139 lines
8.5 KiB
Bash
139 lines
8.5 KiB
Bash
# ── FreeIPA ───────────────────────────────────────────────────────────────────
|
|
IPA_HOSTNAME=ipa.corp.example.com
|
|
IPA_DOMAIN=corp.example.com
|
|
IPA_REALM=CORP.EXAMPLE.COM
|
|
IPA_ADMIN_PASSWORD=ChangeMe123!
|
|
IPA_DM_PASSWORD=ChangeMe456!
|
|
IPA_SETUP_DNS=false
|
|
IPA_DNS_FORWARDER=
|
|
IPA_SETUP_KRA=false
|
|
|
|
# ── Ansipa SMB shares ─────────────────────────────────────────────────────────
|
|
# LUKS_KEY_UPLOAD_PASSWORD — password for the 'luks-upload' service account used
|
|
# by the Ansible controller to write LUKS backup keys to
|
|
# the ansipa-luks-keys share. Pass to collect-luks-keys.yml
|
|
# with -e luks_upload_password=<this value>.
|
|
# To grant read access, add a Samba user to KeyAdmin on the
|
|
# container: useradd -r -G KeyAdmin <user> && smbpasswd -a <user>
|
|
# (ClamAV scan results now go to CheckMK via the dev_mon_clamscan local check —
|
|
# there is no longer an ansipa-scans SMB share or scanupload account.)
|
|
LUKS_KEY_UPLOAD_PASSWORD=ChangeMe_LuksUpload!
|
|
|
|
# ── CheckMK CE monitoring ─────────────────────────────────────────────────────
|
|
# CMK_ADMIN_PASSWORD — web UI password for cmkadmin.
|
|
# CMK_SITE_ID — OMD site name (default: cmk). Used in all CheckMK URLs and
|
|
# agent registration. Must match whatever was used on first start.
|
|
# CMK_ADVERTISED_URL — URL enrolled CLIENTS use to reach CheckMK; stored in the
|
|
# dev_mon_base hostgroup description. Must be routable from
|
|
# the clients' network (the docker HOST address + published
|
|
# port, e.g. http://mon.corp.example.com:8090) — NOT the
|
|
# container-internal 172.30.0.12:5000. Leave empty only if
|
|
# all monitored clients run inside the same docker network.
|
|
# Web UI: http://localhost:8090/cmk/ after `docker compose up -d`
|
|
CMK_ADMIN_PASSWORD=ChangeMe_CMK!
|
|
CMK_SITE_ID=cmk
|
|
CMK_ADVERTISED_URL=
|
|
|
|
# ── Ansipa git policy server (signed policy distribution) ────────────────────
|
|
# Dedicated git-over-SSH server (own service, own attack surface — see
|
|
# docs/md/freeipa-ansible.md) that fleet nodes pull signed policy commits from.
|
|
# ANSIPA_GIT_SSH_PORT — sshd port for this service, separate from any
|
|
# interactive SSH access to the container (default 2222).
|
|
# ANSIPA_GIT_ADMIN_PUBKEY — SSH public key of the machine that authors/pushes
|
|
# policy commits (full push access; git-shell-restricted).
|
|
# ANSIPA_GIT_SIGNING_PUBKEY — armored GPG public key (or a path to one, if you'd
|
|
# rather bind-mount it) used to verify every pushed
|
|
# and pulled commit. The matching PRIVATE key must
|
|
# never leave the authoring machine.
|
|
# Register a node's read-only deploy key afterwards:
|
|
# docker exec freeipa ansipa-git-add-deploy-key.sh "ssh-ed25519 AAAA...=="
|
|
ANSIPA_GIT_SSH_PORT=2222
|
|
ANSIPA_GIT_ADMIN_PUBKEY=
|
|
ANSIPA_GIT_SIGNING_PUBKEY=
|
|
|
|
# ── nginx gateway (reverse proxy + portal) ────────────────────────────────────
|
|
# ANSIPA_HTTP_PORT — host port the ansipa nginx gateway listens on (plain HTTP).
|
|
# Put your own TLS-terminating reverse proxy in front of it and forward to
|
|
# http://<docker-host>:${ANSIPA_HTTP_PORT}. The gateway fronts all UIs on one
|
|
# host: /ipa/ (FreeIPA), /cmk/ (CheckMK), /auth/ (Keycloak), / (portal).
|
|
# Example upstream nginx (in your main reverse proxy), to expose ansipa over HTTPS:
|
|
# location / { proxy_pass http://<docker-host>:8088; proxy_set_header Host $host;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
|
|
# Or Caddy one-liner: ansipa.example.com { reverse_proxy <docker-host>:8088 }
|
|
ANSIPA_HTTP_PORT=8088
|
|
|
|
# ── Keycloak ──────────────────────────────────────────────────────────────────
|
|
KC_HOSTNAME=keycloak.corp.example.com
|
|
KC_REALM=corp
|
|
KC_ADMIN=admin
|
|
KC_ADMIN_PASSWORD=ChangeMe789!
