-
Notifications
You must be signed in to change notification settings - Fork 978
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'release-1.4.0' into stable
- Loading branch information
Showing
17 changed files
with
193 additions
and
60 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,3 @@ | ||
| .DS_Store | ||
| !/.git* | ||
| /VOLUMES |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,7 +4,7 @@ | |
|  | ||
|  | ||
|
|
||
| Latest release: 1.3.0 - OpenLDAP 2.4.48 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/) | ||
| Latest release: 1.4.0 - OpenLDAP 2.4.50 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/) | ||
|
|
||
| **A docker image to run OpenLDAP.** | ||
|
|
||
|
|
@@ -19,6 +19,7 @@ Latest release: 1.3.0 - OpenLDAP 2.4.48 - [Changelog](CHANGELOG.md) | [Docker H | |
| - [Data persistence](#data-persistence) | ||
| - [Edit your server configuration](#edit-your-server-configuration) | ||
| - [Seed ldap database with ldif](#seed-ldap-database-with-ldif) | ||
| - [Seed from internal path](#seed-from-internal-path) | ||
| - [Use an existing ldap database](#use-an-existing-ldap-database) | ||
| - [Backup](#backup) | ||
| - [Administrate your ldap server](#administrate-your-ldap-server) | ||
|
|
@@ -38,7 +39,7 @@ Latest release: 1.3.0 - OpenLDAP 2.4.48 - [Changelog](CHANGELOG.md) | [Docker H | |
| - [Docker Secrets](#docker-secrets) | ||
| - [Make your own image or extend this image](#make-your-own-image-or-extend-this-image) | ||
| - [Advanced User Guide](#advanced-user-guide) | ||
| - [Extend osixia/openldap:1.3.0 image](#extend-osixiaopenldap130-image) | ||
| - [Extend osixia/openldap:1.4.0 image](#extend-osixiaopenldap140-image) | ||
| - [Make your own openldap image](#make-your-own-openldap-image) | ||
| - [Tests](#tests) | ||
| - [Kubernetes](#kubernetes) | ||
|
|
@@ -58,11 +59,11 @@ If you find this image useful here's how you can help: | |
| ## Quick Start | ||
| Run OpenLDAP docker image: | ||
|
|
||
| docker run --name my-openldap-container --detach osixia/openldap:1.3.0 | ||
| docker run --name my-openldap-container --detach osixia/openldap:1.4.0 | ||
|
|
||
| Do not forget to add the port mapping for both port 389 and 636 if you wish to access the ldap server from another machine. | ||
|
|
||
| docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.3.0 | ||
| docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.4.0 | ||
|
|
||
| Either command starts a new container with OpenLDAP running inside. Let's make the first search in our LDAP container: | ||
|
|
||
|
|
@@ -98,7 +99,7 @@ It will create an empty ldap for the company **Example Inc.** and the domain **e | |
| By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example: | ||
|
|
||
| docker run --env LDAP_ORGANISATION="My Company" --env LDAP_DOMAIN="my-company.com" \ | ||
| --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.3.0 | ||
| --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.4.0 | ||
|
|
||
| #### Data persistence | ||
|
|
||
|
|
@@ -120,6 +121,14 @@ For more information about docker data volume, please refer to: | |
|
|
||
| > [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/) | ||
| #### Firewall issues on RHEL/CentOS | ||
| Docker Engine doesn't work well with firewall-cmd and can cause issues if you're connecting to the LDAP server from another container on the same machine. You can fix this by running: | ||
| ``` | ||
| $ firewall-cmd --add-port=389/tcp --permanent | ||
| $ firewall-cmd --add-port=636/tcp --permanent | ||
| $ firewall-cmd --reload | ||
| ``` | ||
| Learn more about this issue at https://github.com/moby/moby/issues/32138 | ||
|
|
||
| #### Edit your server configuration | ||
|
|
||
|
|
@@ -149,12 +158,30 @@ argument to entrypoint if you don't want to overwrite them. | |
| # single file example: | ||
| docker run \ | ||
| --volume ./bootstrap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/50-bootstrap.ldif \ | ||
| osixia/openldap:1.3.0 --copy-service | ||
| osixia/openldap:1.4.0 --copy-service | ||
