63 lines
3.9 KiB
Bash
63 lines
3.9 KiB
Bash
# ── FreeIPA ───────────────────────────────────────────────────────────────────
|
|
IPA_HOSTNAME=ipa.corp.example.com
|
|
IPA_DOMAIN=corp.example.com
|
|
IPA_REALM=CORP.EXAMPLE.COM
|
|
IPA_ADMIN_PASSWORD=ChangeMe123!
|
|
IPA_DM_PASSWORD=ChangeMe456!
|
|
IPA_SETUP_DNS=false
|
|
IPA_DNS_FORWARDER=
|
|
IPA_SETUP_KRA=false
|
|
|
|
# ── Ansipa SMB shares ─────────────────────────────────────────────────────────
|
|
# SMB_SCAN_PASSWORD — password for 'scanupload'; deploy to clients via Ansible
|
|
# with smb_scan_password=<this value> (use ansible-vault).
|
|
# LUKS_KEY_UPLOAD_PASSWORD — password for the 'luks-upload' service account used
|
|
# by the Ansible controller to write LUKS backup keys to
|
|
# the ansipa-luks-keys share. Pass to collect-luks-keys.yml
|
|
# with -e luks_upload_password=<this value>.
|
|
# To grant read access, add a Samba user to KeyAdmin on the
|
|
# container: useradd -r -G KeyAdmin <user> && smbpasswd -a <user>
|
|
SMB_SCAN_PASSWORD=ChangeMe_ScanPass!
|
|
LUKS_KEY_UPLOAD_PASSWORD=ChangeMe_LuksUpload!
|
|
|
|
# ── CheckMK CE monitoring ─────────────────────────────────────────────────────
|
|
# CMK_ADMIN_PASSWORD — web UI password for cmkadmin.
|
|
# CMK_SITE_ID — OMD site name (default: cmk). Used in all CheckMK URLs and
|
|
# agent registration. Must match whatever was used on first start.
|
|
# CMK_ADVERTISED_URL — URL enrolled CLIENTS use to reach CheckMK; stored in the
|
|
# dev_mon_base hostgroup description. Must be routable from
|
|
# the clients' network (the docker HOST address + published
|
|
# port, e.g. http://mon.corp.example.com:8090) — NOT the
|
|
# container-internal 172.30.0.12:5000. Leave empty only if
|
|
# all monitored clients run inside the same docker network.
|
|
# Web UI: http://localhost:8090/cmk/ after `docker compose up -d`
|
|
CMK_ADMIN_PASSWORD=ChangeMe_CMK!
|
|
CMK_SITE_ID=cmk
|
|
CMK_ADVERTISED_URL=
|
|
|
|
# ── nginx gateway (reverse proxy + portal) ────────────────────────────────────
|
|
# ANSIPA_HTTP_PORT — host port the ansipa nginx gateway listens on (plain HTTP).
|
|
# Put your own TLS-terminating reverse proxy in front of it and forward to
|
|
# http://<docker-host>:${ANSIPA_HTTP_PORT}. The gateway fronts all UIs on one
|
|
# host: /ipa/ (FreeIPA), /cmk/ (CheckMK), /auth/ (Keycloak), / (portal).
|
|
# Example upstream nginx (in your main reverse proxy), to expose ansipa over HTTPS:
|
|
# location / { proxy_pass http://<docker-host>:8088; proxy_set_header Host $host;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
|
|
# Or Caddy one-liner: ansipa.example.com { reverse_proxy <docker-host>:8088 }
|
|
ANSIPA_HTTP_PORT=8088
|
|
|
|
# ── Keycloak ──────────────────────────────────────────────────────────────────
|
|
KC_HOSTNAME=keycloak.corp.example.com
|
|
KC_REALM=corp
|
|
KC_ADMIN=admin
|
|
KC_ADMIN_PASSWORD=ChangeMe789!
|
|
KC_DB_PASSWORD=ChangeMe000!
|
|
|
|
# ── Keycloak → FreeIPA LDAP federation ───────────────────────────────────────
|
|
# Leave IPA_BIND_PASSWORD blank to reuse IPA_DM_PASSWORD.
|
|
# In production, create a dedicated read-only service account in FreeIPA.
|
|
IPA_BIND_DN=cn=Directory Manager
|
|
IPA_BIND_PASSWORD=
|
|
IPA_USE_LDAPS=false
|