|
|
KC_DB_PASSWORD=ChangeMe000!
|
|
|
|
# ── Keycloak → FreeIPA LDAP federation ───────────────────────────────────────
|
|
# Leave IPA_BIND_PASSWORD blank to reuse IPA_DM_PASSWORD.
|
|
# In production, create a dedicated read-only service account in FreeIPA.
|
|
#
|
|
# QUOTE any value containing spaces. docker compose parses this file itself and
|
|
# does not need the quotes, but the *-configure.sh scripts `source` it as shell,
|
|
# where an unquoted `cn=Directory Manager` is read as the assignment
|
|
# `IPA_BIND_DN=cn=Directory` followed by a command named `Manager`.
|
|
IPA_BIND_DN="cn=Directory Manager"
|
|
IPA_BIND_PASSWORD=
|
|
IPA_USE_LDAPS=false
|
|
|
|
# ── Nextcloud ─────────────────────────────────────────────────────────────────
|
|
# Served at ${NC_PUBLIC_URL}, i.e. the /nextcloud subpath of the ansipa gateway.
|
|
#
|
|
# Accounts come from FreeIPA (LDAP backend) and logins go through Keycloak
|
|
# (user_oidc) — run ./nextcloud-configure.sh after the stack is up to wire both.
|
|
# NC_ADMIN_USER/NC_ADMIN_PASSWORD are a BREAK-GLASS LOCAL account: Nextcloud
|
|
# cannot complete its installer without one. It is not an IPA identity; keep the
|
|
# password in your password manager and use it only if SSO itself is broken.
|
|
#
|
|
# NC_PUBLIC_URL — the externally reachable Nextcloud base URL. This is what
|
|
# goes in the Keycloak redirect URI and what sync clients
|
|
# are handed, so it must be the address USERS type (your
|
|
# TLS proxy's hostname), not the container address.
|
|
# NC_TRUSTED_DOMAINS — space-separated hostnames Nextcloud will answer for.
|
|
# A host that is not listed here gets a hard "untrusted
|
|
# domain" error page instead of a login form.
|
|
NC_DB_PASSWORD=ChangeMe_NcDb!
|
|
NC_ADMIN_USER=ncadmin
|
|
NC_ADMIN_PASSWORD=ChangeMe_NcAdmin!
|
|
NC_PUBLIC_URL=http://localhost:8088/nextcloud
|
|
NC_TRUSTED_DOMAINS=localhost
|
|
|
|
# ── Nextcloud → FreeIPA LDAP (account source of truth) ───────────────────────
|
|
# Dedicated read-only bind account is strongly recommended over Directory
|
|
# Manager. Leave blank to fall back to IPA_BIND_DN / IPA_BIND_PASSWORD.
|
|
# NC_LDAP_GROUP — if set, ONLY members of this IPA group get a Nextcloud
|
|
# account (e.g. usr_nextcloud). Blank means every IPA user.
|
|
# Quote any DN containing spaces (see the note under IPA_BIND_DN below).
|
|
NC_LDAP_BIND_DN=
|
|
NC_LDAP_BIND_PASSWORD=
|
|
NC_LDAP_GROUP=
|
|
|
|
# ── CheckMK → FreeIPA LDAP ────────────────────────────────────────────────────
|
|
# CheckMK Community/Raw edition has NO SAML and NO OIDC (both are commercial-
|
|
# edition features), so it cannot sit behind Keycloak. It binds FreeIPA over
|
|
# LDAP directly instead — still one account store, one less hop.
|
|
# Run ./checkmk-ldap-configure.sh to apply.
|
|
# CMK_LDAP_ADMIN_GROUP — IPA group whose members get the CheckMK "admin" role.
|
|
# CMK_LDAP_USER_GROUP — IPA group whose members get the read-only "user" role.
|
|
CMK_LDAP_ADMIN_GROUP=usr_cmk_admins
|
|
CMK_LDAP_USER_GROUP=usr_cmk_users
|
|
|
|
# ── External SSO relying parties (Proxmox VE / PBS / OPNsense) ────────────────
|
|
# Base URLs of infrastructure appliances that should log in through Keycloak.
|
|
# Set a URL here and keycloak-configure.sh provisions a matching OIDC client,
|
|
# writing its secret to .oidc-secrets; leave one blank to skip that client.
|
|
# Use the URL an ADMIN types in the browser, including the port.
|
|
# PVE_URL e.g. https://pve.corp.example.com:8006
|
|
# PBS_URL e.g. https://pbs.corp.example.com:8007
|
|
# OPNSENSE_URL e.g. https://fw.corp.example.com
|
|
# See docs/md/ansipa-sso.md for the matching config on each appliance.
|
|
PVE_URL=
|
|
PBS_URL=
|
|
OPNSENSE_URL=
|