Skip to content

Commit f567dc5

Browse files
tiredofittiredofit
committed
2.6-8.0.0pre
1 parent 57ac681 commit f567dc5

File tree

6 files changed

+97
-94
lines changed

6 files changed

+97
-94
lines changed

‎README.md‎

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -197,28 +197,31 @@ If you already have a check_password.conf or ppm.conf in /etc/openldap/ the foll
197197

198198
#### TLS options
199199

200-
| Variable | Description | Default |
201-
| ----------------------- | ------------------------------------------------------------------ | ----------------------------------------- |
202-
| `ENABLE_TLS` | Add TLS capabilities. Can't be removed once set to `TRUE`. | `true` |
203-
| `TLS_CA_NAME` | Selfsigned CA Name | `ldap-selfsigned-ca` |
204-
| `TLS_CA_SUBJECT` | Selfsigned CA Subject | `/C=XX/ST=LDAP/L=LDAP/O=LDAP/CN=` |
205-
| `TLS_CA_CRT_SUBJECT` | SelfSigned CA Cert Sujbject | `${TLS_CA_SUBJECT}${TLS_CA_NAME}` |
206-
| `TLS_CA_CRT_FILENAME` | CA Cert filename | `${TLS_CA_AME}.crt` |
207-
| `TLS_CA_KEY_FILENAME` | CA Key filename | `${TLS_CA_NAME}.key` |
208-
| `TLS_CA_CRT_PATH` | CA Certificates path | `/certs/${TLS_CA_NAME}/` |
209-
| `TLS_CIPHER_SUITE` | Cipher Suite to use | `HIGH:!aNULL:!MD5:!3DES:!RC4:!DES:!eNULL` |
210-
| `TLS_CREATE_CA` | Automatically create CA when generating certificates | `TRUE` |
211-
| `TLS_CRT_FILENAME` | TLS cert filename | `cert.pem` |
212-
| `TLS_CRT_PATH` | TLS cert path | `/certs/` |
213-
| `TLS_ENABLE_DH_PARAM` | Enable DH Param Functionality | `TRUE` |
214-
| `TLS_DH_PARAM_FILENAME` | DH Param filename | `dhparam.pem` |
215-
| `TLS_DH_PARAM_KEYSIZE` | Keysize for DH Param | `2048` |
216-
| `TLS_DH_PARAM_PATH` | DH Param path | `/certs/` |
217-
| `TLS_ENFORCE` | Enforce TLS Usage | `FALSE` |
218-
| `TLS_KEY_FILENAME` | TLS Key filename | `key.pem` |
219-
| `TLS_KEY_PATH` | TLS Key path | `/certs/` |
220-
| `TLS_RESET_PERMISSIONS` | Change permissions on certificate directories for OpenLDAP to read | `TRUE` |
221-
| `TLS_VERIFY_CLIENT` | TLS verify client. | `try` |
200+
| Variable | Description | Default |
201+
| ----------------------- | ------------------------------------------------------------------------- | ----------------------------------------- |
202+
| `ENABLE_TLS` | Add TLS capabilities. Can't be removed once set to `TRUE`. | `true` |
203+
| `TLS_CA_NAME` | Selfsigned CA Name | `ldap-selfsigned-ca` |
204+
| `TLS_CA_SUBJECT` | Selfsigned CA Subject | `/C=XX/ST=LDAP/L=LDAP/O=LDAP/CN=` |
205+
| `TLS_CA_CERT_SUBJECT` | SelfSigned CA Cert Sujbject | `${TLS_CA_SUBJECT}${TLS_CA_NAME}` |
206+
| `TLS_CA_CERT_FILENAME` | CA Cert filename | `${TLS_CA_AME}.crt` |
207+
| `TLS_CA_KEY_FILENAME` | CA Key filename | `${TLS_CA_NAME}.key` |
208+
| `TLS_CA_CERT_PATH` | CA Certificates path | `/certs/${TLS_CA_NAME}/` |
209+
| `TLS_CIPHER_SUITE` | Cipher Suite to use | `HIGH:!aNULL:!MD5:!3DES:!RC4:!DES:!eNULL` |
210+
| `TLS_CREATE_SELFSIGNED` | Automatically create locally signed CA, cert and key if they do not exist | `TRUE` |
211+
| `TLS_CERT_FILENAME` | TLS cert filename | `cert.pem` |
212+
| `TLS_CERT_PATH` | TLS cert path | `/certs/` |
213+
| `TLS_ENABLE_DH_PARAM` | Enable DH Param Functionality | `TRUE` |
214+
| `TLS_DH_PARAM_FILENAME` | DH Param filename | `dhparam.pem` |
215+
| `TLS_DH_PARAM_KEYSIZE` | Keysize for DH Param | `2048` |
216+
| `TLS_DH_PARAM_PATH` | DH Param path | `/certs/` |
217+
| `TLS_ENFORCE` | Enforce TLS Usage | `FALSE` |
218+
| `TLS_KEY_FILENAME` | TLS Key filename | `key.pem` |
219+
| `TLS_KEY_PATH` | TLS Key path | `/certs/` |
220+
| `TLS_RESET_PERMISSIONS` | Change permissions on certificate directories for OpenLDAP to read | `TRUE` |
221+
| `TLS_VERIFY_CLIENT` | TLS verify client. | `try` |
222+
223+
>> Changing TLS Options are best done manually upon initial image deployment
224+
222225

