From bee58a7891cc50176a98fa84df508330924d0c66 Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Wed, 1 Jun 2022 14:04:20 +0200
Subject: Add directory

---
 app/directory/config/bottin/config.json.tpl  | 26 +++++++++++++++++++++
 app/directory/config/guichet/config.json.tpl | 34 ++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 app/directory/config/bottin/config.json.tpl
 create mode 100644 app/directory/config/guichet/config.json.tpl

(limited to 'app/directory/config')

diff --git a/app/directory/config/bottin/config.json.tpl b/app/directory/config/bottin/config.json.tpl
new file mode 100644
index 0000000..844f7b7
--- /dev/null
+++ b/app/directory/config/bottin/config.json.tpl
@@ -0,0 +1,26 @@
+{
+  "suffix": "{{ key "secrets/directory/ldap_base_dn" }}",
+  "bind": "0.0.0.0:389",
+  "log_level": "debug",
+  "acl": [
+		"*,{{ key "secrets/directory/ldap_base_dn" }}::read:*:* !userpassword !user_secret !alternate_user_secrets !garage_s3_secret_key",
+		"*::read modify:SELF:*",
+		"ANONYMOUS::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:",
+		"ANONYMOUS::bind:cn=admin,{{ key "secrets/directory/ldap_base_dn" }}:",
+		"*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::read:*:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"ANONYMOUS::bind:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:",
+		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::delete:SELF:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+
+		"*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
+		"*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
+
+		"cn=admin,{{ key "secrets/directory/ldap_base_dn" }}::read add modify delete:*:*",
+		"*:cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:read add modify delete:*:*"
+  ]
+}
diff --git a/app/directory/config/guichet/config.json.tpl b/app/directory/config/guichet/config.json.tpl
new file mode 100644
index 0000000..871f3f0
--- /dev/null
+++ b/app/directory/config/guichet/config.json.tpl
@@ -0,0 +1,34 @@
+{
+  "http_bind_addr": ":9991",
+  "ldap_server_addr": "ldap://bottin2.service.2.cluster.deuxfleurs.fr:389",
+
+  "base_dn": "{{ key "secrets/directory/ldap_base_dn" }}",
+  "user_base_dn": "ou=users,{{ key "secrets/directory/ldap_base_dn" }}",
+  "user_name_attr": "cn",
+  "group_base_dn": "ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
+  "group_name_attr": "cn",
+
+  "invitation_base_dn": "ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}",
+  "invitation_name_attr": "cn",
+  "invited_mail_format": "{}@{{ key "secrets/directory/guichet/mail_domain" | trimSpace }}",
+  "invited_auto_groups": [
+    "cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}"
+  ],
+
+  "web_address": "https://{{ key "secrets/directory/guichet/web_hostname" }}",
+  "mail_from": "{{ key "secrets/directory/guichet/mail_from" }}",
+  "smtp_server": "{{ key "secrets/directory/guichet/smtp_server" }}",
+  "smtp_username": "{{ key "secrets/directory/guichet/smtp_user" | trimSpace }}",
+  "smtp_password": "{{ key "secrets/directory/guichet/smtp_pass" | trimSpace }}",
+
+  "admin_account": "cn=admin,{{ key "secrets/directory/ldap_base_dn" }}",
+  "group_can_admin": "cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
+  "group_can_invite": "cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}",
+
+  "s3_endpoint": "{{ key "secrets/directory/guichet/s3_endpoint" }}",
+  "s3_access_key": "{{ key "secrets/directory/guichet/s3_access_key" | trimSpace }}",
+  "s3_secret_key": "{{ key "secrets/directory/guichet/s3_secret_key" | trimSpace }}",
+  "s3_region": "{{ key "secrets/directory/guichet/s3_region" }}",
+  "s3_bucket": "{{ key "secrets/directory/guichet/s3_bucket" }}"
+}
+
-- 
cgit v1.2.3