svg

services/10-nineapache/dockercompose/dockercompose.yml

@@ -0,0 +1,19 @@
+
+  # Nineapache
+  # Reverse proxy de l'ensemble des services
+  # Seul port ouvert sur l'exterieur
+  nineapache:
+    image: reg.cadoles.com/envole/nineapache:8.1
+    container_name: nine-nineapache
+    restart: unless-stopped
+    healthcheck:
+      test: curl --fail http://localhost || exit 1
+      interval: 1s
+      timeout: 60s      
+    env_file: ./services/10-nineapache/env/.env.merge
+    networks:
+      - nine-network
+    ports:
+      - "80:80"  
+    volumes:
+      - ./services/10-nineapache/volume/nine/apache.conf:/etc/apache2/conf.d/zapp.conf

services/10-nineapache/misc/nine.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+function upnineapache {
+    if [[ $NINEAPACHE_ACTIVATE == 1 && $NINEAPACHE_LOCAL == 1 ]]
+    then
+        Title ${NINEAPACHE_SERVICE_NAME^^}
+        EchoVert "CONTAINER"
+        upservice ${NINEAPACHE_SERVICE_NAME}
+        Echo
+    fi      
+}
+
+function destroynineapache {
+    if [[ $NINEAPACHE_LOCAL == 1 ]]
+    then
+        Title "DESTROY ${NINEAPACHE_SERVICE_NAME}"
+
+        stop ${NINEAPACHE_SERVICE_NAME} 1
+        docker-compose rm -s -v -f "${NINEAPACHE_SERVICE_NAME}"    
+
+        echo ""
+    fi
+}

services/10-nineapache/volume/nine/apache.conf

@@ -0,0 +1,84 @@
+LoadModule rewrite_module modules/mod_rewrite.so
+
+ServerName nineapache.local
+
+# Options Proxy
+ProxyRequests Off
+ProxyPreserveHost On
+
+<Proxy *>
+    Require all granted
+</Proxy>
+
+RequestHeader set X-Forwarded-Host "%{HTTP_HOST}s"
+RequestHeader set X-Forwarded-Server "%{HTTP_HOST}s"
+RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
+RequestHeader set Host "%{HTTP_HOST}s"
+RequestHeader set X-Forwarded-Proto "http"
+
+# Keycloak
+ProxyPass /auth http://keycloak:8999/auth retry=0 keepalive=On
+ProxyPassReverse /auth http://keycloak:8999/auth retry=0
+
+# Minio = pour l'instant je n'arrive pas à faire fonctionner la console minio derrière un proxy
+#ProxyPass /minio http://minio:9001 retry=0 keepalive=On
+#ProxyPassReverse /minio http://minio:9001 retry=0
+#RewriteEngine On
+#RewriteCond %{HTTP:Upgrade} =websocket [NC]
+#RewriteRule /minio/(.*) ws://minio:9001/$1 [P,L]
+#RewriteCond %{HTTP:Upgrade} !=websocket [NC]
+#RewriteRule /minio/(.*) http://minio:9001/$1 [P,L]
+
+# Nextcloud
+ProxyPass /nextcloud http://nextcloud retry=0 keepalive=On
+ProxyPassReverse /nextcloud http://nextcloud retry=0
+
+# Nineboard
+ProxyPass /nineboard http://nineboard/nineboard retry=0 keepalive=On
+ProxyPassReverse /nineboard http://nineboard/nineboard retry=0
+ProxyPass /wssnineboard ws://nineboard/wssnineboard retry=0 keepalive=On
+ProxyPassReverse /wssnineboard ws://nineboard/wssnineboard retry=0
+
+# Ninegate
+ProxyPass /ninegate http://ninegate/ninegate retry=0 keepalive=On
+ProxyPassReverse /ninegate http://ninegate/ninegate retry=0
+ProxyPass /wssninegate ws://ninegate/wssninegate retry=0 keepalive=On
+ProxyPassReverse /wssninegate ws://ninegate/wssninegate retry=0
+
+# Nineskeletor
+ProxyPass /nineskeletor http://nineskeletor/nineskeletor retry=0 keepalive=On
+ProxyPassReverse /nineskeletor http://nineskeletor/nineskeletor retry=0
+
+# Dokuwiki
+ProxyPass /dokuwiki http://dokuwiki retry=0 keepalive=On
+ProxyPassReverse /dokuwiki http://dokuwiki retry=0
+
+# Wordpress
+ProxyPass /wordpress http://wordpress/wordpress retry=0 keepalive=On
+ProxyPassReverse /wordpress http://wordpress/wordpress retry=0
+
+# Adminer
+ProxyPass /adminer http://adminer:8080 retry=0 keepalive=On
+ProxyPassReverse /adminer http://adminer:8080 retry=0
+
+# Phpldapadmin
+ProxyPass /phpldapadmin http://phpldapadmin/phpldapadmin retry=0 keepalive=On
+ProxyPassReverse /phpldapadmin http://phpldapadmin/phpldapadmin retry=0
+
+# Page interne au proxy
+DocumentRoot "/app/public"
+<Directory "/app/public">
+    Options Indexes FollowSymLinks
+    AllowOverride All
+    Require all granted
+
+    RewriteEngine On
+    RewriteCond %{REQUEST_URI}::$0 ^(/.+)/(.*)::\2$
+    RewriteRule .* - [E=BASE:%1]
+    RewriteCond %{HTTP:Authorization} .+
+    RewriteRule ^ - [E=HTTP_AUTHORIZATION:%0]
+    RewriteCond %{ENV:REDIRECT_STATUS} =""
+    RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^ %{ENV:BASE}/index.php [L]
+</Directory>

