starred/container-openldap
1
0
Fork 0
mirror of https://github.com/osixia/container-openldap.git synced 2026-11-12 15:23:49 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
container-openldap/environment/.env.bootstrap
T
Bertrand Gouny 2761670739 feat(bootstrap): add scoped directory administrator 
Create an optional administrator for user/group CRUD and password resets while protecting service accounts, password hashes/history and cn=config. Document the distinct data root, config root, admin and management roles.

Keep conditional history ACLs in their account directories as optional templates, activated by feature scripts after rendering in a temporary copy. Cover read-only sources, admin permissions, readonly history privacy and custom overrides.
2026-10-27 13:05:36 +01:00

124 lines
6.0 KiB
Bash
Raw Permalink Blame History

OPENLDAP_BOOTSTRAP_ORGANIZATION="Example Org"
OPENLDAP_BOOTSTRAP_SUFFIX="dc=example,dc=org"
OPENLDAP_BOOTSTRAP_MODULES="auto"
OPENLDAP_BOOTSTRAP_SCHEMAS="core.ldif cosine.ldif inetorgperson.ldif rfc2307bis.ldif"
OPENLDAP_BOOTSTRAP_GLOBAL_SIZE_LIMIT=500
OPENLDAP_BOOTSTRAP_GLOBAL_TIME_LIMIT=120
OPENLDAP_BOOTSTRAP_GLOBAL_IDLE_TIMEOUT=3600
OPENLDAP_BOOTSTRAP_GLOBAL_WRITE_TIMEOUT=0
OPENLDAP_BOOTSTRAP_GLOBAL_CONN_MAX_PENDING=100
OPENLDAP_BOOTSTRAP_GLOBAL_CONN_MAX_PENDING_AUTH=1000
OPENLDAP_BOOTSTRAP_GLOBAL_SOCKBUF_MAX_INCOMING=262143
OPENLDAP_BOOTSTRAP_GLOBAL_SOCKBUF_MAX_INCOMING_AUTH=4194303
OPENLDAP_BOOTSTRAP_FRONTEND_PASSWORD_HASH="{ARGON2}"
OPENLDAP_BOOTSTRAP_CONFIG_ROOT_DN="cn=admin,cn=config"
OPENLDAP_BOOTSTRAP_CONFIG_ROOT_PASSWORD_HASHED=""
OPENLDAP_BOOTSTRAP_DATA_DATABASE_MAX_SIZE="10737418240" # 10Go
OPENLDAP_BOOTSTRAP_DATA_LAST_BIND=false
OPENLDAP_BOOTSTRAP_DATA_LAST_BIND_PRECISION=3600
OPENLDAP_BOOTSTRAP_DATA_ROOT_DN="cn=admin,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_DATA_ROOT_PASSWORD_HASHED=""
OPENLDAP_BOOTSTRAP_DATA_TREE=false
OPENLDAP_BOOTSTRAP_DATA_TREE_USERS_DN="ou=users,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_DATA_TREE_GROUPS_DN="ou=groups,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_DATA_TREE_SERVICES_DN="ou=services,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_DATA_ADMIN=false
OPENLDAP_BOOTSTRAP_DATA_ADMIN_DN="cn=admin,${OPENLDAP_BOOTSTRAP_DATA_TREE_SERVICES_DN}"
OPENLDAP_BOOTSTRAP_DATA_ADMIN_PASSWORD_HASHED=""
OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT=false
OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_DN="cn=management,${OPENLDAP_BOOTSTRAP_DATA_TREE_SERVICES_DN}"
OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_PASSWORD_HASHED=""
OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_HIDDEN_ATTRIBUTES="userPassword,shadowLastChange"
OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_HIDDEN_PPOLICY_ATTRIBUTES="pwdHistory"
OPENLDAP_BOOTSTRAP_DATA_READONLY=false
OPENLDAP_BOOTSTRAP_DATA_READONLY_DN="cn=readonly,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_DATA_READONLY_PASSWORD_HASHED=""
OPENLDAP_BOOTSTRAP_MONITOR=false
OPENLDAP_BOOTSTRAP_MONITOR_READONLY=false
OPENLDAP_BOOTSTRAP_MONITOR_READONLY_DN="cn=readonly-monitor,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_MONITOR_READONLY_PASSWORD_HASHED=""
OPENLDAP_BOOTSTRAP_AUDITLOG=false
OPENLDAP_BOOTSTRAP_AUDITLOG_FILE="/var/log/openldap/audit.ldif"
OPENLDAP_BOOTSTRAP_TLS=false
OPENLDAP_BOOTSTRAP_TLS_CERT="/container/services/openldap/assets/certs/tls.crt"
OPENLDAP_BOOTSTRAP_TLS_CERT_KEY="/container/services/openldap/assets/certs/tls.key"
OPENLDAP_BOOTSTRAP_TLS_CA_CERT="/container/services/openldap/assets/certs/ca.crt"
OPENLDAP_BOOTSTRAP_TLS_VERIFY_CLIENT="allow"
OPENLDAP_BOOTSTRAP_TLS_PROTOCOL_MIN="3.4"
OPENLDAP_BOOTSTRAP_TLS_REQUIRED=false
