forbes-0023
fb13795ef7
Add docker-compose.allinone.yaml with five services: - PostgreSQL 16 with auto-applied migrations - MinIO for S3-compatible file storage - OpenLDAP (bitnami/openldap:2.6) with memberOf overlay and preconfigured silo-admins/silo-users/silo-viewers groups - Silo API server built from Dockerfile - Nginx reverse proxy (optional, via --profile nginx) Add scripts/setup-docker.sh interactive helper that generates deployments/.env and deployments/config.docker.yaml with random credentials. Supports --non-interactive for CI. Add deployments/ldap/ LDIF init scripts for memberOf overlay and Silo role groups. Add deployments/nginx/ reverse proxy configs.
35 lines
1.2 KiB
Plaintext
35 lines
1.2 KiB
Plaintext
# Create Silo role groups for LDAP-based access control.
|
|
# These groups map to Silo roles via auth.ldap.role_mapping in config.yaml.
|
|
#
|
|
# Group hierarchy:
|
|
# silo-admins -> admin role (full access)
|
|
# silo-users -> editor role (create/modify items)
|
|
# silo-viewers -> viewer role (read-only)
|
|
#
|
|
# The initial LDAP user (set via LDAP_USERS env var) is added to silo-admins.
|
|
# Additional users can be added with ldapadd or ldapmodify.
|
|
#
|
|
# Loaded automatically by bitnami/openldap from /docker-entrypoint-initdb.d/
|
|
# Note: This runs after the default tree is created (users/groups OUs exist).
|
|
|
|
# Admin group — initial user is a member
|
|
dn: cn=silo-admins,ou=groups,dc=silo,dc=local
|
|
objectClass: groupOfNames
|
|
cn: silo-admins
|
|
description: Silo administrators (full access)
|
|
member: cn=siloadmin,ou=users,dc=silo,dc=local
|
|
|
|
# Editor group
|
|
dn: cn=silo-users,ou=groups,dc=silo,dc=local
|
|
objectClass: groupOfNames
|
|
cn: silo-users
|
|
description: Silo editors (create and modify items)
|
|
member: cn=placeholder,ou=users,dc=silo,dc=local
|
|
|
|
# Viewer group
|
|
dn: cn=silo-viewers,ou=groups,dc=silo,dc=local
|
|
objectClass: groupOfNames
|
|
cn: silo-viewers
|
|
description: Silo viewers (read-only access)
|
|
member: cn=placeholder,ou=users,dc=silo,dc=local
|