panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
74 lines
3.5 KiB
YAML
74 lines
3.5 KiB
YAML
---
|
|
# Authenticate PVE users against Samba AD over verified LDAPS.
|
|
#
|
|
# WHY the AD realm and not OIDC: PVE's `ad`/`ldap` realms support a real user +
|
|
# group SYNC (pveum realm sync), so permissions can be granted to a group BEFORE
|
|
# anyone logs in, and username+password works for the API/CLI (Terraform,
|
|
# pvesh). PVE's OIDC realm only creates users on first browser login and cannot
|
|
# do non-interactive auth. Authelia OIDC can be added later as an EXTRA realm
|
|
# for convenient SSO; it is not a replacement.
|
|
|
|
pve_auth_realm: ad # users appear as <user>@ad
|
|
pve_auth_domain: ad.ddupan.top
|
|
|
|
# MUST be the hostname, NEVER 192.168.10.5: the DC's LDAPS cert is issued by
|
|
# OpenBao ACME with a DNS SAN only (no IP SAN), so verification fails by IP with
|
|
# "IP address mismatch". Verified 2026-07-25.
|
|
pve_auth_server1: dc1.ad.ddupan.top
|
|
pve_auth_port: 636
|
|
pve_auth_mode: ldaps # `--secure` is DEPRECATED in favour of this
|
|
|
|
# The whole point of trusting the internal CA on these nodes (role pve_ca_trust):
|
|
# PVE defaults --verify to 0, i.e. it does NOT check the DC's certificate, which
|
|
# makes the directory bind trivially MITM-able on a flat LAN. capath's default
|
|
# (/etc/ssl/certs) already contains the hashed internal CA.
|
|
pve_auth_verify: 1
|
|
pve_auth_capath: /etc/ssl/certs
|
|
|
|
pve_auth_base_dn: "DC=ad,DC=ddupan,DC=top"
|
|
pve_auth_bind_dn: "CN=svc-pve,CN=Users,DC=ad,DC=ddupan,DC=top"
|
|
# Read-only bind account created by samba-ad (samba_ad_service_accounts).
|
|
pve_auth_bind_password: "{{ vault_pve_bind_password | default('') }}"
|
|
|
|
# AD logon name. Without this PVE would try the default LDAP `uid`, which AD
|
|
# does not populate.
|
|
pve_auth_user_attr: sAMAccountName
|
|
# AD stores users AND groups under CN=Users by default (not an OU).
|
|
pve_auth_group_dn: "CN=Users,DC=ad,DC=ddupan,DC=top"
|
|
pve_auth_group_classes: group
|
|
pve_auth_user_classes: user
|
|
|
|
# Only sync real, ENABLED people — not service or system accounts.
|
|
# The userAccountControl bit-AND rule (1.2.840.113556.1.4.803 := 2) excludes
|
|
# DISABLED accounts, which is what keeps AD's built-in `Guest` and `krbtgt` out.
|
|
# Filtering on name alone let both through on the first sync.
|
|
pve_auth_filter: >-
|
|
(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(sAMAccountName=svc-*)))
|
|
|
|
# Only groups this cluster actually uses for RBAC. `(objectClass=group)` pulls in
|
|
# every builtin AD group: PVE rejects most outright ("group name 'Domain Users-ad'
|
|
# contains invalid characters" — spaces are illegal in PVE group IDs) and imports
|
|
# the rest as clutter (DnsAdmins-ad, DnsUpdateProxy-ad). Convention: name any
|
|
# group PVE should see `pve-*`.
|
|
pve_auth_group_filter: "(&(objectClass=group)(cn=pve-*))"
|
|
pve_auth_sync_attributes: "email=mail,firstname=givenName,lastname=sn"
|
|
|
|
# AD logon names are case-insensitive; PVE defaults to case-sensitive, which
|
|
# means Panxiao81 and panxiao81 would become two different PVE users.
|
|
pve_auth_case_sensitive: 0
|
|
|
|
# remove-vanished: 'none' on purpose. Anything stronger lets a transient LDAP
|
|
# hiccup delete users, their properties, or their ACLs from a live cluster.
|
|
pve_auth_sync_defaults: "scope=both,enable-new=1,remove-vanished=none"
|
|
|
|
# --- scheduled sync ---
|
|
pve_auth_sync_job: pve-ad-sync
|
|
pve_auth_sync_schedule: "*-*-* 04:11:00"
|
|
|
|
# --- RBAC ---
|
|
# PVE RENAMES synced groups to "<name>-<realm>", so AD's pve-admins becomes
|
|
# pve-admins-ad. Granting the ACL to "pve-admins" would silently match nothing.
|
|
pve_auth_admin_group: "pve-admins-{{ pve_auth_realm }}"
|
|
pve_auth_admin_role: Administrator
|
|
pve_auth_admin_path: /
|