il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(ldap): fix ldap binding range

Browse Source
This commit is contained in:
il
2026-06-25 09:28:34 +09:00
parent 47d437375b
commit b499fcb78a
13 changed files with 69 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/playbooks/app/site.yaml
+11 -11
View File
@@ -104,7 +104,7 @@
- "dbus-user-session"
state: "present"
become: true
tags: ["init", "install-packages"]
tags: ["init", "site", "install-packages"]
- name: Set data volume
ansible.builtin.include_role:
@@ -122,14 +122,6 @@
tags: ["init", "linger"]
tags: ["init", "linger"]
- name: Set podman
ansible.builtin.include_role:
name: "common"
tasks_from: "services/set_podman"
apply:
tags: ["init", "podman"]
tags: ["init", "podman"]
- name: Set nftables
ansible.builtin.include_role:
name: "common"
@@ -143,8 +135,8 @@
name: "common"
tasks_from: "services/set_alloy"
apply:
tags: ["init", "alloy"]
tags: ["init", "alloy"]
tags: ["site", "alloy"]
tags: ["site", "alloy"]
- name: Set crowdsec
ansible.builtin.include_role:
@@ -162,6 +154,14 @@
tags: ["site", "kopia"]
tags: ["site", "kopia"]
- name: Set podman
ansible.builtin.include_role:
name: "common"
tasks_from: "services/set_podman"
apply:
tags: ["site", "podman"]
tags: ["site", "podman"]
- name: Set caddy
ansible.builtin.include_role:
name: "common"
ansible/playbooks/auth/site.yaml
+8 -8
View File
@@ -114,14 +114,6 @@
tags: ["init", "linger"]
tags: ["init", "linger"]
- name: Set podman
ansible.builtin.include_role:
name: "common"
tasks_from: "services/set_podman"
apply:
tags: ["init", "podman"]
tags: ["init", "podman"]
- name: Set nftables
ansible.builtin.include_role:
name: "common"
@@ -138,6 +130,14 @@
tags: ["site", "crowdsec"]
tags: ["site", "crowdsec"]
- name: Set podman
ansible.builtin.include_role:
name: "common"
tasks_from: "services/set_podman"
apply:
tags: ["site", "podman"]
tags: ["site", "podman"]
- name: Set caddy
ansible.builtin.include_role:
name: "common"
ansible/playbooks/infra/site.yaml
+8 -8
View File
@@ -114,14 +114,6 @@
tags: ["init", "linger"]
tags: ["init", "linger"]
- name: Set podman
ansible.builtin.include_role:
name: "common"
tasks_from: "services/set_podman"
apply:
tags: ["init", "podman"]
tags: ["init", "podman"]
- name: Set nftables
ansible.builtin.include_role:
name: "common"
@@ -146,6 +138,14 @@
tags: ["site", "kopia"]
tags: ["site", "kopia"]
- name: Set podman
ansible.builtin.include_role:
name: "common"
tasks_from: "services/set_podman"
apply:
tags: ["site", "podman"]
tags: ["site", "podman"]
- name: Set ca
ansible.builtin.include_role:
name: "infra"
ansible/roles/auth/tasks/services/set_authelia.yaml
+1 -1
View File
@@ -54,7 +54,7 @@
- name: "AUTHELIA_JWKS_ES256"
value: "{{ hostvars['console']['authelia']['jwk_es256'] }}"
- name: "AUTHELIA_LDAP_PASSWORD"
