forked from ungleich-public/ungleich-user
Sajeyks
b9c043dcd4
Production and the client's test server use ldaps://, so the dev server now offers TLS as well: ldaps on 636 (localhost:3636) and StartTLS on 389, with both ports also published on [::1]. A throwaway CA and server certificate are generated on every start, with the full CA extensions that Python 3.13+ strict verification requires. The CA certificate is copied to dev/ldap/export/ca.crt (gitignored). The server certificate covers localhost, the service names and ::1, but not 127.0.0.1, so tests can show that hostname mismatches are rejected.
24 lines
861 B
Docker
24 lines
861 B
Docker
# Local OpenLDAP for development and tests only. Not for production.
|
|
#
|
|
# Alpine 3.24 ships OpenLDAP 2.6.15. No sshd is installed here; the
|
|
# "openssh-lpk" bit below is only an LDAP schema for the ldapPublicKey
|
|
# objectClass that the app writes.
|
|
FROM alpine:3.24
|
|
|
|
RUN apk add --no-cache \
|
|
openldap \
|
|
openldap-back-mdb \
|
|
openldap-clients \
|
|
openssl \
|
|
&& mkdir -p /run/openldap /var/lib/openldap/openldap-data /etc/openldap/slapd.d \
|
|
&& rm -rf /etc/openldap/slapd.conf /etc/openldap/slapd.ldif
|
|
|
|
COPY config.ldif openssh-lpk.ldif seed.ldif /bootstrap/
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
EXPOSE 389 636
|
|
HEALTHCHECK --interval=5s --timeout=3s --retries=10 \
|
|
CMD ldapsearch -x -H ldap://localhost -b "" -s base namingContexts | grep -q "dc=ungleich,dc=ch" || exit 1
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|