refactor(ldap): fix ldap binding range

ansible/playbooks/app/site.yaml

@@ -104,7 +104,7 @@
           - "dbus-user-session"
         state: "present"
       become: true
-      tags: ["init", "install-packages"]
+      tags: ["init", "site", "install-packages"]
 
     - name: Set data volume
       ansible.builtin.include_role:
@@ -122,14 +122,6 @@
           tags: ["init", "linger"]
       tags: ["init", "linger"]
 
-    - name: Set podman
-      ansible.builtin.include_role:
-        name: "common"
-        tasks_from: "services/set_podman"
-        apply:
-          tags: ["init", "podman"]
-      tags: ["init", "podman"]
-
     - name: Set nftables
       ansible.builtin.include_role:
         name: "common"
@@ -143,8 +135,8 @@
         name: "common"
         tasks_from: "services/set_alloy"
         apply:
-          tags: ["init", "alloy"]
+          tags: ["site", "alloy"]
-      tags: ["init", "alloy"]
+      tags: ["site", "alloy"]
 
     - name: Set crowdsec
       ansible.builtin.include_role:
@@ -162,6 +154,14 @@
           tags: ["site", "kopia"]
       tags: ["site", "kopia"]
 
+    - name: Set podman
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "services/set_podman"
+        apply:
+          tags: ["site", "podman"]
+      tags: ["site", "podman"]
+
     - name: Set caddy
       ansible.builtin.include_role:
         name: "common"

ansible/playbooks/auth/site.yaml

@@ -114,14 +114,6 @@
           tags: ["init", "linger"]
       tags: ["init", "linger"]
 
-    - name: Set podman
-      ansible.builtin.include_role:
-        name: "common"
-        tasks_from: "services/set_podman"
-        apply:
-          tags: ["init", "podman"]
-      tags: ["init", "podman"]
-
     - name: Set nftables
       ansible.builtin.include_role:
         name: "common"
@@ -138,6 +130,14 @@
           tags: ["site", "crowdsec"]
       tags: ["site", "crowdsec"]
 
+    - name: Set podman
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "services/set_podman"
+        apply:
+          tags: ["site", "podman"]
+      tags: ["site", "podman"]
+
     - name: Set caddy
       ansible.builtin.include_role:
         name: "common"

ansible/playbooks/infra/site.yaml

@@ -114,14 +114,6 @@
           tags: ["init", "linger"]
       tags: ["init", "linger"]
 
-    - name: Set podman
-      ansible.builtin.include_role:
-        name: "common"
-        tasks_from: "services/set_podman"
-        apply:
-          tags: ["init", "podman"]
-      tags: ["init", "podman"]
-
     - name: Set nftables
       ansible.builtin.include_role:
         name: "common"
@@ -146,6 +138,14 @@
           tags: ["site", "kopia"]
       tags: ["site", "kopia"]
 
+    - name: Set podman
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "services/set_podman"
+        apply:
+          tags: ["site", "podman"]
+      tags: ["site", "podman"]
+
     - name: Set ca
       ansible.builtin.include_role:
         name: "infra"

ansible/roles/auth/tasks/services/set_authelia.yaml

@@ -54,7 +54,7 @@
     - name: "AUTHELIA_JWKS_ES256"
       value: "{{ hostvars['console']['authelia']['jwk_es256'] }}"
     - name: "AUTHELIA_LDAP_PASSWORD"
-      value: "{{ hostvars['console']['ldap']['password']['authelia'] }}"
+      value: "{{ hostvars['console']['ldap']['password']['services']['authelia'] }}"
     - name: "POSTGRES_AUTHELIA_PASSWORD"
       value: "{{ hostvars['console']['postgresql']['password']['authelia'] }}"
   notify: "notification_restart_authelia"

ansible/roles/common/tasks/services/set_podman.yaml

@@ -15,14 +15,14 @@
     state: "directory"
     mode: "0700"
 