services/15-mariadb/dockercompose/dockercompose.yml

@@ -0,0 +1,18 @@
+
+  # Mariadb
+  # Base de données des services
+  # Port interne 3306
+  mariadb:
+    image: docker.io/library/mariadb
+    container_name: nine-mariadb
+    restart: unless-stopped
+    healthcheck:
+      test: /nine/check.sh    
+      interval: 1s
+      timeout: 60s      
+    env_file: ./services/15-mariadb/env/.env.merge
+    networks:
+      - nine-network
+    volumes:
+      - ./services/15-mariadb/volume/mysql:/var/lib/mysql
+      - ./services/15-mariadb/volume/nine:/nine

services/15-mariadb/env/.env

@@ -0,0 +1,7 @@
+
+# == MARIADB ==============================================================================================================================
+
+MYSQL_ROOT_PASSWORD=$MARIADB_ROOT_PASSWORD
+MYSQL_USER=$MARIADB_USER
+MYSQL_PASSWORD=$MARIADB_PASSWORD
+

services/15-mariadb/misc/nine.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+
+
+function upmariadb {
+    if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
+    then
+        Title "MARIADB"
+        EchoVert "CONTAINER"
+        upservice $MARIADB_SERVICE_NAME wait
+        Echo
+    fi
+}
+
+function destroymariadb(){
+    if [[ $MARIADB_LOCAL == 1 ]]
+    then
+        Title "DESTROY $MARIADB_SERVICE_NAME"
+
+        stop $MARIADB_SERVICE_NAME 1
+        docker-compose rm -s -v -f "$MARIADB_SERVICE_NAME"
+    
+        if [[ -z $1 ]]; then Question_ouinon "Souhaitez-vous supprimer l'ensemble des bases ?";fi
+        if [[ "$?" = 0 || -z $1 ]]
+        then
+            sudo rm -rf services/15-mariadb/volume/mysql
+        fi
+
+        echo ""
+    fi  
+}

services/15-mariadb/volume/nine/check.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+mariadb mysql -u root -p${MARIADB_ROOT_PASSWORD} -h localhost -e "select 1" 

services/15-mariadb/volume/nine/delete.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "DROP DATABASE IF EXISTS $1;"

services/15-mariadb/volume/nine/init.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "CREATE DATABASE IF NOT EXISTS $1;"
+mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "GRANT ALL PRIVILEGES ON $1.* TO '$MARIADB_USER'@'%';"

services/30-minio/dockercompose/dockercompose.yml

@@ -0,0 +1,15 @@
+
+  # Minio
+  # Stocakge S3
+  # Port interne 9000 pour le stockage / Port interne 9001 pour l'interface web
+  minio:
+    image: bitnami/minio
+    container_name: nine-minio
+    restart: unless-stopped      
+    env_file: ./services/30-minio/env/.env.merge
+    ports:
+      - "9001:9001"      
+    networks:
+      - nine-network
+    volumes:
+      - './services/30-minio/volume/data:/data'

