145 lines
6 KiB
Text
145 lines
6 KiB
Text
|
{{ file_header | default () }}
|
||
|
|
## Tune the logging to be more verbose by setting this to be true.
|
||
|
|
## You can set it with the LLDAP_VERBOSE environment variable.
|
||
|
|
verbose={{ lldap_logging_verbose }}
|
||
|
|
|
||
|
|
## The host address that the LDAP server will be bound to.
|
||
|
|
## To enable IPv6 support, simply switch "ldap_host" to "::":
|
||
|
|
## To only allow connections from localhost (if you want to restrict to local self-hosted services),
|
||
|
|
## change it to "127.0.0.1" ("::1" in case of IPv6)".
|
||
|
|
ldap_host = "{{ lldap_ldap_host }}"
|
||
|
|
|
||
|
|
## The port on which to have the LDAP server.
|
||
|
|
#ldap_port = 3890
|
||
|
|
|
||
|
|
## The host address that the HTTP server will be bound to.
|
||
|
|
## To enable IPv6 support, simply switch "http_host" to "::".
|
||
|
|
## To only allow connections from localhost (if you want to restrict to local self-hosted services),
|
||
|
|
## change it to "127.0.0.1" ("::1" in case of IPv6)".
|
||
|
|
http_host = "{{ lldap_http_host }}"
|
||
|
|
|
||
|
|
## The port on which to have the HTTP server, for user login and
|
||
|
|
## administration.
|
||
|
|
http_port = {{ lldap_http_port }}
|
||
|
|
|
||
|
|
## The public URL of the server, for password reset links.
|
||
|
|
http_url = "{{ lldap_public_url }}"
|
||
|
|
|
||
|
|
## Random secret for JWT signature.
|
||
|
|
## This secret should be random, and should be shared with application
|
||
|
|
## servers that need to consume the JWTs.
|
||
|
|
## Changing this secret will invalidate all user sessions and require
|
||
|
|
## them to re-login.
|
||
|
|
## You should probably set it through the LLDAP_JWT_SECRET environment
|
||
|
|
## variable from a secret ".env" file.
|
||
|
|
## This can also be set from a file's contents by specifying the file path
|
||
|
|
## in the LLDAP_JWT_SECRET_FILE environment variable
|
||
|
|
## You can generate it with (on linux):
|
||
|
|
## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''
|
||
|
|
jwt_secret = "{{ lldap_jwt_secret }}"
|
||
|
|
|
||
|
|
## Base DN for LDAP.
|
||
|
|
## This is usually your domain name, and is used as a
|
||
|
|
## namespace for your users. The choice is arbitrary, but will be needed
|
||
|
|
## to configure the LDAP integration with other services.
|
||
|
|
## The sample value is for "example.com", but you can extend it with as
|
||
|
|
## many "dc" as you want, and you don't actually need to own the domain
|
||
|
|
## name.
|
||
|
|
ldap_base_dn = "{{ lldap_ldap_base_dn }}"
|
||
|
|
|
||
|
|
## Admin username.
|
||
|
|
## For the LDAP interface, a value of "admin" here will create the LDAP
|
||
|
|
## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).
|
||
|
|
## For the administration interface, this is the username.
|
||
|
|
ldap_user_dn = "{{ lldap_admin_username }}"
|
||
|
|
|
||
|
|
## Admin email.
|
||
|
|
## Email for the admin account. It is only used when initially creating
|
||
|
|
## the admin user, and can safely be omitted.
|
||
|
|
ldap_user_email = "{{ lldap_admin_mailaddress }}"