-- name: Create container data directory for app
+- name: Create container data directory
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/data/containers"
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
-  when: node['name'] == "app"
+  when: node['name'] in ["infra", "app"]
 
 - name: Create container image archive directory
   ansible.builtin.file:
@@ -35,11 +35,7 @@
     - "{{ node['home_path'] }}/archives"
     - "{{ node['home_path'] }}/archives/containers"
 
-- name: Install podman and reset ssh connection for initiating
+- name: Set subid scope (Overwrite)
-  when: is_podman_installed.rc != 0
-  become: true
-  block:
-    - name: Set subid scope (Overwrite)
   ansible.builtin.copy:
     content: |
       {{ ansible_user }}:100000:65536
@@ -50,8 +46,12 @@
   loop:
     - "uid"
     - "gid"
-    - name: Install podman
+  become: true
+
+- name: Install podman
   ansible.builtin.apt:
     name:
       - "podman"
     state: "present"
+  become: true
+  when: is_podman_installed.rc != 0

ansible/roles/infra/tasks/services/set_grafana.yaml

@@ -36,10 +36,10 @@
     state: "present"
     force: true
   loop:
+    - name: "LDAP_BIND_PASSWORD"
+      value: "{{ hostvars['console']['ldap']['password']['services']['grafana'] }}"
     - name: "GF_DB_PASSWORD"
       value: "{{ hostvars['console']['postgresql']['password']['grafana'] }}"
-    - name: "LDAP_BIND_PASSWORD"
-      value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
     - name: "GF_ADMIN_PASSWORD"
       value: "{{ hostvars['console']['grafana']['admin']['password'] }}"
   notify: "notification_restart_grafana"

ansible/roles/infra/tasks/services/set_ldap.yaml

@@ -65,7 +65,7 @@
     - name: Register extra secret value to podman secret
       containers.podman.podman_secret:
         name: "LLDAP_LDAP_USER_PASSWORD"
-        data: "{{ hostvars['console']['ldap']['password']['user'] }}"
+        data: "{{ hostvars['console']['ldap']['password']['services']['admin'] }}"
         state: "present"
         force: true
     # You must check the image version first (following container file on data/config/containers/infra/ldap/ldap.container)