services/30-minio/env/.env

@@ -0,0 +1,13 @@
+
+# == MINIO ================================================================================================================================
+
+MINIO_ROOT_USER=${ADMIN_USER}
+MINIO_ROOT_PASSWORD=${ADMIN_PASSWORD}
+MINIO_DEFAULT_BUCKETS=nine
+MINIO_API_PORT_NUMBER=9000
+MINIO_CONSOLE_PORT_NUMBER=9001
+
+#MINIO_SERVER_URL="${PROTOCOLE}://${WEB_URL}"
+#MINIO_BROWSER_REDIRECT_URL="${MINIO_URL}"
+#MINIO_SCHEME=${PROTOCOLE}
+#BITNAMI_DEBUG=true

services/30-minio/misc/nine.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+function upminio {
+    if [[ $MINIO_ACTIVATE == 1 && $MINIO_LOCAL == 1 ]]
+    then
+        Title "MINIO"
+        EchoVert "CONTAINER"
+        upservice $MINIO_SERVICE_NAME
+        Echo
+    fi
+}
+
+function destroyminio(){
+    if [[ $MINIO_LOCAL == 1 ]]
+    then
+        Title "DESTROY $MINIO_SERVICE_NAME"
+
+        stop $MINIO_SERVICE_NAME 1
+        docker-compose rm -s -v -f "$MINIO_SERVICE_NAME"  
+
+        if [[ -z $1 ]]; then Question_ouinon "Souhaitez-vous supprimer les fichiers stockés dans $MINIO_SERVICE_NAME ?";fi
+        if [[ "$?" = 0 || -z $1 ]]
+        then
+                sudo rm -rf ./services/30-minio/volume/data
+        fi
+
+        echo ""
+   fi  
+}

services/30-openldap/dockercompose/dockercompose.yml

@@ -0,0 +1,18 @@
+
+  # Openldap
+  # Annuaire
+  # Port interne 1389 & 1636
+  openldap:
+    image: docker.io/bitnami/openldap:2
+    container_name: nine-openldap
+    restart: unless-stopped
+    healthcheck:
+      test: /nine/check.sh    
+      interval: 1s
+      timeout: 60s     
+    env_file: ./services/30-openldap/env/.env.merge
+    networks:
+      - nine-network
+    volumes:
+      - './services/30-openldap/volume/data:/bitnami/openldap'
+      - './services/30-openldap/volume/nine:/nine'

services/30-openldap/env/.env

@@ -0,0 +1,10 @@
+
+# == OPENLDAP =============================================================================================================================
+
+LDAP_ROOT=${LDAP_BASEDN}
+LDAP_ADMIN_PASSWORD=${LDAP_PASSWORD}
+LDAP_ADMIN_DN=${LDAP_USER}
+LDAP_USERS="dockernouser"
+LDAP_PASSWORDS="dockernouser"
+LDAP_CUSTOM_SCHEMA_FILE=/nine/schema/cadoles.ldif
+

services/30-openldap/misc/nine.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+function upopenldap  {
+    if [[ $OPENLDAP_ACTIVATE == 1 && $OPENLDAP_LOCAL == 1 ]]
+    then
+        Title ${OPENLDAP_SERVICE_NAME^^}
+        EchoVert "CONTAINER"
+
+        mkdir -p ./services/30-openldap/volume/data
+        chmod a+wr ./services/30-openldap/volume/data
+        
+        upservice $OPENLDAP_SERVICE_NAME wait
+        docker-compose exec $OPENLDAP_SERVICE_NAME /nine/init.sh
+        Echo
+    fi
+}
+
+function destroyopenldap {
+    if [[ $OPENLDAP_LOCAL == 1 ]]
+    then
+        Title "DESTROY $OPENLDAP_SERVICE_NAME"
+
+        stop $OPENLDAP_SERVICE_NAME 1
+        docker-compose rm -s -v -f "$OPENLDAP_SERVICE_NAME"
+        
+        if [[ -z $1 ]]; then Question_ouinon "Souhaitez-vous supprimer l'annuaire associé à $OPENLDAP_SERVICE_NAME ?";fi
+        if [[ "$?" = 0 || -z $1 ]]
+        then
+                sudo rm -rf ./services/30-openldap/volume/data
+        fi
+
+        echo ""
+    fi   
+}

