.http.http.redirections.entryPoint.scheme=https"
|
||||
add_arg "--entryPoints.https.address=:${TRAEFIK_PORT_HTTPS:-443}"
|
||||
# change default timeouts for long-running requests
|
||||
# this is needed for webdav clients that do not support the TUS protocol
|
||||
add_arg "--entryPoints.https.transport.respondingTimeouts.readTimeout=12h"
|
||||
add_arg "--entryPoints.https.transport.respondingTimeouts.writeTimeout=12h"
|
||||
add_arg "--entryPoints.https.transport.respondingTimeouts.idleTimeout=3m"
|
||||
# allow encoded characters
|
||||
# required for WOPI/Collabora
|
||||
add_arg "--entryPoints.https.http.encodedCharacters.allowEncodedSlash=true"
|
||||
add_arg "--entryPoints.https.http.encodedCharacters.allowEncodedQuestionMark=true"
|
||||
add_arg "--entryPoints.https.http.encodedCharacters.allowEncodedPercent=true"
|
||||
# required for file operations with supported encoded characters
|
||||
add_arg "--entryPoints.https.http.encodedCharacters.allowEncodedSemicolon=true"
|
||||
add_arg "--entryPoints.https.http.encodedCharacters.allowEncodedHash=true"
|
||||
# docker provider (get configuration from container labels)
|
||||
add_arg "--providers.docker.endpoint=unix:///var/run/docker.sock"
|
||||
add_arg "--providers.docker.exposedByDefault=false"
|
||||
# access log
|
||||
add_arg "--accessLog=${TRAEFIK_ACCESS_LOG:-false}"
|
||||
add_arg "--accessLog.format=json"
|
||||
add_arg "--accessLog.fields.headers.names.X-Request-Id=keep"
|
||||
|
||||
# Add Let's Encrypt configuration if enabled
|
||||
if [ "${TRAEFIK_SERVICES_TLS_CONFIG}" = "tls.certresolver=letsencrypt" ]; then
|
||||
echo "Configuring Traefik with Let's Encrypt..."
|
||||
add_arg "--certificatesResolvers.letsencrypt.acme.email=${TRAEFIK_ACME_MAIL:-example@example.org}"
|
||||
add_arg "--certificatesResolvers.letsencrypt.acme.storage=/certs/acme.json"
|
||||
add_arg "--certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=http"
|
||||
add_arg "--certificatesResolvers.letsencrypt.acme.caserver=${TRAEFIK_ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}"
|
||||
fi
|
||||
|
||||
# Add local certificate configuration if enabled
|
||||
if [ "${TRAEFIK_SERVICES_TLS_CONFIG}" = "tls=true" ]; then
|
||||
echo "Configuring Traefik with local certificates..."
|
||||
add_arg "--providers.file.directory=/etc/traefik/dynamic"
|
||||
add_arg "--providers.file.watch=true"
|
||||
fi
|
||||
|
||||
# Warning if neither certificate method is enabled
|
||||
if [ "${TRAEFIK_SERVICES_TLS_CONFIG}" != "tls=true" ] && [ "${TRAEFIK_SERVICES_TLS_CONFIG}" != "tls.certresolver=letsencrypt" ]; then
|
||||
echo "WARNING: Neither Let's Encrypt nor local certificates are enabled."
|
||||
echo "HTTPS will not work properly without certificate configuration."
|
||||
fi
|
||||
|
||||
# Add any custom arguments from environment variable
|
||||
if [ -n "${TRAEFIK_CUSTOM_ARGS}" ]; then
|
||||
echo "Adding custom Traefik arguments: ${TRAEFIK_CUSTOM_ARGS}"
|
||||
TRAEFIK_CMD="$TRAEFIK_CMD $TRAEFIK_CUSTOM_ARGS"
|
||||
fi
|
||||
|
||||
# Add any additional arguments passed to the script
|
||||
for arg in "$@"; do
|
||||
add_arg "$arg"
|
||||
done
|
||||
|
||||
# Print the final command for debugging
|
||||
echo "Starting Traefik with command:"
|
||||
echo "$TRAEFIK_CMD"
|
||||
|
||||
# Execute Traefik
|
||||
exec $TRAEFIK_CMD
|
||||
0
opencloud-compose/config/traefik/dynamic/.gitkeep
Normal file
0
opencloud-compose/config/traefik/dynamic/.gitkeep
Normal file
Reference in New Issue
Block a user