OPENLDAP_BOOTSTRAP_REFINT=false
OPENLDAP_BOOTSTRAP_REFINT_ATTRIBUTES="member uniqueMember manager owner"
OPENLDAP_BOOTSTRAP_REFINT_NOTHING_DN=""
OPENLDAP_BOOTSTRAP_PPOLICY=false
OPENLDAP_BOOTSTRAP_PPOLICY_HASH_CLEAR_TEXT=true
OPENLDAP_BOOTSTRAP_PPOLICY_USE_LOCKOUT=true
OPENLDAP_BOOTSTRAP_PPOLICY_CHECK_MODULE=""
OPENLDAP_BOOTSTRAP_PPOLICY_GROUP_DN="ou=policies,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_POLICY_DN="cn=default,${OPENLDAP_BOOTSTRAP_PPOLICY_GROUP_DN}"
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MIN_LENGTH=12
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY=1
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_IN_HISTORY=12
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_ALLOW_USER_CHANGE=true
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_SAFE_MODIFY=true
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MUST_CHANGE=false
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MIN_AGE=0
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MAX_FAILURE=5
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_FAILURE_COUNT_INTERVAL=300
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_LOCKOUT=true
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_LOCKOUT_DURATION=900
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MIN_DELAY=0
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MAX_DELAY=0
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MAX_AGE=7776000
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_MAX_IDLE=0
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_EXPIRE_WARNING=1209600
OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_GRACE_AUTH_NLIMIT=3
OPENLDAP_BOOTSTRAP_UNIQUE=false
OPENLDAP_BOOTSTRAP_UNIQUE_URIS="ldap:///?uid?sub ldap:///?mail?sub"
OPENLDAP_BOOTSTRAP_MEMBEROF=false
OPENLDAP_BOOTSTRAP_MEMBEROF_GROUP_OC=groupOfNames
OPENLDAP_BOOTSTRAP_MEMBEROF_MEMBER_AD=member
OPENLDAP_BOOTSTRAP_MEMBEROF_MEMBEROF_AD=memberOf
OPENLDAP_BOOTSTRAP_MEMBEROF_ADD_CHECK=true
OPENLDAP_BOOTSTRAP_MEMBEROF_DANGLING=ignore
OPENLDAP_BOOTSTRAP_REPLICATION=false
OPENLDAP_BOOTSTRAP_REPLICATION_HOSTS="ldap://ldap1.example.org:3890 ldap://ldap2.example.org:3890" # at least 2 hosts required, in the same order on all LDAP servers
OPENLDAP_BOOTSTRAP_REPLICATION_SYNCPROV_CHECKPOINT="100 10"
OPENLDAP_BOOTSTRAP_REPLICATION_DATA_READONLY_DN="cn=replicator,${OPENLDAP_BOOTSTRAP_SUFFIX}"
OPENLDAP_BOOTSTRAP_REPLICATION_DATA_READONLY_PASSWORD=""
OPENLDAP_BOOTSTRAP_REPLICATION_DATA_SYNC_REPL_TEMPLATE="rid=\${OPENLDAP_BOOTSTRAP_REPLICATION_DATA_SYNC_REPL_RID} provider=\${OPENLDAP_BOOTSTRAP_REPLICATION_SYNC_REPL_PROVIDER} bindmethod=simple binddn=\"\${OPENLDAP_BOOTSTRAP_REPLICATION_DATA_READONLY_DN}\" credentials=\"\${OPENLDAP_BOOTSTRAP_REPLICATION_DATA_READONLY_PASSWORD}\" searchbase=\"\${OPENLDAP_BOOTSTRAP_SUFFIX}\" schemachecking=on type=refreshAndPersist retry=\"5 5 60 +\" timeout=3"
OPENLDAP_BOOTSTRAP_REPLICATION_DATA_LIMITS="dn.exact=\"${OPENLDAP_BOOTSTRAP_REPLICATION_DATA_READONLY_DN}\" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited"
OPENLDAP_BOOTSTRAP_REPLICATION_TLS="${OPENLDAP_BOOTSTRAP_TLS_REQUIRED}"
OPENLDAP_BOOTSTRAP_REPLICATION_TLS_SYNC_REPL="starttls=critical tls_reqcert=demand"
OPENLDAP_BOOTSTRAP_REPLICATION_MEMBEROF="${OPENLDAP_BOOTSTRAP_MEMBEROF}"
OPENLDAP_BOOTSTRAP_REPLICATION_MEMBEROF_SYNC_REPL="exattrs=${OPENLDAP_BOOTSTRAP_MEMBEROF_MEMBEROF_AD}"
OPENLDAP_BOOTSTRAP_LDIF_CONFIG_DIR="/container/services/openldap-bootstrap/assets/ldif/config"
OPENLDAP_BOOTSTRAP_LDIF_DATA_DIR="/container/services/openldap-bootstrap/assets/ldif/data"
OPENLDAP_BOOTSTRAP_SCRIPTS_DIR="/container/services/openldap-bootstrap/assets/scripts"
Reference in New Issue View Git Blame Copy Permalink