services/30-openldap/volume/nine/changepassword.sh

@@ -0,0 +1 @@
+ldappasswd -x -H ldap://${LDAP_HOST}:${LDAP_PORT} -D ${LDAP_USER} -w ${LDAP_PASSWORD} -s $2 "uid=$1,ou=users,ou=ninegate,dc=nine,dc=org"

services/30-openldap/volume/nine/check.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+ldapsearch -x -H ldap://${LDAP_HOST}:${LDAP_PORT} -D ${LDAP_USER} -b ${LDAP_BASEDN} -w ${LDAP_PASSWORD}
+exit 0

services/30-openldap/volume/nine/debug/debug.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# shellcheck disable=SC1091
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Load libraries
+. /opt/bitnami/scripts/libos.sh
+. /nine/libopenldap.sh
+
+rm -rf /bitnami/openldap/data
+rm -rf /bitnami/openldap/slapd.d
+
+# Load LDAP environment variables
+eval "$(ldap_env)"
+
+# Ensure Open LDAP environment variables are valid
+ldap_validate
+# Ensure 'daemon' user exists when running as 'root'
+am_i_root && ensure_user_exists "$LDAP_DAEMON_USER" --group "$LDAP_DAEMON_GROUP"
+# Ensure Open LDAP server is initialize
+ldap_initialize

