lukas
5aa85b0920
Move all hardcoded credentials out of tracked compose/env files into the
git-crypt-encrypted secrets/ directory, using each app's supported mechanism:
- env_file -> secrets/*.env: mealie, navidrome, karakeep, meilisearch,
baserow, maloja, valheim, photoprism, komf, openldap, penpot, vaultwarden
- file:///run/secrets: authentik email password
- jelu DB password appended to existing secrets/jelu.env
Untrack root .env (interpolated ${VAR} secrets) and add sanitized
.env.example template; gitignore /.env.
Move unreferenced orphan files (mediawiki/rtorrent/snibox .env) into
secrets/ to preserve values while encrypting them.
Add SECURITY.md documenting the secrets conventions and a rotation
checklist. NOTE: all migrated values remain in prior git history and
must be rotated at their providers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
27 lines
770 B
YAML
27 lines
770 B
YAML
---
|
|
services:
|
|
openldap:
|
|
image: osixia/openldap:latest
|
|
container_name: openldap
|
|
networks:
|
|
public:
|
|
ipv4_address: 192.168.240.42
|
|
ports:
|
|
- 389:389
|
|
- 636:636
|
|
volumes:
|
|
- "${DOCKER_STORAGE_PATH}/openldap/config:/etc/ldap/slapd.d"
|
|
- "${DOCKER_STORAGE_PATH}/openldap/data:/var/lib/ldap"
|
|
env_file:
|
|
- ../secrets/openldap.env
|
|
environment:
|
|
- LDAP_ORGANISATION=Homelab
|
|
- LDAP_DOMAIN=${DOMAIN}
|
|
# LDAP_ADMIN_PASSWORD provided via secrets/openldap.env
|
|
- LDAP_OPENLDAP_UID=${PUID}
|
|
- LDAP_OPENLDAP_GID=${PGID}
|
|
- LDAP_READONLY_USER=true
|
|
- LDAP_READONLY_USER_USERNAME=readonly
|
|
# LDAP_READONLY_USER_PASSWORD provided via secrets/openldap.env
|
|
restart: unless-stopped
|