223226
Help: http://www.openldap.org/doc/admin26/tls.html
224227

‎examples/compose.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ services:
3333
- READONLY_USER_PASS=reader
3434

3535
- ENABLE_TLS=TRUE
36-
- TLS_CRT_FILENAME=cert.pem
37-
- TLS_KEY_FILENAME=key.pem
36+
- TLS_CERT_FILE=cert.pem
37+
- TLS_KEY_FILE=key.pem
3838
- TLS_ENFORCE=FALSE
3939

4040
- ENABLE_REPLICATION=FALSE

‎rootfs/container/data/openldap/config/tls/tls-enable.ldif‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ replace: olcTLSCipherSuite
44
olcTLSCipherSuite: {{TLS_CIPHER_SUITE}}
55
-
66
replace: olcTLSCACertificateFile
7-
olcTLSCACertificateFile: {{TLS_CA_CRT_PATH}}/{{TLS_CA_CRT_FILENAME}}
7+
olcTLSCACertificateFile: {{TLS_CA_CERT_PATH}}/{{TLS_CA_CERT_FILE}}
88
-
99
replace: olcTLSCertificateFile
10-
olcTLSCertificateFile: {{TLS_CRT_PATH}}/{{TLS_CRT_FILENAME}}
10+
olcTLSCertificateFile: {{TLS_CERT_PATH}}/{{TLS_CERT_FILE}}
1111
-
1212
replace: olcTLSCertificateKeyFile
13-
olcTLSCertificateKeyFile: {{TLS_KEY_PATH}}/{{TLS_KEY_FILENAME}}
13+
olcTLSCertificateKeyFile: {{TLS_KEY_PATH}}/{{TLS_KEY_FILE}}
1414
{{TLS_DH_PARAM_LDIF_ENABLE}}
1515
replace: olcTLSVerifyClient
1616
olcTLSVerifyClient: {{TLS_VERIFY_CLIENT}}

‎rootfs/container/defaults/10-openldap‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,21 +56,21 @@ SLAPD_HOSTS=${SLAPD_HOSTS:-"ldap://$HOSTNAME ldaps://$HOSTNAME ldapi:///"}
5656
#
5757
TLS_CA_NAME=${TLS_CA_NAME:-"ldap-nfrastack"}
5858
TLS_CA_SUBJECT=${TLS_CA_SUBJECT:-"/C=XX/ST=LDAP/L=LDAP/O=LDAP/CN="}
59-
TLS_CA_CRT_SUBJECT=${TLS_CA_CRT_SUBJECT:-"${TLS_CA_SUBJECT}${TLS_CA_NAME}"}
60-
TLS_CA_CRT_FILENAME=${TLS_CA_CRT_FILENAME:-"${TLS_CA_NAME}.crt"}
61-
TLS_CA_KEY_FILENAME=${TLS_CA_KEY_FILENAME:-"${TLS_CA_NAME}.key"}
62-
TLS_CA_CRT_PATH=${TLS_CA_CRT_PATH:-"/certs/${TLS_CA_NAME}/"}
59+
TLS_CA_CERT_SUBJECT=${TLS_CA_CERT_SUBJECT:-"${TLS_CA_SUBJECT}${TLS_CA_NAME}"}
60+
TLS_CA_CERT_FILE=${TLS_CA_CERT_FILE:-"${TLS_CA_NAME}.crt"}
61+
TLS_CA_KEY_FILE=${TLS_CA_KEY_FILE:-"${TLS_CA_NAME}.key"}
62+
TLS_CA_CERT_PATH=${TLS_CA_CERT_PATH:-"/certs/${TLS_CA_NAME}/"}
6363
#
6464
TLS_CIPHER_SUITE=${TLS_CIPHER_SUITE:-"HIGH:!aNULL:!MD5:!3DES:!RC4:!DES:!eNULL"}
6565
TLS_CREATE_CA=${TLS_CREATE_CA:-"TRUE"}
66-
TLS_CRT_FILENAME=${TLS_CRT_FILENAME:-"cert.pem"}
67-
TLS_CRT_PATH=${TLS_CRT_PATH:-"/certs/"}
68-
TLS_DH_PARAM_FILENAME=${TLS_DH_PARAM_FILENAME:-"dhparam.pem"}
66+
TLS_CERT_FILE=${TLS_CERT_FILE:-"cert.pem"}
67+
TLS_CERT_PATH=${TLS_CERT_PATH:-"/certs/"}
68+
TLS_DH_PARAM_FILE=${TLS_DH_PARAM_FILE:-"dhparam.pem"}
6969
TLS_DH_PARAM_KEYSIZE=${TLS_DH_PARAM_KEYSIZE:-2048}
7070
TLS_DH_PARAM_PATH=${TLS_DH_PARAM_PATH:-"/certs/"}
7171
TLS_ENFORCE=${TLS_ENFORCE:-"FALSE"}
7272
TLS_ENABLE_DH_PARAM=${TLS_ENABLE_DH_PARAM:-"TRUE"}
73-
TLS_KEY_FILENAME=${TLS_KEY_FILENAME:-"key.pem"}
73+
TLS_KEY_FILE=${TLS_KEY_FILE:-"key.pem"}
7474
TLS_KEY_PATH=${TLS_KEY_PATH:-"/certs/"}
7575
TLS_RESET_PERMISSIONS=${TLS_RESET_PERMISSIONS:-"TRUE"}
7676
TLS_VERIFY_CLIENT=${TLS_VERIFY_CLIENT:-"try"}

0 commit comments

Comments
 (0)