config/secrets/secrets.yaml

@@ -152,12 +152,13 @@ ldap:
     #ENC[AES256_GCM,data:6AE31A6F6mflPwwac4jVxY5kJPYaKlYzNjtUC9/VmCPeS8iuvoFmxHNQ9cwxLa20Nw==,iv:N7tQ9RyBYvSCKzbLGWgH8NgyKCJpNM5cupGK9e9pQbM=,tag:nAduK50DDywtkkQ03psKRA==,type:comment]
     #ENC[AES256_GCM,data:o4Uc0IfSKbSCHAh00aHkN1g/+FoK/Ffm26iT//ZGc9WTncusMdZslfX9AQWXXOtRwOP9hjpw7KZA5FWsYEGzyIJNcvq0nayEgwBmCB1RmmDVcvVT2jEjKLGCIqYMHT10ZUdFuls+SSKtE6Kk6GMrrV/MEGzn7rKIHSlflv3+Iav8p2cblRoEFqAxrbNgbvcMzSDpWH9XCInhD0Sw5ABViNvBc6CVb0ZfZEuyoBF4EhQ=,iv:bs9iS3fmJtb0K5fc/DXKYWho9+1GBWmN8jOBEhGr8Bw=,tag:Ry77miT/7UKA2pLE3kMcag==,type:comment]
     password:
-        user: ENC[AES256_GCM,data:DT9h51o6z70A4QeoKvCbUo98JFxILgB5tkHeX60CZuCl0GHTa//mRpIUEvo=,iv:Pa9iqXeKDHHBz524zeRImYEkXmY50s7Z+Z4KYt3sNT4=,tag:UTS5VIqbRA66UVDrDXwuPQ==,type:str]
+        services:
-        authelia: ENC[AES256_GCM,data:G8ZGsLKqEmMzQ5NMAgirF5BQraHNqixtI6dyyaeNhTdXebjJZML52xL36p4=,iv:ZtHAsFYmrQxr+qoQLPW/eme0+nsT148KRsXmW/LNLlU=,tag:Pvjs/eylkgxJpmGBsRmjcw==,type:str]
+            admin: ENC[AES256_GCM,data:xMBoPycO/5wDae2AMZlgomoXjB98BpCOQkxek3W7t7Wk+az1GMqJhdB0osY=,iv:E6nNmNNKlJoNC7KwE0PaDIB8QyGM0MuNutQty3bi1Pc=,tag:yc8nlegBUOX2hfaMBoNaCw==,type:str]
-        grafana: ENC[AES256_GCM,data:vWmU3ZKcolETWAY74C3OMD8gMXDeYk+DqssACL0xefIPi5IkbrhYWmnWAnA=,iv:wcRms3Zp8kPM4USRPVa0UHpCTK36SWhK9C8yHSWu2Cs=,tag:gU5S/6fdMZVd/ih3Yd5uJA==,type:str]
+            authelia: ENC[AES256_GCM,data:1hHNPWgiRte/TJr4gBuwFt3zMHPivgRp7Z2kurYG+bT96HWmwk1+4iKSQVM=,iv:cpV2P14daWabaDuQ9KgrGs8bN+4pc7sXbAUE2mjWQL0=,tag:lsLgHkkhgSPfwxC6vu5JEg==,type:str]
+            grafana: ENC[AES256_GCM,data:42rnv/NMwmvHdyWW6PZj1Lto5mRDTHp6h55OuRYd9xMOtmenX5zBJzGMvnE=,iv:jUKuPisxa/S9erKjXHl3y0zJR+Tfe36O85/BdGmN+gE=,tag:h1InzKaa+bWjlmIq9OZRpw==,type:str]
         users:
-        il: ENC[AES256_GCM,data:9b9OU4Nt60/XdUrwnhJh,iv:7ZqOYqM2aibgcFRxw1ZvOdBJMZUfOVbNa+2sMzrXAns=,tag:x87IG/HETASiC9/HwyW1Ig==,type:str]
+            il: ENC[AES256_GCM,data:GcOsUe7yJFLdhPp2H7i2,iv:T4NGNvYe5beYbxr+ezfT86aS5lCBa/TG3bUWuUrCZ+A=,tag:rrdHtLyZI7pdTGq5qmptYw==,type:str]
-        morsalin: ENC[AES256_GCM,data:rERjBNLZXSKT,iv:VuD8ZGfrd0wQ/5TCgLhLN459ZHPepcZyv8Kdl7TsMc4=,tag:Xp/fjve1xn0Wjk7ExShCLw==,type:str]
+            morsalin: ENC[AES256_GCM,data:86+imwqNJ5Xg,iv:Lgt1I12gtDsjvE1yMjiyed0sZEeExQZoJPD+xKzHBqk=,tag:YiQgczFZnzh7p1t+KIzM6Q==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -342,7 +343,7 @@ sops:
             k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
-    lastmodified: "2026-06-23T00:53:05Z"
+    lastmodified: "2026-06-25T00:07:39Z"
-    mac: ENC[AES256_GCM,data:30XGjw0JCuUTo5nbcAYkIeMyJ2H50f8F9hdTArYLxAlRz0iffx0n7BXH/LLtI/5FKcOmfhoHP/CT22wcSFxKAPzWD5Ce/xNGAFNoTftodU4CE+/VHn7VFhWYaXVjnQs2duuy4QHQvcDa8uMo+c7ZunqrkZO0zU5fKSYOaJMLloQ=,iv:MyMgnJ96P9RoDYxsbJVZnnK1q82o5AB/hueMXeQhKqQ=,tag:1s288++ruxdUfSnyP8/ecA==,type:str]
+    mac: ENC[AES256_GCM,data:XNOyATqwo6BygVz6nzBZx6Jn8YONifcvwRKFxWsVxy+aqRRCbUA4eY3g9s6EstpZwHLpf1KeH6iS1ogzwlZfw1Xp8xaWjXgZTEV9R6jEKRzZ4pwPnmC6UVTfrJ2XBB/mjTel0jSR6gbKSgXMJw4rsEyvth+tPxMAaHvrIEcFGqE=,iv:2W2ohbVz4zFDFHG6T5loayab6nOsZaJ/OwqTfNNhEYs=,tag:TNoVHAW5g4/pAOdqolmD7Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1

