Latest revision as of 21:48, 6 September 2024

LDAP

Participants	Fwd
Skills	Linux, FreeIPA
Status	Implemented
Niche	Software
Purpose	Infrastructure
Tool	Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

We are currently running on FreeIPA.

Connected machines and services

Virtual Machines

You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.

services-1.lan.nurd.space
services-2.lan.nurd.space
gitlab.vm.nurd.space
minio.vm.nurd.space
navi.vm.nurd.space
gh-runner-almalinux.vm.nurd.space
gh-runner-debian.vm.nurd.space

All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.

TODO: Make this available for members without BOFH being involved.

Wiki

Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.

Gitlab

See our Gitlab instance

Wifi (Spacenet)

TODO: Is broken as of now

DHCP

See the network page.

(Un)locking the front door

See the Door lock page.

@@ Line 1: / Line 1: @@
-For use with [[SpaceNet]] we've installed OpenLDAP on [[nurdserver]]. We can use this LDAP for many more purposes. This page can serve as documentation for both working implementations and future plans.
+{{Project
+|Name=LDAP
+|Skills=Linux, FreeIPA
+|Status=Implemented
+|Niche=Software
+|Purpose=Infrastructure
+|Tool=Yes
+}}
+= Status =
-= Working implementations =
+We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]].
-* [[Spacenet]]
-* Samba on [[NURDServer]]
-* vsFTPd on [[NURDServer]]
-= Future plans =
+= Connected machines and services =
-* [[wiki]] logins
-* NFS for homedirs and other dirs (MP3 etc) on [[NURDServer]]
-* System users for all [[infra]]-machines
-* Maintain sudo'ers through the LDAP and remove all local root accounts
-= Status of future plans =
+== Virtual Machines ==
-I've installed [http://fusiondirectory.org FusionDirectory] on a new VM called nurdservices on the proxmox system of [[NURDserver_v2|Nurdserver v2]]. Now I need to add all users into it.
-It can be accessed on http://nurdservices/fusiondirectory from within the network.
+You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.
-= Logging in to workstations with LDAP users =
+* services-1.lan.nurd.space
-To get this to work you need to install libnss-ldapd, configure the ldap in nss and pam (no ssl, so ldap://nurdservices/), and add a line to /etc/pam.d/common-account:
+* services-2.lan.nurd.space
+* gitlab.vm.nurd.space
+* minio.vm.nurd.space
+* navi.vm.nurd.space
+* gh-runner-almalinux.vm.nurd.space
+* gh-runner-debian.vm.nurd.space
-<code>
+All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.
-session    required   pam_mkhomedir.so skel=/etc/skel/ umask=0022
-</code>
+TODO: Make this available for members without BOFH being involved.
+== Wiki ==
+Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.
+== Gitlab ==
+See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]]
+== Wifi (Spacenet) ==
+TODO: Is broken as of now
+== DHCP ==
+See the [[Network|network page]].
+== (Un)locking the front door ==
+See the [[Network/Services/DoorLock|Door lock page]].