From b499fcb78aeadc4b9601cd9172ac779782517bd9 Mon Sep 17 00:00:00 2001 From: il Date: Thu, 25 Jun 2026 09:28:34 +0900 Subject: [PATCH] refactor(ldap): fix ldap binding range --- ansible/playbooks/app/site.yaml | 22 +++++----- ansible/playbooks/auth/site.yaml | 16 +++---- ansible/playbooks/infra/site.yaml | 16 +++---- .../auth/tasks/services/set_authelia.yaml | 2 +- .../common/tasks/services/set_podman.yaml | 42 +++++++++---------- .../infra/tasks/services/set_grafana.yaml | 4 +- .../roles/infra/tasks/services/set_ldap.yaml | 2 +- config/secrets/secrets.yaml | 17 ++++---- .../app/homepage/config/bookmarks.yaml.j2 | 3 ++ .../app/homepage/config/widgets.yaml.j2 | 10 ----- .../auth/authelia/config/authelia.yaml.j2 | 2 +- .../containers/infra/grafana/etc/ldap.toml.j2 | 11 ++--- .../infra/prometheus/etc/prometheus.yaml.j2 | 2 +- 13 files changed, 69 insertions(+), 80 deletions(-) diff --git a/ansible/playbooks/app/site.yaml b/ansible/playbooks/app/site.yaml index e146375..fdc50c7 100644 --- a/ansible/playbooks/app/site.yaml +++ b/ansible/playbooks/app/site.yaml @@ -104,7 +104,7 @@ - "dbus-user-session" state: "present" become: true - tags: ["init", "install-packages"] + tags: ["init", "site", "install-packages"] - name: Set data volume ansible.builtin.include_role: @@ -122,14 +122,6 @@ tags: ["init", "linger"] tags: ["init", "linger"] - - name: Set podman - ansible.builtin.include_role: - name: "common" - tasks_from: "services/set_podman" - apply: - tags: ["init", "podman"] - tags: ["init", "podman"] - - name: Set nftables ansible.builtin.include_role: name: "common" @@ -143,8 +135,8 @@ name: "common" tasks_from: "services/set_alloy" apply: - tags: ["init", "alloy"] - tags: ["init", "alloy"] + tags: ["site", "alloy"] + tags: ["site", "alloy"] - name: Set crowdsec ansible.builtin.include_role: @@ -162,6 +154,14 @@ tags: ["site", "kopia"] tags: ["site", "kopia"] + - name: Set podman + ansible.builtin.include_role: + name: "common" + tasks_from: "services/set_podman" + apply: + tags: ["site", "podman"] + tags: ["site", "podman"] + - name: Set caddy ansible.builtin.include_role: name: "common" diff --git a/ansible/playbooks/auth/site.yaml b/ansible/playbooks/auth/site.yaml index d5cbc52..f1ef446 100644 --- a/ansible/playbooks/auth/site.yaml +++ b/ansible/playbooks/auth/site.yaml @@ -114,14 +114,6 @@ tags: ["init", "linger"] tags: ["init", "linger"] - - name: Set podman - ansible.builtin.include_role: - name: "common" - tasks_from: "services/set_podman" - apply: - tags: ["init", "podman"] - tags: ["init", "podman"] - - name: Set nftables ansible.builtin.include_role: name: "common" @@ -138,6 +130,14 @@ tags: ["site", "crowdsec"] tags: ["site", "crowdsec"] + - name: Set podman + ansible.builtin.include_role: + name: "common" + tasks_from: "services/set_podman" + apply: + tags: ["site", "podman"] + tags: ["site", "podman"] + - name: Set caddy ansible.builtin.include_role: name: "common" diff --git a/ansible/playbooks/infra/site.yaml b/ansible/playbooks/infra/site.yaml index 003c2e2..540ad6f 100644 --- a/ansible/playbooks/infra/site.yaml +++ b/ansible/playbooks/infra/site.yaml @@ -114,14 +114,6 @@ tags: ["init", "linger"] tags: ["init", "linger"] - - name: Set podman - ansible.builtin.include_role: - name: "common" - tasks_from: "services/set_podman" - apply: - tags: ["init", "podman"] - tags: ["init", "podman"] - - name: Set nftables ansible.builtin.include_role: name: "common" @@ -146,6 +138,14 @@ tags: ["site", "kopia"] tags: ["site", "kopia"] + - name: Set podman + ansible.builtin.include_role: + name: "common" + tasks_from: "services/set_podman" + apply: + tags: ["site", "podman"] + tags: ["site", "podman"] + - name: Set ca ansible.builtin.include_role: name: "infra" diff --git a/ansible/roles/auth/tasks/services/set_authelia.yaml b/ansible/roles/auth/tasks/services/set_authelia.yaml index 077e97f..41816c6 100644 --- a/ansible/roles/auth/tasks/services/set_authelia.yaml +++ b/ansible/roles/auth/tasks/services/set_authelia.yaml @@ -54,7 +54,7 @@ - name: "AUTHELIA_JWKS_ES256" value: "{{ hostvars['console']['authelia']['jwk_es256'] }}" - name: "AUTHELIA_LDAP_PASSWORD" - value: "{{ hostvars['console']['ldap']['password']['authelia'] }}" + value: "{{ hostvars['console']['ldap']['password']['services']['authelia'] }}" - name: "POSTGRES_AUTHELIA_PASSWORD" value: "{{ hostvars['console']['postgresql']['password']['authelia'] }}" notify: "notification_restart_authelia" diff --git a/ansible/roles/common/tasks/services/set_podman.yaml b/ansible/roles/common/tasks/services/set_podman.yaml index 53124eb..9abcea0 100644 --- a/ansible/roles/common/tasks/services/set_podman.yaml +++ b/ansible/roles/common/tasks/services/set_podman.yaml @@ -15,14 +15,14 @@ state: "directory" mode: "0700" -- name: Create container data directory for app +- name: Create container data directory ansible.builtin.file: path: "{{ node['home_path'] }}/data/containers" owner: "{{ ansible_user }}" group: "{{ node['group'] }}" state: "directory" mode: "0770" - when: node['name'] == "app" + when: node['name'] in ["infra", "app"] - name: Create container image archive directory ansible.builtin.file: @@ -35,23 +35,23 @@ - "{{ node['home_path'] }}/archives" - "{{ node['home_path'] }}/archives/containers" -- name: Install podman and reset ssh connection for initiating - when: is_podman_installed.rc != 0 +- name: Set subid scope (Overwrite) + ansible.builtin.copy: + content: | + {{ ansible_user }}:100000:65536 + dest: "/etc/sub{{ item }}" + owner: "root" + group: "root" + mode: "0644" + loop: + - "uid" + - "gid" become: true - block: - - name: Set subid scope (Overwrite) - ansible.builtin.copy: - content: | - {{ ansible_user }}:100000:65536 - dest: "/etc/sub{{ item }}" - owner: "root" - group: "root" - mode: "0644" - loop: - - "uid" - - "gid" - - name: Install podman - ansible.builtin.apt: - name: - - "podman" - state: "present" + +- name: Install podman + ansible.builtin.apt: + name: + - "podman" + state: "present" + become: true + when: is_podman_installed.rc != 0 diff --git a/ansible/roles/infra/tasks/services/set_grafana.yaml b/ansible/roles/infra/tasks/services/set_grafana.yaml index ede4d91..b39820f 100644 --- a/ansible/roles/infra/tasks/services/set_grafana.yaml +++ b/ansible/roles/infra/tasks/services/set_grafana.yaml @@ -36,10 +36,10 @@ state: "present" force: true loop: + - name: "LDAP_BIND_PASSWORD" + value: "{{ hostvars['console']['ldap']['password']['services']['grafana'] }}" - name: "GF_DB_PASSWORD" value: "{{ hostvars['console']['postgresql']['password']['grafana'] }}" - - name: "LDAP_BIND_PASSWORD" - value: "{{ hostvars['console']['ldap']['password']['grafana'] }}" - name: "GF_ADMIN_PASSWORD" value: "{{ hostvars['console']['grafana']['admin']['password'] }}" notify: "notification_restart_grafana" diff --git a/ansible/roles/infra/tasks/services/set_ldap.yaml b/ansible/roles/infra/tasks/services/set_ldap.yaml index 1f2e2cb..6e604c2 100644 --- a/ansible/roles/infra/tasks/services/set_ldap.yaml +++ b/ansible/roles/infra/tasks/services/set_ldap.yaml @@ -65,7 +65,7 @@ - name: Register extra secret value to podman secret containers.podman.podman_secret: name: "LLDAP_LDAP_USER_PASSWORD" - data: "{{ hostvars['console']['ldap']['password']['user'] }}" + data: "{{ hostvars['console']['ldap']['password']['services']['admin'] }}" state: "present" force: true # You must check the image version first (following container file on data/config/containers/infra/ldap/ldap.container) diff --git a/config/secrets/secrets.yaml b/config/secrets/secrets.yaml index f48568f..b9aaafb 100644 --- a/config/secrets/secrets.yaml +++ b/config/secrets/secrets.yaml @@ -152,12 +152,13 @@ ldap: #ENC[AES256_GCM,data:6AE31A6F6mflPwwac4jVxY5kJPYaKlYzNjtUC9/VmCPeS8iuvoFmxHNQ9cwxLa20Nw==,iv:N7tQ9RyBYvSCKzbLGWgH8NgyKCJpNM5cupGK9e9pQbM=,tag:nAduK50DDywtkkQ03psKRA==,type:comment] #ENC[AES256_GCM,data:o4Uc0IfSKbSCHAh00aHkN1g/+FoK/Ffm26iT//ZGc9WTncusMdZslfX9AQWXXOtRwOP9hjpw7KZA5FWsYEGzyIJNcvq0nayEgwBmCB1RmmDVcvVT2jEjKLGCIqYMHT10ZUdFuls+SSKtE6Kk6GMrrV/MEGzn7rKIHSlflv3+Iav8p2cblRoEFqAxrbNgbvcMzSDpWH9XCInhD0Sw5ABViNvBc6CVb0ZfZEuyoBF4EhQ=,iv:bs9iS3fmJtb0K5fc/DXKYWho9+1GBWmN8jOBEhGr8Bw=,tag:Ry77miT/7UKA2pLE3kMcag==,type:comment] password: - user: ENC[AES256_GCM,data:DT9h51o6z70A4QeoKvCbUo98JFxILgB5tkHeX60CZuCl0GHTa//mRpIUEvo=,iv:Pa9iqXeKDHHBz524zeRImYEkXmY50s7Z+Z4KYt3sNT4=,tag:UTS5VIqbRA66UVDrDXwuPQ==,type:str] - authelia: ENC[AES256_GCM,data:G8ZGsLKqEmMzQ5NMAgirF5BQraHNqixtI6dyyaeNhTdXebjJZML52xL36p4=,iv:ZtHAsFYmrQxr+qoQLPW/eme0+nsT148KRsXmW/LNLlU=,tag:Pvjs/eylkgxJpmGBsRmjcw==,type:str] - grafana: ENC[AES256_GCM,data:vWmU3ZKcolETWAY74C3OMD8gMXDeYk+DqssACL0xefIPi5IkbrhYWmnWAnA=,iv:wcRms3Zp8kPM4USRPVa0UHpCTK36SWhK9C8yHSWu2Cs=,tag:gU5S/6fdMZVd/ih3Yd5uJA==,type:str] - users: - il: