# ── FreeIPA ─────────────────────────────────────────────────────────────────── IPA_HOSTNAME=ipa.corp.example.com IPA_DOMAIN=corp.example.com IPA_REALM=CORP.EXAMPLE.COM IPA_ADMIN_PASSWORD=ChangeMe123! IPA_DM_PASSWORD=ChangeMe456! IPA_SETUP_DNS=false IPA_DNS_FORWARDER= IPA_SETUP_KRA=false # ── Ansipa SMB shares ───────────────────────────────────────────────────────── # LUKS_KEY_UPLOAD_PASSWORD — password for the 'luks-upload' service account used # by the Ansible controller to write LUKS backup keys to # the ansipa-luks-keys share. Pass to collect-luks-keys.yml # with -e luks_upload_password=. # To grant read access, add a Samba user to KeyAdmin on the # container: useradd -r -G KeyAdmin && smbpasswd -a # (ClamAV scan results now go to CheckMK via the dev_mon_clamscan local check — # there is no longer an ansipa-scans SMB share or scanupload account.) LUKS_KEY_UPLOAD_PASSWORD=ChangeMe_LuksUpload! # ── CheckMK CE monitoring ───────────────────────────────────────────────────── # CMK_ADMIN_PASSWORD — web UI password for cmkadmin. # CMK_SITE_ID — OMD site name (default: cmk). Used in all CheckMK URLs and # agent registration. Must match whatever was used on first start. # CMK_ADVERTISED_URL — URL enrolled CLIENTS use to reach CheckMK; stored in the # dev_mon_base hostgroup description. Must be routable from # the clients' network (the docker HOST address + published # port, e.g. http://mon.corp.example.com:8090) — NOT the # container-internal 172.30.0.12:5000. Leave empty only if # all monitored clients run inside the same docker network. # Web UI: http://localhost:8090/cmk/ after `docker compose up -d` CMK_ADMIN_PASSWORD=ChangeMe_CMK! CMK_SITE_ID=cmk CMK_ADVERTISED_URL= # ── Ansipa git policy server (signed policy distribution) ──────────────────── # Dedicated git-over-SSH server (own service, own attack surface — see # docs/md/freeipa-ansible.md) that fleet nodes pull signed policy commits from. # ANSIPA_GIT_SSH_PORT — sshd port for this service, separate from any # interactive SSH access to the container (default 2222). # ANSIPA_GIT_ADMIN_PUBKEY — SSH public key of the machine that authors/pushes # policy commits (full push access; git-shell-restricted). # ANSIPA_GIT_SIGNING_PUBKEY — armored GPG public key (or a path to one, if you'd # rather bind-mount it) used to verify every pushed # and pulled commit. The matching PRIVATE key must # never leave the authoring machine. # Register a node's read-only deploy key afterwards: # docker exec freeipa ansipa-git-add-deploy-key.sh "ssh-ed25519 AAAA...==" ANSIPA_GIT_SSH_PORT=2222 ANSIPA_GIT_ADMIN_PUBKEY= ANSIPA_GIT_SIGNING_PUBKEY= # ── nginx gateway (reverse proxy + portal) ──────────────────────────────────── # ANSIPA_HTTP_PORT — host port the ansipa nginx gateway listens on (plain HTTP). # Put your own TLS-terminating reverse proxy in front of it and forward to # http://:${ANSIPA_HTTP_PORT}. The gateway fronts all UIs on one # host: /ipa/ (FreeIPA), /cmk/ (CheckMK), /auth/ (Keycloak), / (portal). # Example upstream nginx (in your main reverse proxy), to expose ansipa over HTTPS: # location / { proxy_pass http://:8088; proxy_set_header Host $host; # proxy_set_header X-Forwarded-Proto $scheme; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } # Or Caddy one-liner: ansipa.example.com { reverse_proxy :8088 } ANSIPA_HTTP_PORT=8088 # ── Keycloak ────────────────────────────────────────────────────────────────── KC_HOSTNAME=keycloak.corp.example.com KC_REALM=corp KC_ADMIN=admin