services/30-openldap/volume/nine/debug/libopenldap.sh

@@ -0,0 +1,474 @@
+#!/bin/bash
+#
+# Bitnami OpenLDAP library
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/libfile.sh
+. /opt/bitnami/scripts/libfs.sh
+. /opt/bitnami/scripts/liblog.sh
+. /opt/bitnami/scripts/libos.sh
+. /opt/bitnami/scripts/libservice.sh
+. /opt/bitnami/scripts/libvalidations.sh
+
+########################
+# Load global variables used on OpenLDAP configuration
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   Series of exports to be used as 'eval' arguments
+#########################
+ldap_env() {
+    cat << "EOF"
+# Paths
+export LDAP_BASE_DIR="/opt/bitnami/openldap"
+export LDAP_BIN_DIR="${LDAP_BASE_DIR}/bin"
+export LDAP_SBIN_DIR="${LDAP_BASE_DIR}/sbin"
+export LDAP_CONF_DIR="${LDAP_BASE_DIR}/etc"
+export LDAP_SHARE_DIR="${LDAP_BASE_DIR}/share"
+export LDAP_VOLUME_DIR="/bitnami/openldap"
+export LDAP_DATA_DIR="${LDAP_VOLUME_DIR}/data"
+export LDAP_ONLINE_CONF_DIR="${LDAP_VOLUME_DIR}/slapd.d"
+export LDAP_PID_FILE="${LDAP_BASE_DIR}/var/run/slapd.pid"
+export LDAP_CUSTOM_LDIF_DIR="${LDAP_CUSTOM_LDIF_DIR:-/ldifs}"
+export LDAP_CUSTOM_SCHEMA_FILE="${LDAP_CUSTOM_SCHEMA_FILE:-/schema/custom.ldif}"
+export PATH="${LDAP_BIN_DIR}:${LDAP_SBIN_DIR}:$PATH"
+export LDAP_TLS_CERT_FILE="${LDAP_TLS_CERT_FILE:-}"
+export LDAP_TLS_KEY_FILE="${LDAP_TLS_KEY_FILE:-}"
+export LDAP_TLS_CA_FILE="${LDAP_TLS_CA_FILE:-}"
+export LDAP_TLS_DH_PARAMS_FILE="${LDAP_TLS_DH_PARAMS_FILE:-}"
+# Users
+export LDAP_DAEMON_USER="slapd"
+export LDAP_DAEMON_GROUP="slapd"
+# Settings
+export LDAP_PORT_NUMBER="${LDAP_PORT_NUMBER:-1389}"
+export LDAP_LDAPS_PORT_NUMBER="${LDAP_LDAPS_PORT_NUMBER:-1636}"
+export LDAP_ROOT="${LDAP_ROOT:-dc=example,dc=org}"
+export LDAP_ADMIN_USERNAME="${LDAP_ADMIN_USERNAME:-admin}"
+export LDAP_ADMIN_DN="${LDAP_ADMIN_USERNAME/#/cn=},${LDAP_ROOT}"
+export LDAP_ADMIN_PASSWORD="${LDAP_ADMIN_PASSWORD:-adminpassword}"
+export LDAP_ENCRYPTED_ADMIN_PASSWORD="$(echo -n $LDAP_ADMIN_PASSWORD | slappasswd -n -T /dev/stdin)"
+export LDAP_EXTRA_SCHEMAS="${LDAP_EXTRA_SCHEMAS:-cosine,inetorgperson,nis}"
+export LDAP_SKIP_DEFAULT_TREE="${LDAP_SKIP_DEFAULT_TREE:-no}"
+export LDAP_USERS="${LDAP_USERS:-user01,user02}"
+export LDAP_PASSWORDS="${LDAP_PASSWORDS:-bitnami1,bitnami2}"
+export LDAP_USER_DC="${LDAP_USER_DC:-users}"
+export LDAP_GROUP="${LDAP_GROUP:-readers}"
+export LDAP_ENABLE_TLS="${LDAP_ENABLE_TLS:-no}"
+export LDAP_ULIMIT_NOFILES="${LDAP_ULIMIT_NOFILES:-1024}"
+EOF
+}
+
+########################
+# Validate settings in LDAP_* environment variables
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_validate() {
+    info "Validating settings in LDAP_* env vars"
+    local error_code=0
+
+    # Auxiliary functions
+    print_validation_error() {
+        error "$1"
+        error_code=1
+    }
+    check_allowed_port() {
+        local port_var="${1:?missing port variable}"
+        local validate_port_args=()
+        ! am_i_root && validate_port_args+=("-unprivileged")
+        if ! err=$(validate_port "${validate_port_args[@]}" "${!port_var}"); then
+            print_validation_error "An invalid port was specified in the environment variable ${port_var}: ${err}."
+        fi
+    }
+    for var in LDAP_SKIP_DEFAULT_TREE LDAP_ENABLE_TLS; do
+        if ! is_yes_no_value "${!var}"; then
+            print_validation_error "The allowed values for $var are: yes or no"
+        fi
+    done
+
+    if is_boolean_yes "$LDAP_ENABLE_TLS"; then
+        if [[ -z "$LDAP_TLS_CERT_FILE" ]]; then
+            print_validation_error "You must provide a X.509 certificate in order to use TLS"
+        elif [[ ! -f "$LDAP_TLS_CERT_FILE" ]]; then
+            print_validation_error "The X.509 certificate file in the specified path ${LDAP_TLS_CERT_FILE} does not exist"
+        fi
+        if [[ -z "$LDAP_TLS_KEY_FILE" ]]; then
+            print_validation_error "You must provide a private key in order to use TLS"
+        elif [[ ! -f "$LDAP_TLS_KEY_FILE" ]]; then