|
|
||
| #directory example: | ||
| docker run \ | ||
| --volume ./ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom \ | ||
| osixia/openldap:1.3.0 --copy-service | ||
| osixia/openldap:1.4.0 --copy-service | ||
|
|
||
| #### Seed from internal path | ||
|
|
||
| This image can load ldif and schema files at startup from an internal path. This is useful if a continuous integration service mounts automatically the working copy (sources) into a docker service, which has a relation to the ci job. | ||
|
|
||
| For example: Gitlab is not capable of mounting custom paths into docker services of a ci job, but gitlab automatically mounts the working copy in every service container. So the working copy (sources) are accessible under `/builds` in every services | ||
| of a ci job. The path to the working copy can be obtained via `${CI_PROJECT_DIR}`. See also: https://docs.gitlab.com/runner/executors/docker.html#build-directory-in-service | ||
|
|
||
| This may also work with other CI services, if they automatically mount the working directory to the services of a ci job like gitlab ci does. | ||
|
|
||
| In order to seed ldif or schema files from internal path you must set the specific environment variable `LDAP_SEED_INTERNAL_LDIF_PATH` and/or `LDAP_SEED_INTERNAL_SCHEMA_PATH`. If set this will copy any *.ldif or *.schema file into the default seeding | ||
| directories of this image. | ||
|
|
||
| Example variables defined in gitlab-ci.yml: | ||
|
|
||
| variables: | ||
| LDAP_SEED_INTERNAL_LDIF_PATH: "${CI_PROJECT_DIR}/docker/openldap/ldif" | ||
| LDAP_SEED_INTERNAL_SCHEMA_PATH: "${CI_PROJECT_DIR}/docker/openldap/schema" | ||
|
|
||
| ### Use an existing ldap database | ||
|
|
||
|
|
@@ -165,7 +192,7 @@ simply mount this directories as a volume to `/var/lib/ldap` and `/etc/ldap/slap | |
|
|
||
| docker run --volume /data/slapd/database:/var/lib/ldap \ | ||
| --volume /data/slapd/config:/etc/ldap/slapd.d \ | ||
| --detach osixia/openldap:1.3.0 | ||
| --detach osixia/openldap:1.4.0 | ||
|
|
||
| You can also use data volume containers. Please refer to: | ||
| > [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/) | ||
|
|
@@ -185,7 +212,7 @@ If you are looking for a simple solution to administrate your ldap server you ca | |
| #### Use auto-generated certificate | ||
| By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org). | ||
|
|
||
| docker run --hostname ldap.my-company.com --detach osixia/openldap:1.3.0 | ||
| docker run --hostname ldap.my-company.com --detach osixia/openldap:1.4.0 | ||
|
|
||
| #### Use your own certificate | ||
|
|
||
|
|
@@ -195,24 +222,24 @@ You can set your custom certificate at run time, by mounting a directory contain | |
| --env LDAP_TLS_CRT_FILENAME=my-ldap.crt \ | ||
| --env LDAP_TLS_KEY_FILENAME=my-ldap.key \ | ||
| --env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \ | ||
| --detach osixia/openldap:1.3.0 | ||
| --detach osixia/openldap:1.4.0 | ||
|
|
||
| Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide) | ||
|
|
||
| #### Disable TLS | ||
| Add --env LDAP_TLS=false to the run command: | ||
|
|
||
| docker run --env LDAP_TLS=false --detach osixia/openldap:1.3.0 | ||
| docker run --env LDAP_TLS=false --detach osixia/openldap:1.4.0 | ||
|
|
||
| ### Multi master replication | ||
| Quick example, with the default config. | ||
|
|
||
| #Create the first ldap server, save the container id in LDAP_CID and get its IP: | ||
| LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.3.0) | ||
| LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.4.0) | ||
| LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID) | ||
|
|
||
| #Create the second ldap server, save the container id in LDAP2_CID and get its IP: | ||
| LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.3.0) | ||
| LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.4.0) | ||
| LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID) | ||
|
|
||
| #Add the pair "ip hostname" to /etc/hosts on each containers, | ||
|
|
