b633fe5b4d
Codex bootstrapped this as an uncommitted, parallel identity/control plane under domain2 (lukasrosier.com) alongside the router migration; committing it now that it's been exercised together this session: - LLDAP admin login verified against a freshly rotated, pinix-only admin secret (pinixLldapAdmin.age, distinct from the lldapAdmin secret shared with blunix -- rotating one no longer risks the other). - Dex OIDC discovery and the LDAP connector work end-to-end through Traefik (dex.lukasrosier.com, head.lukasrosier.com). - Headscale's OIDC `allowed_groups` gate is intentionally not set yet: any account in this still-empty LLDAP directory may register a node for now. Re-add the "intern" gate once real accounts exist and the bootstrap is done. - tnix successfully joined headscale-pinix via a pre-auth key as a second, parallel tailscale identity (not yet made declarative). Not committed: tailnet-dns.nix (a separate, more speculative netns'd resolver experiment for this tailnet, untouched today) and its default.nix import. This remains a parallel control plane during bootstrap -- see docs/pinix-identity-stack.md. tailscale.nix on tnix/pinix, the existing blunix-controlled tailnet, and 0ff.space DNS are unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5FvfdKcQjEFQ4aLrepcS1
8 lines
319 B
Bash
8 lines
319 B
Bash
# Render a systemd EnvironmentFile; never source the result as shell code.
|
|
# A trailing newline in an agenix password file is not part of the password.
|
|
set -eu
|
|
umask 077
|
|
password=$(cat "$1")
|
|
escaped=$(printf '%s' "$password" | sed 's/\\/\\\\/g; s/"/\\"/g')
|
|
printf 'LDAP_BIND_PW="%s"\n' "$escaped" > "$2"
|
|
chmod 600 "$2"
|