|
||
|
|
|
||
|
|
## Admin password.
|
||
|
|
## Password for the admin account, both for the LDAP bind and for the
|
||
|
|
## administration interface. It is only used when initially creating
|
||
|
|
## the admin user.
|
||
|
|
## It should be minimum 8 characters long.
|
||
|
|
## You can set it with the LLDAP_LDAP_USER_PASS environment variable.
|
||
|
|
## This can also be set from a file's contents by specifying the file path
|
||
|
|
## in the LLDAP_LDAP_USER_PASS_FILE environment variable
|
||
|
|
## Note: you can create another admin user for user administration, this
|
||
|
|
## is just the default one.
|
||
|
|
ldap_user_pass = "{{ lldap_admin_password }}"
|
||
|
|
|
||
|
|
## Database URL.
|
||
|
|
## This encodes the type of database (SQlite, MySQL, or PostgreSQL)
|
||
|
|
## , the path, the user, password, and sometimes the mode (when
|
||
|
|
## relevant).
|
||
|
|
## Note: SQlite should come with "?mode=rwc" to create the DB
|
||
|
|
## if not present.
|
||
|
|
## Example URLs:
|
||
|
|
## - "postgres://postgres-user:password@postgres-server/my-database"
|
||
|
|
## - "mysql://mysql-user:password@mysql-server/my-database"
|
||
|
|
##
|
||
|
|
## This can be overridden with the LLDAP_DATABASE_URL env variable.
|
||
|
|
database_url = "{{ lldap_database_url }}"
|
||
|
|
|
||
|
|
## Private key file.
|
||
|
|
## Contains the secret private key used to store the passwords safely.
|
||
|
|
## Note that even with a database dump and the private key, an attacker
|
||
|
|
## would still have to perform an (expensive) brute force attack to find
|
||
|
|
## each password.
|
||
|
|
## Randomly generated on first run if it doesn't exist.
|
||
|
|
## Alternatively, you can use key_seed to override this instead of relying on
|
||
|
|
## a file.
|
||
|
|
## Env variable: LLDAP_KEY_FILE
|
||
|
|
key_file = "/var/lib/lldap/private_key"
|
||
|
|
|
||
|
|
## Seed to generate the server private key, see key_file above.
|
||
|
|
## This can be any random string, the recommendation is that it's at least 12
|
||
|
|
## characters long.
|
||
|
|
## Env variable: LLDAP_KEY_SEED
|
||
|
|
key_seed = "{{ lldap_key_seed }}"
|
||
|
|
|
||
|
|
## Ignored attributes.
|
||
|
|
## Some services will request attributes that are not present in LLDAP. When it
|
||
|
|
## is the case, LLDAP will warn about the attribute being unknown. If you want
|
||
|
|
## to ignore the attribute and the service works without, you can add it to this
|
||
|
|
## list to silence the warning.
|
||
|
|
#ignored_user_attributes = [ "sAMAccountName" ]
|
||
|
|
#ignored_group_attributes = [ "mail", "userPrincipalName" ]
|
||
|
|
|
||
|
|
## Options to configure SMTP parameters, to send password reset emails.
|
||
|
|
## To set these options from environment variables, use the following format
|
||
|
|
## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
|
||
|
|
[smtp_options]
|
||
|
|
## Whether to enabled password reset via email, from LLDAP.
|
||
|
|
enable_password_reset={{ lldap_smtp_enable_password_reset }}
|
||
|
|
## The SMTP server.
|
||
|
|
server="{{ lldap_smtp_server }}"
|
||
|
|
## The SMTP port.
|
||
|
|
port={{ lldap_smtp_port }}
|
||
|
|
## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
|
||
|
|
smtp_encryption = "{{ lldap_smtp_smtp_encryption }}"
|
||
|
|
## The SMTP user, usually your email address.
|
||
|
|
user="{{ lldap_smtp_user }}"
|
||
|
|
## The SMTP password.
|
||
|
|
#password="password" #gitleaks:allow
|
||
|
|
## The header field, optional: how the sender appears in the email. The first
|
||
|
|
## is a free-form name, followed by an email between <>.
|
||
|
|
from="{{ lldap_smtp_from }}"
|
||
|
|
## Same for reply-to, optional.
|
||
|
|
reply_to="{{ lldap_smtp_reply_to }}"
|
||
|
|
|
||
|
|
## Options to configure LDAPS.
|
||
|
|
## To set these options from environment variables, use the following format
|
||
|
|
## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
|
||
|
|
[ldaps_options]
|
||
|
|
## Whether to enable LDAPS.
|
||
|
|
#enabled=true
|
||
|
|
## Port on which to listen.
|
||
|
|
#port=6360
|
||
|
|
## Certificate file.
|
||
|
|
#cert_file="/data/cert.pem"
|
||
|
|
## Certificate key file.
|
||
|
|
#key_file="/data/key.pem"
|