KAZ/KazV2
11
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

ldap: autoriser ldaps via traefik

Browse Source
This commit is contained in:
Fanch
2025-11-19 10:30:05 +01:00
parent 5dc5155c53
commit 5e858b86f3
3 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
dockers/ldap/docker-compose.yml
View File

@@ -68,6 +68,16 @@ services:
- /etc/timezone:/etc/timezone:ro - /etc/timezone:/etc/timezone:ro
networks: networks:
- ldapNet - ldapNet
labels:
- "traefik.enable=true"
- "traefik.tcp.routers.${ldapServName}.rule=HostSNI(`ldap.${domain}`)"
- "traefik.tcp.routers.${ldapServName}.entrypoints=ldapsecure"
- "traefik.tcp.routers.${ldapServName}.tls=true"
- "traefik.tcp.routers.${ldapServName}.tls.domains[0].main=ldap.${domain}"
- "traefik.tcp.routers.${ldapServName}.tls.certResolver=letsencrypt"
- "traefik.tcp.routers.${ldapServName}.middlewares=ldap-ip-allowlist@file"
- "traefik.tcp.services.${ldapServName}.loadbalancer.server.port=389"
- "traefik.docker.network=ldapNet"
volumes: volumes:
openldapData: openldapData:

7
dockers/traefik/conf/allow_ip.yml.dist
View File

@@ -9,3 +9,10 @@ http:
ipallowlist: ipallowlist:
sourceRange: sourceRange:
- "127.0.0.1" - "127.0.0.1"
tcp:
middlewares:
ldap-ip-allowlist:
ipAllowList:
sourceRange:
- "127.0.0.1"

2
dockers/traefik/docker-compose.tmpl.yml.dist
View File

@@ -7,6 +7,7 @@ services:
ports: ports:
- ${MAIN_IP}:80:80 - ${MAIN_IP}:80:80
- ${MAIN_IP}:443:443 - ${MAIN_IP}:443:443
- ${MAIN_IP}:636:636
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro
- ./conf:/etc/traefik/ - ./conf:/etc/traefik/
@@ -24,6 +25,7 @@ services:
- TRAEFIK_ENTRYPOINTS_websecure_HTTP_MIDDLEWARES=hsts@file,test-ipallowlist@file - TRAEFIK_ENTRYPOINTS_websecure_HTTP_MIDDLEWARES=hsts@file,test-ipallowlist@file
- TRAEFIK_ENTRYPOINTS_websecure_TRANSPORT_RESPONDINGTIMEOUTS_READTIMEOUT=600 - TRAEFIK_ENTRYPOINTS_websecure_TRANSPORT_RESPONDINGTIMEOUTS_READTIMEOUT=600
- TRAEFIK_ENTRYPOINTS_websecure_TRANSPORT_RESPONDINGTIMEOUTS_IDLETIMEOUT=600 - TRAEFIK_ENTRYPOINTS_websecure_TRANSPORT_RESPONDINGTIMEOUTS_IDLETIMEOUT=600
- TRAEFIK_ENTRYPOINTS_ldapsecure_ADDRESS=:636
- TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_EMAIL=admin@${domain} - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_EMAIL=admin@${domain}
- TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_CASERVER=${acme_server} - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_CASERVER=${acme_server}
- TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_STORAGE=/letsencrypt/acme.json - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_STORAGE=/letsencrypt/acme.json