Adds a built-in Nextcloud to the ansipa stack and wires every service's
logins back to FreeIPA, either through Keycloak or directly.
Nextcloud:
- nextcloud + redis services, sharing the existing postgres server via a
second database. The initdb hook only fires on an empty data directory,
so run.sh also creates the role/DB idempotently for stacks that predate
Nextcloud.
- served at the /nextcloud subpath of the gateway (OVERWRITEWEBROOT), with
the /.well-known/* DAV redirects at the server root that sync clients and
Nextcloud's own setup checks expect.
Identity:
- keycloak-configure.sh now provisions confidential OIDC clients per relying
party (nextcloud, proxmox-ve, proxmox-bs, opnsense) plus a realm-wide
"groups" claim, writing secrets to .oidc-secrets (0600, gitignored).
- nextcloud-configure.sh binds the IPA LDAP backend as the account source
and user_oidc for login. The internal username is pinned to the IPA uid
and unique-uid is disabled, otherwise every SSO login creates a second,
empty account beside the LDAP one.
- checkmk-ldap-configure.sh binds CheckMK straight to FreeIPA. CheckMK
cannot go through Keycloak: SAML is commercial-edition only and no
edition supports OIDC. The LDAP REST endpoints landed in 2.4 (werk
#16527) but the stack pins 2.3, so it writes user_connections.mk —
generated via Python repr() so quotes in a password cannot produce a
SyntaxError that takes the GUI down, backed up and rolled back if the
site fails to load it. Directory type is 389directoryserver, which is
what gives FreeIPA the correct uid/member attribute defaults.
Monitoring:
- OPNsense local check (gateways, pf state table vs its hard limit,
firmware, CARP) plus an installer. POSIX sh, since OPNsense is FreeBSD
with no bash or GNU grep. Transport is agent-over-SSH rather than inetd
on 6556, because OPNsense regenerates inetd.conf/services/hosts.allow
from config.xml and silently reverts those edits on reboot.
Fixes found along the way:
- keycloak-configure.sh used KC_URL without the /auth relative path and
probed /health/ready, which lives on management port 9000 and is not
under that path — so it 404'd and timed out on this deployment.
- .env.example had an unquoted `cn=Directory Manager`, which the shell
scripts sourcing it parsed as a command named `Manager`.
- summary heredocs printed raw escape codes; colours now use ANSI-C quoting.
docs/md/ansipa-sso.md covers the identity chain, the per-service support
matrix, Proxmox VE/PBS OpenID realm setup, and why packet captures should
not be tunnelled through the CheckMK API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWLuyyrydC1u2FjM7naPcz
Adds a deliberate extra sign-in layer covering the entire nginx gateway
(portal page + every proxied web UI) via a shared htpasswd credential
generated on the FreeIPA container and published to nginx through a new
portal-auth volume. FreeIPA, CheckMK and Keycloak still each enforce their
own login behind it — two prompts beats one attacker who only had to beat
one lock. Healthcheck updated to treat 401 as healthy accordingly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- ansipa Setup Guide: add a Firewall section — which inbound ports to open on
the server (minimum LDAP/Kerberos/HTTPS + per-feature SMB/CheckMK/Keycloak/
gateway), that clients need nothing inbound for policy enforcement or CheckMK
push mode, and copy-paste firewalld / ufw / nftables rule examples.
- freeipa-ansible.md: reflect the now-supported mixed fleet (Arch, Fedora,
RHEL/Rocky/Alma, Debian/Ubuntu) instead of "Arch-only", note the Arch
autofs/AUR enrollment caveat, and cross-link the setup guide.
Nothing about the deployment is left to guesswork: architecture, every port,
firewall rules, the nginx portal + reverse-proxy snippets, NAT/push-mode, the
Proxmox LXC generator, and the tools reorg paths are all documented.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
Generate everything needed to run the complete ansipa stack (FreeIPA + CheckMK
+ Keycloak + PostgreSQL + nginx gateway) inside a single Proxmox LXC container.
Unlike freeipa-image.sh's proxmox-lxc target (which exports a FreeIPA-only CT
rootfs), this runs the tested docker-compose stack inside a privileged,
nesting-enabled CT ("Docker-in-LXC"), so it is the whole management plane in
one container.
Prompts for domain/realm/VMID/resources, generates all service secrets, and
emits: pct-create-<vmid>.sh, ansipa-<vmid>.conf (nesting=1,keyctl=1,fuse=1 +
the cgroup/apparmor allowances FreeIPA's systemd and Docker overlay2 need), a
first-boot provisioner that installs Docker and brings the stack up via run.sh,
a filled-in .env (mode 600), and a DEPLOY guide. Verified the generator emits
correct, syntactically-valid artifacts. Documented in the ansipa Setup Guide.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
Move the build and deployment scripts into setup/tools alongside the existing
generators (proxmox-lxc-gen.sh, freeipa-image.sh, generate-modules.sh):
- setup/generate-answerfile.sh -> setup/tools/generate-answerfile.sh
- setup/archiso/build.sh -> setup/tools/build.sh
- setup/archiso/wds-deploy.sh -> setup/tools/wds-deploy.sh
- setup/archiso/write-usb.sh -> setup/tools/write-usb.sh
The archiso overlay/ (profile data: airootfs, profiledef.sh, packages.extra)
stays in setup/archiso/; build.sh now resolves it via an OVERLAY_DIR anchored
at the repo root, and DOTFILES_DIR is corrected for the new two-levels-deep
location. Updated every reference (generate-modules.sh, readme.md,
docs/md/{archiso,installation,index}.md).
generate-answerfile.sh: add linux-hardened to the kernel menu; verified its
emitted answerfile schema still matches every field the installers consume
(drive/kernel/keymap/hostname/username/password/luks_password/encrypt/
fido2_*/run_tui/components/desktop_environment/apps/shell_rc/colors).
Docs: add a dedicated ansipa Setup Guide (docs/md/ansipa-setup.md) covering
architecture, the full port list, the nginx portal + reverse-proxy paths, the
exact upstream reverse-proxy snippets (nginx/Caddy), NAT/push-mode behaviour,
and the Arch autofs/AUR caveat; link it from the index and cross-reference the
CheckMK/nginx ports from freeipa-ansible.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
Amir Alexander Abdelbaki