value: "{{ hostvars['console']['ldap']['password']['authelia'] }}"
value: "{{ hostvars['console']['ldap']['password']['services']['authelia'] }}"
- name: "POSTGRES_AUTHELIA_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['authelia'] }}"
notify: "notification_restart_authelia"
ansible/roles/common/tasks/services/set_podman.yaml
+21 -21
View File
@@ -15,14 +15,14 @@
state: "directory"
mode: "0700"
- name: Create container data directory for app
- name: Create container data directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/data/containers"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
state: "directory"
mode: "0770"
when: node['name'] == "app"
when: node['name'] in ["infra", "app"]
- name: Create container image archive directory
ansible.builtin.file:
@@ -35,23 +35,23 @@
- "{{ node['home_path'] }}/archives"
- "{{ node['home_path'] }}/archives/containers"
- name: Install podman and reset ssh connection for initiating
when: is_podman_installed.rc != 0
- name: Set subid scope (Overwrite)
ansible.builtin.copy:
content: |
{{ ansible_user }}:100000:65536
dest: "/etc/sub{{ item }}"
owner: "root"
group: "root"
mode: "0644"
loop:
- "uid"
- "gid"
become: true
block:
- name: Set subid scope (Overwrite)
ansible.builtin.copy:
content: |
{{ ansible_user }}:100000:65536
dest: "/etc/sub{{ item }}"
owner: "root"
group: "root"
mode: "0644"
loop:
- "uid"
- "gid"
- name: Install podman
ansible.builtin.apt:
name:
- "podman"
state: "present"
- name: Install podman
ansible.builtin.apt:
name:
- "podman"
state: "present"
become: true
when: is_podman_installed.rc != 0
ansible/roles/infra/tasks/services/set_grafana.yaml
+2 -2
View File
@@ -36,10 +36,10 @@
state: "present"
force: true
loop:
- name: "LDAP_BIND_PASSWORD"
value: "{{ hostvars['console']['ldap']['password']['services']['grafana'] }}"
- name: "GF_DB_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['grafana'] }}"
- name: "LDAP_BIND_PASSWORD"
value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
- name: "GF_ADMIN_PASSWORD"
value: "{{ hostvars['console']['grafana']['admin']['password'] }}"
notify: "notification_restart_grafana"
ansible/roles/infra/tasks/services/set_ldap.yaml
+1 -1
View File
@@ -65,7 +65,7 @@
- name: Register extra secret value to podman secret
containers.podman.podman_secret:
name: "LLDAP_LDAP_USER_PASSWORD"
data: "{{ hostvars['console']['ldap']['password']['user'] }}"
data: "{{ hostvars['console']['ldap']['password']['services']['admin'] }}"
state: "present"
force: true
# You must check the image version first (following container file on data/config/containers/infra/ldap/ldap.container)
config/secrets/secrets.yaml
+9 -8
View File
@@ -152,12 +152,13 @@ ldap:
