only expose ldaps on rfc intranets

This commit is contained in:
Elizabeth Hunt 2024-03-25 13:43:12 -04:00
parent ba6e89a0dc
commit 40523baacc
5 changed files with 13 additions and 4 deletions

View File

@ -1,3 +1,4 @@
--- ---
kanidm_domain: auth.hatecomputers.club kanidm_domain: auth.hatecomputers.club
kanidm_bind_address: "{{ lookup('community.general.dig', inventory_hostname) }}"

View File

@ -5,7 +5,11 @@ postmaster_email: postmaster@hatecomputers.club
domain: hatecomputers.club domain: hatecomputers.club
mail_domain: mail.hatecomputers.club mail_domain: mail.hatecomputers.club
ldap_server_host: "ldaps://auth.hatecomputers.club:3636" ldap_server: "auth.hatecomputers.club"
ldap_server_host: "ldaps://{{ ldap_server }}:3636"
ldap_intranet: >
{{ lookup('community.general.dig',
'auth.int.infra.hatecomputers.club') }}
ldap_search_base: "dc=auth,dc=hatecomputers,dc=club" ldap_search_base: "dc=auth,dc=hatecomputers,dc=club"
ldap_bind_dn: "dn=token" ldap_bind_dn: "dn=token"

View File

@ -32,11 +32,13 @@
group: root group: root
mode: 0755 mode: 0755
- name: Allow all LDAPS connections from everywhere - name: Allow LDAPS from rfc1918 networks
ansible.builtin.ufw: loop: "{{ rfc1918_networks }}"
community.general.ufw:
rule: allow rule: allow
proto: tcp proto: tcp
port: '3636' port: '3636'
from: "{{ item }}"
- name: Enable kanidm - name: Enable kanidm
ansible.builtin.systemd_service: ansible.builtin.systemd_service:

View File

@ -10,4 +10,4 @@ services:
- /etc/letsencrypt:/certs:ro - /etc/letsencrypt:/certs:ro
ports: ports:
- 127.0.0.1:8443:8443 - 127.0.0.1:8443:8443
- 0.0.0.0:3636:3636 - {{ kanidm_bind_address }}:3636:3636

View File

@ -64,3 +64,5 @@ services:
- ENABLE_OAUTH2=1 - ENABLE_OAUTH2=1
- OAUTH2_INTROSPECTION_URL={{ roundcube_oauth2_user_uri }} - OAUTH2_INTROSPECTION_URL={{ roundcube_oauth2_user_uri }}
extra_hosts:
- {{ ldap_server }}:{{ ldap_intranet}}