config/services/containers/app/homepage/config/bookmarks.yaml.j2

@@ -2,6 +2,9 @@
     - Code-Server:
         - abbr: CS
           href: http://localhost:2080/
+    - ChatGPT:
+        - abbr: GPT
+          href: https://chatgpt.com
 
 - School:
     - Portal:

config/services/containers/app/homepage/config/widgets.yaml.j2

@@ -16,13 +16,3 @@
     format:
       dateStyle: short
       timeStyle: short
-
-- openmeteo:
-    label: Seoul
-    latitude: 37.5665
-    longitude: 126.9780
-    timezone: Asia/Seoul
-    units: metric
-    cache: 5
-    format:
-      maximumFractionDigits: 1

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -42,7 +42,7 @@ authentication_backend:
     additional_users_dn: 'ou=people'
     additional_groups_dn: 'ou=groups'
     # LLDAP filters
-    users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
+    users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)(|(memberOf=cn=admins,ou=groups,{{ domain['dc'] }})(memberOf=cn=users,ou=groups,{{ domain['dc'] }})))'
     groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
     # LLDAP bind account configuration
     user: 'uid=authelia,ou=people,{{ domain['dc'] }}'

config/services/containers/infra/grafana/etc/ldap.toml.j2

@@ -1,7 +1,7 @@
 # https://github.com/lldap/lldap/blob/main/example_configs/grafana_ldap_config.toml
 [[servers]]
 host = "{{ services['ldap']['domain']['internal'] }}.{{ domain['internal'] }}"
-port = {{ services['ldap']['ports']['ldaps'] }}
+port = 636
 # Activate STARTTLS or LDAPS
 use_ssl = true
 # true = STARTTLS, false = LDAPS
@@ -17,7 +17,7 @@ root_ca_cert = "/etc/ssl/grafana/{{ root_cert_filename }}"
 bind_dn = "uid=grafana,ou=people,{{ domain['dc'] }}"
 bind_password = "$__file{/run/secrets/LDAP_BIND_PASSWORD}"
 
-search_filter = "(|(uid=%s)(mail=%s))"
+search_filter = "(&(|(uid=%s)(mail=%s))(|(memberOf=cn=admins,ou=groups,{{ domain['dc'] }})(memberOf=cn=users,ou=groups,{{ domain['dc'] }})))"
 search_base_dns = ["{{ domain['dc'] }}"]
 
 [servers.attributes]
@@ -31,14 +31,9 @@ group_search_filter = "(&(objectClass=groupOfUniqueNames)(uniqueMember=%s))"
 group_search_base_dns = ["ou=groups,{{ domain['dc'] }}"]
 group_search_filter_user_attribute = "uid"
 
-[[servers.group_mappings]]
-group_dn = "cn=lldap_admin,ou=groups,{{ domain['dc'] }}"
-org_role = "Admin"
-grafana_admin = true
-
 [[servers.group_mappings]]
 group_dn = "cn=admins,ou=groups,{{ domain['dc'] }}"
-org_role = "Editor"
+org_role = "Admin"
 grafana_admin = false
 
 [[servers.group_mappings]]

config/services/containers/infra/prometheus/etc/prometheus.yaml.j2

@@ -8,7 +8,7 @@ global:
 alerting:
   alertmanagers:
     - static_configs:
-        - targets:
+        - targets: []
           # - alertmanager:9093
 
 # Load rules once and periodically evaluate them according to the global 'evaluation_interval'.