#ENC[AES256_GCM,data:6AE31A6F6mflPwwac4jVxY5kJPYaKlYzNjtUC9/VmCPeS8iuvoFmxHNQ9cwxLa20Nw==,iv:N7tQ9RyBYvSCKzbLGWgH8NgyKCJpNM5cupGK9e9pQbM=,tag:nAduK50DDywtkkQ03psKRA==,type:comment]
#ENC[AES256_GCM,data:o4Uc0IfSKbSCHAh00aHkN1g/+FoK/Ffm26iT//ZGc9WTncusMdZslfX9AQWXXOtRwOP9hjpw7KZA5FWsYEGzyIJNcvq0nayEgwBmCB1RmmDVcvVT2jEjKLGCIqYMHT10ZUdFuls+SSKtE6Kk6GMrrV/MEGzn7rKIHSlflv3+Iav8p2cblRoEFqAxrbNgbvcMzSDpWH9XCInhD0Sw5ABViNvBc6CVb0ZfZEuyoBF4EhQ=,iv:bs9iS3fmJtb0K5fc/DXKYWho9+1GBWmN8jOBEhGr8Bw=,tag:Ry77miT/7UKA2pLE3kMcag==,type:comment]
password:
user: ENC[AES256_GCM,data:DT9h51o6z70A4QeoKvCbUo98JFxILgB5tkHeX60CZuCl0GHTa//mRpIUEvo=,iv:Pa9iqXeKDHHBz524zeRImYEkXmY50s7Z+Z4KYt3sNT4=,tag:UTS5VIqbRA66UVDrDXwuPQ==,type:str]
authelia: ENC[AES256_GCM,data:G8ZGsLKqEmMzQ5NMAgirF5BQraHNqixtI6dyyaeNhTdXebjJZML52xL36p4=,iv:ZtHAsFYmrQxr+qoQLPW/eme0+nsT148KRsXmW/LNLlU=,tag:Pvjs/eylkgxJpmGBsRmjcw==,type:str]
grafana: ENC[AES256_GCM,data:vWmU3ZKcolETWAY74C3OMD8gMXDeYk+DqssACL0xefIPi5IkbrhYWmnWAnA=,iv:wcRms3Zp8kPM4USRPVa0UHpCTK36SWhK9C8yHSWu2Cs=,tag:gU5S/6fdMZVd/ih3Yd5uJA==,type:str]
users:
il: ENC[AES256_GCM,data:9b9OU4Nt60/XdUrwnhJh,iv:7ZqOYqM2aibgcFRxw1ZvOdBJMZUfOVbNa+2sMzrXAns=,tag:x87IG/HETASiC9/HwyW1Ig==,type:str]
morsalin: ENC[AES256_GCM,data:rERjBNLZXSKT,iv:VuD8ZGfrd0wQ/5TCgLhLN459ZHPepcZyv8Kdl7TsMc4=,tag:Xp/fjve1xn0Wjk7ExShCLw==,type:str]
services:
admin: ENC[AES256_GCM,data:xMBoPycO/5wDae2AMZlgomoXjB98BpCOQkxek3W7t7Wk+az1GMqJhdB0osY=,iv:E6nNmNNKlJoNC7KwE0PaDIB8QyGM0MuNutQty3bi1Pc=,tag:yc8nlegBUOX2hfaMBoNaCw==,type:str]
authelia: ENC[AES256_GCM,data:1hHNPWgiRte/TJr4gBuwFt3zMHPivgRp7Z2kurYG+bT96HWmwk1+4iKSQVM=,iv:cpV2P14daWabaDuQ9KgrGs8bN+4pc7sXbAUE2mjWQL0=,tag:lsLgHkkhgSPfwxC6vu5JEg==,type:str]
grafana: ENC[AES256_GCM,data:42rnv/NMwmvHdyWW6PZj1Lto5mRDTHp6h55OuRYd9xMOtmenX5zBJzGMvnE=,iv:jUKuPisxa/S9erKjXHl3y0zJR+Tfe36O85/BdGmN+gE=,tag:h1InzKaa+bWjlmIq9OZRpw==,type:str]
users:
il: ENC[AES256_GCM,data:GcOsUe7yJFLdhPp2H7i2,iv:T4NGNvYe5beYbxr+ezfT86aS5lCBa/TG3bUWuUrCZ+A=,tag:rrdHtLyZI7pdTGq5qmptYw==,type:str]
morsalin: ENC[AES256_GCM,data:86+imwqNJ5Xg,iv:Lgt1I12gtDsjvE1yMjiyed0sZEeExQZoJPD+xKzHBqk=,tag:YiQgczFZnzh7p1t+KIzM6Q==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
@@ -342,7 +343,7 @@ sops:
k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
-----END AGE ENCRYPTED FILE-----
recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
lastmodified: "2026-06-23T00:53:05Z"
mac: ENC[AES256_GCM,data:30XGjw0JCuUTo5nbcAYkIeMyJ2H50f8F9hdTArYLxAlRz0iffx0n7BXH/LLtI/5FKcOmfhoHP/CT22wcSFxKAPzWD5Ce/xNGAFNoTftodU4CE+/VHn7VFhWYaXVjnQs2duuy4QHQvcDa8uMo+c7ZunqrkZO0zU5fKSYOaJMLloQ=,iv:MyMgnJ96P9RoDYxsbJVZnnK1q82o5AB/hueMXeQhKqQ=,tag:1s288++ruxdUfSnyP8/ecA==,type:str]
lastmodified: "2026-06-25T00:07:39Z"