KC_ADMIN_PASSWORD=ChangeMe789! KC_DB_PASSWORD=ChangeMe000! # ── Keycloak → FreeIPA LDAP federation ─────────────────────────────────────── # Leave IPA_BIND_PASSWORD blank to reuse IPA_DM_PASSWORD. # In production, create a dedicated read-only service account in FreeIPA. # # QUOTE any value containing spaces. docker compose parses this file itself and # does not need the quotes, but the *-configure.sh scripts `source` it as shell, # where an unquoted `cn=Directory Manager` is read as the assignment # `IPA_BIND_DN=cn=Directory` followed by a command named `Manager`. IPA_BIND_DN="cn=Directory Manager" IPA_BIND_PASSWORD= IPA_USE_LDAPS=false # ── Nextcloud ───────────────────────────────────────────────────────────────── # Served at ${NC_PUBLIC_URL}, i.e. the /nextcloud subpath of the ansipa gateway. # # Accounts come from FreeIPA (LDAP backend) and logins go through Keycloak # (user_oidc) — run ./nextcloud-configure.sh after the stack is up to wire both. # NC_ADMIN_USER/NC_ADMIN_PASSWORD are a BREAK-GLASS LOCAL account: Nextcloud # cannot complete its installer without one. It is not an IPA identity; keep the # password in your password manager and use it only if SSO itself is broken. # # NC_PUBLIC_URL — the externally reachable Nextcloud base URL. This is what # goes in the Keycloak redirect URI and what sync clients # are handed, so it must be the address USERS type (your # TLS proxy's hostname), not the container address. # NC_TRUSTED_DOMAINS — space-separated hostnames Nextcloud will answer for. # A host that is not listed here gets a hard "untrusted # domain" error page instead of a login form. NC_DB_PASSWORD=ChangeMe_NcDb! NC_ADMIN_USER=ncadmin NC_ADMIN_PASSWORD=ChangeMe_NcAdmin! NC_PUBLIC_URL=http://localhost:8088/nextcloud NC_TRUSTED_DOMAINS=localhost # ── Nextcloud → FreeIPA LDAP (account source of truth) ─────────────────────── # Dedicated read-only bind account is strongly recommended over Directory # Manager. Leave blank to fall back to IPA_BIND_DN / IPA_BIND_PASSWORD. # NC_LDAP_GROUP — if set, ONLY members of this IPA group get a Nextcloud # account (e.g. usr_nextcloud). Blank means every IPA user. # Quote any DN containing spaces (see the note under IPA_BIND_DN below). NC_LDAP_BIND_DN= NC_LDAP_BIND_PASSWORD= NC_LDAP_GROUP= # ── CheckMK → FreeIPA LDAP ──────────────────────────────────────────────────── # CheckMK Community/Raw edition has NO SAML and NO OIDC (both are commercial- # edition features), so it cannot sit behind Keycloak. It binds FreeIPA over # LDAP directly instead — still one account store, one less hop. # Run ./checkmk-ldap-configure.sh to apply. # CMK_LDAP_ADMIN_GROUP — IPA group whose members get the CheckMK "admin" role. # CMK_LDAP_USER_GROUP — IPA group whose members get the read-only "user" role. CMK_LDAP_ADMIN_GROUP=usr_cmk_admins CMK_LDAP_USER_GROUP=usr_cmk_users # ── External SSO relying parties (Proxmox VE / PBS / OPNsense) ──────────────── # Base URLs of infrastructure appliances that should log in through Keycloak. # Set a URL here and keycloak-configure.sh provisions a matching OIDC client, # writing its secret to .oidc-secrets; leave one blank to skip that client. # Use the URL an ADMIN types in the browser, including the port. # PVE_URL e.g. https://pve.corp.example.com:8006 # PBS_URL e.g. https://pbs.corp.example.com:8007 # OPNSENSE_URL e.g. https://fw.corp.example.com # See docs/md/ansipa-sso.md for the matching config on each appliance. PVE_URL= PBS_URL= OPNSENSE_URL=