panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
47 lines
2.5 KiB
YAML
47 lines
2.5 KiB
YAML
---
|
|
# LDAPS certificate for the DC, auto-renewed from OpenBao's internal ACME.
|
|
#
|
|
# WHY: the first bao-issued LDAPS cert (2026-07-25) was placed by hand and expires
|
|
# 2027-07-25 with nothing to renew it. If it lapses, Authelia loses its LDAPS
|
|
# backend and every SSO consumer (Gitea, Grafana, OpenBao's own OIDC login) fails
|
|
# at once — a year later, with no memory of how it got there.
|
|
|
|
# --- lego (ACME client). Same pinned release as openbao_acme, deliberately. ---
|
|
samba_ad_acme_version: "5.3.1"
|
|
samba_ad_acme_checksum: "sha256:b3c71b122ee1947eacfe0b809b955647f6377239fe4bfc49f73b1a091ae1252a"
|
|
samba_ad_acme_url: "https://github.com/go-acme/lego/releases/download/v{{ samba_ad_acme_version }}/lego_v{{ samba_ad_acme_version }}_linux_amd64.tar.gz"
|
|
samba_ad_acme_bin: "/usr/local/bin/lego"
|
|
|
|
# --- Paths ---
|
|
samba_ad_acme_dir: "/etc/samba/acme" # lego state (account + certs)
|
|
samba_ad_acme_tls_dir: "/var/lib/samba/private/tls" # where Samba reads cert/key/ca
|
|
|
|
# --- Identity ---
|
|
samba_ad_acme_domain: "dc1.ad.ddupan.top"
|
|
samba_ad_acme_email: "[email protected]"
|
|
|
|
# OpenBao's ACME directory, pinned to the ROLE-scoped path so issuance is capped by
|
|
# the bao-server role (allowed_domains=ad.ddupan.top) rather than sign-verbatim.
|
|
samba_ad_acme_server: "https://bao.ad.ddupan.top:8200/v1/pki/roles/bao-server/acme/directory"
|
|
|
|
# http-01: lego binds this address only while validating, then releases it. Verified nothing
|
|
# else listens on :80 on the DC, and bao (192.168.10.8) can reach it.
|
|
# NOTE: this yields a cert with a DNS SAN ONLY — no IP SAN, unlike the hand-issued
|
|
# one it replaces. Clients MUST connect as dc1.ad.ddupan.top, not 192.168.10.5.
|
|
# NOTE: lego v5 calls this --http.address (NOT --http.port, which is a v4-ism
|
|
# and fails with "flag provided but not defined"). Mirrors --tls.address.
|
|
samba_ad_acme_http_address: ":80"
|
|
|
|
# OpenBao's ACME caps certificate lifetime (issued cert is ~32 days, NOT the
|
|
# role's 1y max_ttl — ACME deliberately issues short-lived certs). A 30-day
|
|
# threshold against a 32-day cert would try to renew on almost every run, so keep
|
|
# the window well inside the lifetime: renew with ~10 days of headroom.
|
|
samba_ad_acme_renew_days: 10
|
|
samba_ad_acme_renew_oncalendar: "*-*-* 03:42:00"
|
|
|
|
# lego defaults to an EC (P-256) key, but the bao-server PKI role pins
|
|
# key_type=rsa / key_bits=2048, so an EC CSR is rejected at finalize with
|
|
# "badCSR :: refusing to sign CSR: role requires keys of type rsa".
|
|
# Match the role rather than loosening it — the role is what caps ACME issuance.
|
|
samba_ad_acme_key_type: "rsa2048"
|