mac: ENC[AES256_GCM,data:XNOyATqwo6BygVz6nzBZx6Jn8YONifcvwRKFxWsVxy+aqRRCbUA4eY3g9s6EstpZwHLpf1KeH6iS1ogzwlZfw1Xp8xaWjXgZTEV9R6jEKRzZ4pwPnmC6UVTfrJ2XBB/mjTel0jSR6gbKSgXMJw4rsEyvth+tPxMAaHvrIEcFGqE=,iv:2W2ohbVz4zFDFHG6T5loayab6nOsZaJ/OwqTfNNhEYs=,tag:TNoVHAW5g4/pAOdqolmD7Q==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1
config/services/containers/app/homepage/config/bookmarks.yaml.j2
+3
View File
@@ -2,6 +2,9 @@
- Code-Server:
- abbr: CS
href: http://localhost:2080/
- ChatGPT:
- abbr: GPT
href: https://chatgpt.com
- School:
- Portal:
config/services/containers/app/homepage/config/widgets.yaml.j2
-10
View File
@@ -16,13 +16,3 @@
format:
dateStyle: short
timeStyle: short
- openmeteo:
label: Seoul
latitude: 37.5665
longitude: 126.9780
timezone: Asia/Seoul
units: metric
cache: 5
format:
maximumFractionDigits: 1
config/services/containers/auth/authelia/config/authelia.yaml.j2
+1 -1
View File
@@ -42,7 +42,7 @@ authentication_backend:
additional_users_dn: 'ou=people'
additional_groups_dn: 'ou=groups'
# LLDAP filters
users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)(|(memberOf=cn=admins,ou=groups,{{ domain['dc'] }})(memberOf=cn=users,ou=groups,{{ domain['dc'] }})))'
groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
# LLDAP bind account configuration
user: 'uid=authelia,ou=people,{{ domain['dc'] }}'
config/services/containers/infra/grafana/etc/ldap.toml.j2
+3 -8
View File
@@ -1,7 +1,7 @@
# https://github.com/lldap/lldap/blob/main/example_configs/grafana_ldap_config.toml
[[servers]]
host = "{{ services['ldap']['domain']['internal'] }}.{{ domain['internal'] }}"
port = {{ services['ldap']['ports']['ldaps'] }}
port = 636
# Activate STARTTLS or LDAPS
use_ssl = true
# true = STARTTLS, false = LDAPS
@@ -17,7 +17,7 @@ root_ca_cert = "/etc/ssl/grafana/{{ root_cert_filename }}"
bind_dn = "uid=grafana,ou=people,{{ domain['dc'] }}"
bind_password = "$__file{/run/secrets/LDAP_BIND_PASSWORD}"
search_filter = "(|(uid=%s)(mail=%s))"
search_filter = "(&(|(uid=%s)(mail=%s))(|(memberOf=cn=admins,ou=groups,{{ domain['dc'] }})(memberOf=cn=users,ou=groups,{{ domain['dc'] }})))"
search_base_dns = ["{{ domain['dc'] }}"]
[servers.attributes]
@@ -31,14 +31,9 @@ group_search_filter = "(&(objectClass=groupOfUniqueNames)(uniqueMember=%s))"
group_search_base_dns = ["ou=groups,{{ domain['dc'] }}"]
group_search_filter_user_attribute = "uid"
[[servers.group_mappings]]
group_dn = "cn=lldap_admin,ou=groups,{{ domain['dc'] }}"
org_role = "Admin"
grafana_admin = true
[[servers.group_mappings]]
group_dn = "cn=admins,ou=groups,{{ domain['dc'] }}"
org_role = "Editor"
org_role = "Admin"
grafana_admin = false
[[servers.group_mappings]]
config/services/containers/infra/prometheus/etc/prometheus.yaml.j2
+1 -1
View File
@@ -8,7 +8,7 @@ global:
alerting:
alertmanagers:
- static_configs:
- targets:
- targets: []
# - alertmanager:9093
# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.