2022-07-27 22:57:28 +00:00
|
|
|
job "lldap" {
|
|
|
|
datacenters = ["dc1"]
|
|
|
|
type = "service"
|
2022-11-15 19:43:05 +00:00
|
|
|
priority = 80
|
2022-07-27 22:57:28 +00:00
|
|
|
|
|
|
|
group "lldap" {
|
|
|
|
|
|
|
|
network {
|
|
|
|
mode = "bridge"
|
|
|
|
|
|
|
|
port "web" {
|
2023-08-24 19:36:47 +00:00
|
|
|
%{~ if use_wesher ~}
|
2023-03-24 23:32:37 +00:00
|
|
|
host_network = "wesher"
|
2023-08-24 19:36:47 +00:00
|
|
|
%{~ endif ~}
|
2022-07-27 22:57:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
port "ldap" {
|
2023-08-24 19:36:47 +00:00
|
|
|
%{~ if use_wesher ~}
|
2023-03-24 23:32:37 +00:00
|
|
|
host_network = "wesher"
|
2023-08-24 19:36:47 +00:00
|
|
|
%{~ endif ~}
|
2022-07-27 22:57:28 +00:00
|
|
|
}
|
2023-07-07 00:16:36 +00:00
|
|
|
|
|
|
|
port "tls" {}
|
2022-07-27 22:57:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
service {
|
|
|
|
name = "lldap"
|
2022-11-21 00:24:00 +00:00
|
|
|
provider = "nomad"
|
2022-07-27 22:57:28 +00:00
|
|
|
port = "ldap"
|
|
|
|
}
|
|
|
|
|
2023-07-07 00:16:36 +00:00
|
|
|
service {
|
|
|
|
name = "lldap-tls"
|
|
|
|
provider = "nomad"
|
|
|
|
port = "tls"
|
|
|
|
}
|
|
|
|
|
2022-07-27 22:57:28 +00:00
|
|
|
service {
|
|
|
|
name = "ldap-admin"
|
2022-11-21 00:24:00 +00:00
|
|
|
provider = "nomad"
|
2022-07-27 22:57:28 +00:00
|
|
|
port = "web"
|
|
|
|
|
|
|
|
tags = [
|
|
|
|
"traefik.enable=true",
|
|
|
|
"traefik.http.routers.ldap-admin.entryPoints=websecure",
|
|
|
|
]
|
|
|
|
}
|
|
|
|
|
|
|
|
task "lldap" {
|
|
|
|
driver = "docker"
|
|
|
|
|
|
|
|
config {
|
2023-07-07 00:16:36 +00:00
|
|
|
image = "nitnelave/lldap:latest"
|
2022-07-27 22:57:28 +00:00
|
|
|
ports = ["ldap", "web"]
|
2023-08-24 19:36:47 +00:00
|
|
|
args = ["run", "--config-file", "$${NOMAD_SECRETS_DIR}/lldap_config.toml"]
|
2022-07-27 22:57:28 +00:00
|
|
|
}
|
|
|
|
|
2022-11-16 00:54:37 +00:00
|
|
|
env = {
|
2022-11-15 19:43:05 +00:00
|
|
|
"LLDAP_VERBOSE" = "true"
|
2023-08-24 19:36:47 +00:00
|
|
|
"LLDAP_LDAP_PORT" = "$${NOMAD_PORT_ldap}"
|
|
|
|
"LLDAP_HTTP_PORT" = "$${NOMAD_PORT_web}"
|
2022-11-16 00:54:37 +00:00
|
|
|
}
|
2022-07-27 22:57:28 +00:00
|
|
|
|
|
|
|
template {
|
|
|
|
data = <<EOH
|
2023-07-07 00:16:36 +00:00
|
|
|
ldap_base_dn = "{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}"
|
2023-07-06 00:29:26 +00:00
|
|
|
|
2023-03-24 23:32:37 +00:00
|
|
|
{{ with nomadVar "nomad/jobs/lldap" -}}
|
2023-07-06 00:29:26 +00:00
|
|
|
database_url = "mysql://{{ .db_user }}:{{ .db_pass }}@127.0.0.1:3306/{{ .db_name }}"
|
|
|
|
key_seed = "{{ .key_seed }}"
|
2022-11-21 00:24:00 +00:00
|
|
|
jwt_secret = "{{ .jwt_secret }}"
|
2023-07-06 00:29:26 +00:00
|
|
|
|