+            print_validation_error "The private key file in the specified path ${LDAP_TLS_KEY_FILE} does not exist"
+        fi
+        if [[ -z "$LDAP_TLS_CA_FILE" ]]; then
+            print_validation_error "You must provide a CA X.509 certificate in order to use TLS"
+        elif [[ ! -f "$LDAP_TLS_CA_FILE" ]]; then
+            print_validation_error "The CA X.509 certificate file in the specified path ${LDAP_TLS_CA_FILE} does not exist"
+        fi
+    fi
+
+    read -r -a users <<< "$(tr ',;' ' ' <<< "${LDAP_USERS}")"
+    read -r -a passwords <<< "$(tr ',;' ' ' <<< "${LDAP_PASSWORDS}")"
+    if [[ "${#users[@]}" -ne "${#passwords[@]}" ]]; then
+        print_validation_error "Specify the same number of passwords on LDAP_PASSWORDS as the number of users on LDAP_USERS!"
+    fi
+
+    if [[ -n "$LDAP_PORT_NUMBER" ]] && [[ -n "$LDAP_LDAPS_PORT_NUMBER" ]]; then
+        if [[ "$LDAP_PORT_NUMBER" -eq "$LDAP_LDAPS_PORT_NUMBER" ]]; then
+            print_validation_error "LDAP_PORT_NUMBER and LDAP_LDAPS_PORT_NUMBER are bound to the same port!"
+        fi
+    fi
+    [[ -n "$LDAP_PORT_NUMBER" ]] && check_allowed_port LDAP_PORT_NUMBER
+    [[ -n "$LDAP_LDAPS_PORT_NUMBER" ]] && check_allowed_port LDAP_LDAPS_PORT_NUMBER
+
+    [[ "$error_code" -eq 0 ]] || exit "$error_code"
+}
+
+########################
+# Check if OpenLDAP is running
+# Globals:
+#   LDAP_PID_FILE
+# Arguments:
+#   None
+# Returns:
+#   Whether slapd is running
+#########################
+is_ldap_running() {
+    local pid
+    pid="$(get_pid_from_file "${LDAP_PID_FILE}")"
+    if [[ -n "${pid}" ]]; then
+        is_service_running "${pid}"
+    else
+        false
+    fi
+}
+
+########################
+# Check if OpenLDAP is not running
+# Arguments:
+#   None
+# Returns:
+#   Whether slapd is not running
+#########################
+is_ldap_not_running() {
+    ! is_ldap_running
+}
+
+########################
+# Start OpenLDAP server in background
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_start_bg() {
+    local -a flags=("-h" "ldap://:${LDAP_PORT_NUMBER}/ ldapi:/// " "-F" "${LDAP_CONF_DIR}/slapd.d")
+    if is_ldap_not_running; then
+        info "Starting OpenLDAP server in background"
+        ulimit -n "$LDAP_ULIMIT_NOFILES"
+        am_i_root && flags=("-u" "$LDAP_DAEMON_USER" "${flags[@]}")
+        debug_execute slapd "${flags[@]}"
+    fi
+}
+
+########################
+# Stop OpenLDAP server
+# Arguments:
+#   $1 - max retries. Default: 12
+#   $2 - sleep between retries (in seconds). Default: 1
+# Returns:
+#   None
+#########################
+ldap_stop() {
+    local -r retries="${1:-12}"
+    local -r sleep_time="${2:-1}"
+
+    are_db_files_locked() {
+        local return_value=0
+        read -r -a db_files <<< "$(find "$LDAP_DATA_DIR" -type f -print0 | xargs -0)"
+        for f in "${db_files[@]}"; do
+            debug_execute lsof -w "$f" && return_value=1
+        done
+        return $return_value
+    }
+
+    is_ldap_not_running && return
+
+    stop_service_using_pid "$LDAP_PID_FILE"
+    if ! retry_while are_db_files_locked "$retries" "$sleep_time"; then
+        error "OpenLDAP failed to stop"
+        return 1
+    fi
+}
+
+########################
+# Create LDAP online configuration
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_create_online_configuration() {
+    info "Creating LDAP online configuration"
+    ! am_i_root && replace_in_file "${LDAP_SHARE_DIR}/slapd.ldif" "uidNumber=0" "uidNumber=$(id -u)"
+    slapadd -F "$LDAP_ONLINE_CONF_DIR" -n 0 -l "${LDAP_SHARE_DIR}/slapd.ldif"
+    
+}
+
+########################
+# Configure LDAP credentials for admin user
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_admin_credentials() {
+    info "Configure LDAP credentials for admin user = $LDAP_ADMIN_DN"
+    cat > "${LDAP_SHARE_DIR}/admin.ldif" << EOF
+dn: olcDatabase={2}hdb,cn=config
+changetype: modify
+replace: olcSuffix
+olcSuffix: $LDAP_ROOT
+
+dn: olcDatabase={2}hdb,cn=config
+changetype: modify
+replace: olcRootDN
+olcRootDN: $LDAP_ADMIN_DN