ENC[AES256_GCM,data:9b9OU4Nt60/XdUrwnhJh,iv:7ZqOYqM2aibgcFRxw1ZvOdBJMZUfOVbNa+2sMzrXAns=,tag:x87IG/HETASiC9/HwyW1Ig==,type:str] - morsalin: ENC[AES256_GCM,data:rERjBNLZXSKT,iv:VuD8ZGfrd0wQ/5TCgLhLN459ZHPepcZyv8Kdl7TsMc4=,tag:Xp/fjve1xn0Wjk7ExShCLw==,type:str] + services: + admin: ENC[AES256_GCM,data:xMBoPycO/5wDae2AMZlgomoXjB98BpCOQkxek3W7t7Wk+az1GMqJhdB0osY=,iv:E6nNmNNKlJoNC7KwE0PaDIB8QyGM0MuNutQty3bi1Pc=,tag:yc8nlegBUOX2hfaMBoNaCw==,type:str] + authelia: ENC[AES256_GCM,data:1hHNPWgiRte/TJr4gBuwFt3zMHPivgRp7Z2kurYG+bT96HWmwk1+4iKSQVM=,iv:cpV2P14daWabaDuQ9KgrGs8bN+4pc7sXbAUE2mjWQL0=,tag:lsLgHkkhgSPfwxC6vu5JEg==,type:str] + grafana: ENC[AES256_GCM,data:42rnv/NMwmvHdyWW6PZj1Lto5mRDTHp6h55OuRYd9xMOtmenX5zBJzGMvnE=,iv:jUKuPisxa/S9erKjXHl3y0zJR+Tfe36O85/BdGmN+gE=,tag:h1InzKaa+bWjlmIq9OZRpw==,type:str] + users: + il: ENC[AES256_GCM,data:GcOsUe7yJFLdhPp2H7i2,iv:T4NGNvYe5beYbxr+ezfT86aS5lCBa/TG3bUWuUrCZ+A=,tag:rrdHtLyZI7pdTGq5qmptYw==,type:str] + morsalin: ENC[AES256_GCM,data:86+imwqNJ5Xg,iv:Lgt1I12gtDsjvE1yMjiyed0sZEeExQZoJPD+xKzHBqk=,tag:YiQgczFZnzh7p1t+KIzM6Q==,type:str] #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] # # @@ -342,7 +343,7 @@ sops: k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ== -----END AGE ENCRYPTED FILE----- recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y - lastmodified: "2026-06-23T00:53:05Z" - mac: ENC[AES256_GCM,data:30XGjw0JCuUTo5nbcAYkIeMyJ2H50f8F9hdTArYLxAlRz0iffx0n7BXH/LLtI/5FKcOmfhoHP/CT22wcSFxKAPzWD5Ce/xNGAFNoTftodU4CE+/VHn7VFhWYaXVjnQs2duuy4QHQvcDa8uMo+c7ZunqrkZO0zU5fKSYOaJMLloQ=,iv:MyMgnJ96P9RoDYxsbJVZnnK1q82o5AB/hueMXeQhKqQ=,tag:1s288++ruxdUfSnyP8/ecA==,type:str] + lastmodified: "2026-06-25T00:07:39Z" + mac: ENC[AES256_GCM,data:XNOyATqwo6BygVz6nzBZx6Jn8YONifcvwRKFxWsVxy+aqRRCbUA4eY3g9s6EstpZwHLpf1KeH6iS1ogzwlZfw1Xp8xaWjXgZTEV9R6jEKRzZ4pwPnmC6UVTfrJ2XBB/mjTel0jSR6gbKSgXMJw4rsEyvth+tPxMAaHvrIEcFGqE=,iv:2W2ohbVz4zFDFHG6T5loayab6nOsZaJ/OwqTfNNhEYs=,tag:TNoVHAW5g4/pAOdqolmD7Q==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 diff --git a/config/services/containers/app/homepage/config/bookmarks.yaml.j2 b/config/services/containers/app/homepage/config/bookmarks.yaml.j2 index d98b232..8fa6a8f 100644 --- a/config/services/containers/app/homepage/config/bookmarks.yaml.j2 +++ b/config/services/containers/app/homepage/config/bookmarks.yaml.j2 @@ -2,6 +2,9 @@ - Code-Server: - abbr: CS href: http://localhost:2080/ + - ChatGPT: + - abbr: GPT + href: https://chatgpt.com - School: - Portal: diff --git a/config/services/containers/app/homepage/config/widgets.yaml.j2 b/config/services/containers/app/homepage/config/widgets.yaml.j2 index fc40516..0097e7a 100644 --- a/config/services/containers/app/homepage/config/widgets.yaml.j2 +++ b/config/services/containers/app/homepage/config/widgets.yaml.j2 @@ -16,13 +16,3 @@ format: dateStyle: short timeStyle: short - -- openmeteo: - label: Seoul - latitude: 37.5665 - longitude: 126.9780 - timezone: Asia/Seoul - units: metric - cache: 5 - format: - maximumFractionDigits: 1 diff --git a/config/services/containers/auth/authelia/config/authelia.yaml.j2 b/config/services/containers/auth/authelia/config/authelia.yaml.j2 index b273234..b1a8983 100644 --- a/config/services/containers/auth/authelia/config/authelia.yaml.j2 +++ b/config/services/containers/auth/authelia/config/authelia.yaml.j2 @@ -42,7 +42,7 @@ authentication_backend: additional_users_dn: 'ou=people' additional_groups_dn: 'ou=groups' # LLDAP filters - users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))' + users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)(|(memberOf=cn=admins,ou=groups,{{ domain['dc'] }})(memberOf=cn=users,ou=groups,{{ domain['dc'] }})))' groups_filter: '(&(member={dn})(objectClass=groupOfNames))' # LLDAP bind account configuration user: 'uid=authelia,ou=people,{{ domain['dc'] }}' diff --git a/config/services/containers/infra/grafana/etc/ldap.toml.j2 b/config/services/containers/infra/grafana/etc/ldap.toml.j2 index c7e513d..9f960fc 100644 --- a/config/services/containers/infra/grafana/etc/ldap.toml.j2 +++ b/config/services/containers/infra/grafana/etc/ldap.toml.j2 @@ -1,7 +1,7 @@ # https://github.com/lldap/lldap/blob/main/example_configs/grafana_ldap_config.toml [[servers]] host = "{{ services['ldap']['domain']['internal'] }}.{{ domain['internal'] }}" -port = {{ services['ldap']['ports']['ldaps'] }} +port = 636 # Activate STARTTLS or LDAPS use_ssl = true # true = STARTTLS, false = LDAPS @@ -17,7 +17,7 @@ root_ca_cert = "/etc/ssl/grafana/{{ root_cert_filename }}" bind_dn = "uid=grafana,ou=people,{{ domain['dc'] }}" bind_password = "$__file{/run/secrets/LDAP_BIND_PASSWORD}" -search_filter = "(|(uid=%s)(mail=%s))" +search_filter = "(&(|(uid=%s)(mail=%s))(|(memberOf=cn=admins,ou=groups,{{ domain['dc'] }})(memberOf=cn=users,ou=groups,{{ domain['dc'] }})))" search_base_dns = ["{{ domain['dc'] }}"] [servers.attributes] @@ -31,14 +31,9 @@ group_search_filter = "(&(objectClass=groupOfUniqueNames)(uniqueMember=%s))" group_search_base_dns = ["ou=groups,{{ domain['dc'] }}"] group_search_filter_user_attribute = "uid" -[[servers.group_mappings]] -group_dn = "cn=lldap_admin,ou=groups,{{ domain['dc'] }}" -org_role = "Admin" -grafana_admin = true - [[servers.group_mappings]] group_dn = "cn=admins,ou=groups,{{ domain['dc'] }}" -org_role = "Editor" +org_role = "Admin" grafana_admin = false [[servers.group_mappings]] diff --git a/config/services/containers/infra/prometheus/etc/prometheus.yaml.j2 b/config/services/containers/infra/prometheus/etc/prometheus.yaml.j2 index c5d316c..cd445f6 100644 --- a/config/services/containers/infra/prometheus/etc/prometheus.yaml.j2 +++ b/config/services/containers/infra/prometheus/etc/prometheus.yaml.j2 @@ -8,7 +8,7 @@ global: alerting: alertmanagers: - static_configs: - - targets: + - targets: [] # - alertmanager:9093 # Load rules once and periodically evaluate them according to the global 'evaluation_interval'.