2022-11-21 00:24:00 +00:00
|
|
|
ldap_user_dn = "{{ .admin_user }}"
|
|
|
|
ldap_user_email = "{{ .admin_email }}"
|
|
|
|
ldap_user_pass = "{{ .admin_password }}"
|
2023-07-06 00:29:26 +00:00
|
|
|
|
2022-07-27 22:57:28 +00:00
|
|
|
[smtp_options]
|
2023-07-06 00:29:26 +00:00
|
|
|
from = "{{ .smtp_from }}"
|
|
|
|
reply_to = "{{ .smtp_reply_to }}"
|
|
|
|
|
2022-07-27 22:57:28 +00:00
|
|
|
enable_password_reset = true
|
2023-07-06 00:29:26 +00:00
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
# TODO: Better access to SMTP creds using nomad ACLs
|
|
|
|
{{ with nomadVar "nomad/jobs" -}}
|
2022-11-21 00:24:00 +00:00
|
|
|
server = "{{ .smtp_server }}"
|
|
|
|
port = {{ .smtp_port }}
|
2023-03-24 23:32:37 +00:00
|
|
|
tls_required = {{ .smtp_tls.Value | toLower }}
|
2022-11-21 00:24:00 +00:00
|
|
|
user = "{{ .smtp_user }}"
|
|
|
|
password = "{{ .smtp_password }}"
|
2022-07-27 22:57:28 +00:00
|
|
|
{{ end -}}
|
|
|
|
EOH
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_SECRETS_DIR}/lldap_config.toml"
|
2022-07-27 22:57:28 +00:00
|
|
|
change_mode = "restart"
|
|
|
|
}
|
|
|
|
|
|
|
|
resources {
|
|
|
|
cpu = 10
|
2022-11-15 23:54:32 +00:00
|
|
|
memory = 200
|
|
|
|
memory_max = 200
|
2022-07-27 22:57:28 +00:00
|
|
|
}
|
|
|
|
}
|
2023-07-06 00:29:26 +00:00
|
|
|
|
|
|
|
task "bootstrap" {
|
|
|
|
driver = "docker"
|
|
|
|
|
|
|
|
lifecycle {
|
|
|
|
hook = "prestart"
|
|
|
|
sidecar = false
|
|
|
|
}
|
|
|
|
|
|
|
|
config {
|
|
|
|
image = "mariadb:10"
|
|
|
|
args = [
|
|
|
|
"/usr/bin/timeout",
|
|
|
|
"2m",
|
|
|
|
"/bin/bash",
|
|
|
|
"-c",
|
2023-08-24 19:36:47 +00:00
|
|
|
"until /usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql; do sleep 10; done",
|
2023-07-06 00:29:26 +00:00
|
|
|
]
|
|
|
|
}
|
|
|
|
|
|
|
|
template {
|
|
|
|
data = <<EOF
|
|
|
|
[client]
|
|
|
|
host=127.0.0.1
|
|
|
|
port=3306
|
|
|
|
user=root
|
2023-08-29 19:48:48 +00:00
|
|
|
{{ with nomadVar "secrets/mysql" -}}
|
2023-07-06 00:29:26 +00:00
|
|
|
password={{ .mysql_root_password }}
|
|
|
|
{{ end -}}
|
|
|
|
EOF
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_SECRETS_DIR}/my.cnf"
|
2023-07-06 00:29:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
template {
|
|
|
|
data = <<EOF
|
|
|
|
{{ with nomadVar "nomad/jobs/lldap" -}}
|
|
|
|
{{ $db_name := .db_name }}
|
|
|
|
CREATE DATABASE IF NOT EXISTS `{{ .db_name }}`
|
|
|
|
CHARACTER SET = 'utf8mb4'
|
|
|
|
COLLATE = 'utf8mb4_unicode_ci';
|
|
|
|
DROP USER IF EXISTS '{{ .db_user }}'@'%';
|
|
|
|
CREATE USER '{{ .db_user }}'@'%'
|
|
|
|
IDENTIFIED BY '{{ .db_pass }}';
|
|
|
|
GRANT ALL ON `{{ .db_name }}`.*
|
|
|
|
TO '{{ .db_user }}'@'%';
|
|
|
|
{{ else -}}