@@ -248,7 +275,7 @@ You may have some problems with mounted files on some systems. The startup scrip | |
|
|
||
| To fix that run the container with `--copy-service` argument : | ||
|
|
||
| docker run [your options] osixia/openldap:1.3.0 --copy-service | ||
| docker run [your options] osixia/openldap:1.4.0 --copy-service | ||
|
|
||
| ### Debug | ||
|
|
||
|
|
@@ -257,11 +284,11 @@ Available levels are: `none`, `error`, `warning`, `info`, `debug` and `trace`. | |
|
|
||
| Example command to run the container in `debug` mode: | ||
|
|
||
| docker run --detach osixia/openldap:1.3.0 --loglevel debug | ||
| docker run --detach osixia/openldap:1.4.0 --loglevel debug | ||
|
|
||
| See all command line options: | ||
|
|
||
| docker run osixia/openldap:1.3.0 --help | ||
| docker run osixia/openldap:1.4.0 --help | ||
|
|
||
|
|
||
| ## Environment Variables | ||
|
|
@@ -327,7 +354,7 @@ Replication options: | |
|
|
||
| If you want to set this variable at docker run command add the tag `#PYTHON2BASH:` and convert the yaml in python: | ||
|
|
||
| docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.3.0 | ||
| docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.4.0 | ||
|
|
||
| To convert yaml to python online: http://yaml-online-parser.appspot.com/ | ||
|
|
||
|
|
@@ -340,6 +367,8 @@ Other environment variables: | |
| - **LDAP_SSL_HELPER_PREFIX**: ssl-helper environment variables prefix. Defaults to `ldap`, ssl-helper first search config from LDAP_SSL_HELPER_* variables, before SSL_HELPER_* variables. | ||
| - **HOSTNAME**: set the hostname of the running openldap server. Defaults to whatever docker creates. | ||
| - **DISABLE_CHOWN**: do not perform any chown to fix file ownership. Defaults to `false` | ||
| - LDAP_OPENLDAP_UID: runtime docker user uid to run container as | ||
| - LDAP_OPENLDAP_GID: runtime docker user gid to run container as | ||
|
|
||
|
|
||
| ### Set your own environment variables | ||
|
|
@@ -348,7 +377,7 @@ Other environment variables: | |
| Environment variables can be set by adding the --env argument in the command line, for example: | ||
|
|
||
| docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \ | ||
| --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.3.0 | ||
| --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.4.0 | ||
|
|
||
| Be aware that environment variable added in command line will be available at any time | ||
| in the container. In this example if someone manage to open a terminal in this container | ||
|
|
@@ -359,14 +388,14 @@ he will be able to read the admin password in clear text from environment variab | |
| For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment | ||
|
|
||
| docker run --volume /data/ldap/environment:/container/environment/01-custom \ | ||
| --detach osixia/openldap:1.3.0 | ||
| --detach osixia/openldap:1.4.0 | ||
|
|
||
| Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE). | ||
|
|
||
| Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**: | ||
|
|
||
| docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \ | ||
| --detach osixia/openldap:1.3.0 | ||
| --detach osixia/openldap:1.4.0 | ||
|
|
||
| #### Docker Secrets | ||
|
|
||
|
|
@@ -385,13 +414,13 @@ This is the best solution if you have a private registry. Please refer to the [A | |
|
|
||
| ## Advanced User Guide | ||
|
|
||
| ### Extend osixia/openldap:1.3.0 image | ||
| ### Extend osixia/openldap:1.4.0 image | ||
|
|
||
| If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image. | ||
|
|
||
| Dockerfile example: | ||
|
|
||
| FROM osixia/openldap:1.3.0 | ||
| FROM osixia/openldap:1.4.0 | ||
| MAINTAINER Your Name <[email protected]> | ||
|
|
||
| ADD bootstrap /container/service/slapd/assets/config/bootstrap | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| FROM osixia/openldap:1.3.0 | ||
| FROM osixia/openldap:1.4.0 | ||
| MAINTAINER Your Name <[email protected]> | ||
|
|
||
| ADD bootstrap /container/service/slapd/assets/config/bootstrap | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.