|
|
|
|
SELECT 'NOOP';
|
|
|
|
{{ end -}}
|
|
|
|
EOF
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_SECRETS_DIR}/bootstrap.sql"
|
2023-07-06 00:29:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
resources {
|
|
|
|
cpu = 50
|
|
|
|
memory = 50
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
task "stunnel" {
|
|
|
|
driver = "docker"
|
|
|
|
|
|
|
|
lifecycle {
|
|
|
|
hook = "prestart"
|
|
|
|
sidecar = true
|
|
|
|
}
|
|
|
|
|
|
|
|
config {
|
|
|
|
image = "alpine:3.17"
|
2023-07-07 00:16:36 +00:00
|
|
|
ports = ["tls"]
|
2023-08-24 19:36:47 +00:00
|
|
|
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
2023-07-06 00:29:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
resources {
|
|
|
|
cpu = 100
|
|
|
|
memory = 100
|
|
|
|
}
|
|
|
|
|
|
|
|
template {
|
|
|
|
data = <<EOF
|
|
|
|
set -e
|
|
|
|
apk add stunnel
|
|
|
|
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
|
|
|
|
EOF
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
2023-07-06 00:29:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
template {
|
|
|
|
data = <<EOF
|
|
|
|
syslog = no
|
|
|
|
foreground = yes
|
|
|
|
delay = yes
|
|
|
|
|
2023-07-07 00:16:36 +00:00
|
|
|
[ldap_server]
|
|
|
|
accept = {{ env "NOMAD_PORT_tls" }}
|
|
|
|
connect = 127.0.0.1:{{ env "NOMAD_PORT_ldap" }}
|
|
|
|
ciphers = PSK
|
|
|
|
PSKsecrets = {{ env "NOMAD_TASK_DIR" }}/stunnel_psk.txt
|
|
|
|
|
2023-07-06 00:29:26 +00:00
|
|
|
[mysql_client]
|
|
|
|
client = yes
|
|
|
|
accept = 127.0.0.1:3306
|
|
|
|
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
|
|
|
|
connect = {{ .Address }}:{{ .Port }}
|
|
|
|
{{- end }}
|
|
|
|
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
|
|
|
|
EOF
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_TASK_DIR}/stunnel.conf"
|
2023-07-06 00:29:26 +00:00
|
|
|
}
|
|
|
|
|
2023-07-07 00:16:36 +00:00
|
|
|
template {
|
|
|
|
data = <<EOF
|
2023-08-29 19:48:48 +00:00
|
|
|
{{ range nomadVarList "secrets/ldap/allowed_psks" -}}
|
|
|
|
{{ with nomadVar .Path }}{{ .psk }}{{ end }}
|
|
|
|
{{ end -}}
|
2023-07-07 00:16:36 +00:00
|
|
|
EOF
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_TASK_DIR}/stunnel_psk.txt"
|
2023-07-07 00:16:36 +00:00
|
|
|
}
|
|
|
|
|
2023-07-06 00:29:26 +00:00
|
|
|
template {
|
|
|
|
data = <<EOF
|
2023-08-29 19:48:48 +00:00
|
|
|
{{- with nomadVar "secrets/mysql/allowed_psks/lldap" }}{{ .psk }}{{ end -}}
|
2023-07-06 00:29:26 +00:00
|
|
|
EOF
|
2023-08-24 19:36:47 +00:00
|
|
|
destination = "$${NOMAD_SECRETS_DIR}/mysql_stunnel_psk.txt"
|
2023-07-06 00:29:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
}
|
2022-07-27 22:57:28 +00:00
|
|
|
}
|
|
|
|
}
|