+
+dn: olcDatabase={2}hdb,cn=config
+changeType: modify
+add: olcRootPW
+olcRootPW: $LDAP_ENCRYPTED_ADMIN_PASSWORD
+
+dn: olcDatabase={1}monitor,cn=config
+changetype: modify
+replace: olcAccess
+olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="${LDAP_ADMIN_DN}" read by * none
+EOF
+    ldapmodify -Y EXTERNAL -H "ldapi:///" -f "${LDAP_SHARE_DIR}/admin.ldif"
+}
+
+########################
+# Add LDAP schemas
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns
+#   None
+#########################
+ldap_add_schemas() {
+    info "Adding LDAP extra schemas === ${LDAP_EXTRA_SCHEMAS}"
+    read -r -a schemas <<< "$(tr ',;' ' ' <<< "${LDAP_EXTRA_SCHEMAS}")"
+    for schema in "${schemas[@]}"; do
+        ldapadd -Y EXTERNAL -H "ldapi:///" -f "${LDAP_CONF_DIR}/schema/${schema}.ldif"
+    done
+
+}
+
+########################
+# Add custom schema
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns
+#   None
+#########################
+ldap_add_custom_schema() {
+    info "Adding custom Schema : $LDAP_CUSTOM_SCHEMA_FILE ..."
+    slapadd -F "$LDAP_ONLINE_CONF_DIR" -n 0 -l  "$LDAP_CUSTOM_SCHEMA_FILE"
+    ldap_stop
+     while is_ldap_running; do sleep 1; done
+    ldap_start_bg
+}
+
+########################
+# Create LDAP tree
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_create_tree() {
+    info "Creating LDAP default tree"
+    local dc=""
+    local o="example"
+    read -r -a root <<< "$(tr ',;' ' ' <<< "${LDAP_ROOT}")"
+    for attr in "${root[@]}"; do
+        if [[ $attr = dc=* ]] && [[ -z "$dc" ]]; then
+            dc="${attr:3}"
+        elif [[ $attr = o=* ]] && [[ $o = "example" ]]; then
+            o="${attr:2}"
+        fi
+    done
+    cat > "${LDAP_SHARE_DIR}/tree.ldif" << EOF
+# Root creation
+dn: $LDAP_ROOT
+objectClass: dcObject
+objectClass: organization
+dc: $dc
+o: $o
+
+dn: ${LDAP_USER_DC/#/ou=},${LDAP_ROOT}
+objectClass: organizationalUnit
+ou: users
+
+EOF
+    read -r -a users <<< "$(tr ',;' ' ' <<< "${LDAP_USERS}")"
+    read -r -a passwords <<< "$(tr ',;' ' ' <<< "${LDAP_PASSWORDS}")"
+    local index=0
+    for user in "${users[@]}"; do
+        cat >> "${LDAP_SHARE_DIR}/tree.ldif" << EOF
+# User $user creation
+dn: ${user/#/cn=},${LDAP_USER_DC/#/ou=},${LDAP_ROOT}
+cn: User$((index + 1 ))
+sn: Bar$((index + 1 ))
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: shadowAccount
+userPassword: ${passwords[$index]}
+uid: $user
+uidNumber: $((index + 1000 ))
+gidNumber: $((index + 1000 ))
+homeDirectory: /home/${user}
+
+EOF
+        index=$((index + 1 ))
+    done
+    cat >> "${LDAP_SHARE_DIR}/tree.ldif" << EOF
+# Group creation
+dn: ${LDAP_GROUP/#/cn=},${LDAP_USER_DC/#/ou=},${LDAP_ROOT}
+cn: $LDAP_GROUP
+objectClass: groupOfNames
+# User group membership
+EOF
+
+    for user in "${users[@]}"; do
+        cat >> "${LDAP_SHARE_DIR}/tree.ldif" << EOF
+member: ${user/#/cn=},${LDAP_USER_DC/#/ou=},${LDAP_ROOT}
+EOF
+    done
+
+    debug_execute ldapadd -f "${LDAP_SHARE_DIR}/tree.ldif" -H "ldapi:///" -D "$LDAP_ADMIN_DN" -w "$LDAP_ADMIN_PASSWORD"
+}
+
+########################
+# Add custom LDIF files
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns
+#   None
+#########################
+ldap_add_custom_ldifs() {
+    info "Loading custom LDIF files..."
+    warn "Ignoring LDAP_USERS, LDAP_PASSWORDS, LDAP_USER_DC and LDAP_GROUP environment variables..."
+    find "$LDAP_CUSTOM_LDIF_DIR" -maxdepth 1 \( -type f -o -type l \) -iname '*.ldif' -print0 | sort -z | xargs --null -I{} bash -c ". /opt/bitnami/scripts/libos.sh && debug_execute ldapadd -f {} -H 'ldapi:///' -D $LDAP_ADMIN_DN -w $LDAP_ADMIN_PASSWORD"
+}
+
+########################
+# OpenLDAP configure permissions
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_configure_permissions() {
+  debug "Ensuring expected directories/files exist..."
+  for dir in "$LDAP_SHARE_DIR" "$LDAP_DATA_DIR" "$LDAP_ONLINE_CONF_DIR"; do
+      ensure_dir_exists "$dir"
+      if am_i_root; then
+          chown -R "$LDAP_DAEMON_USER:$LDAP_DAEMON_GROUP" "$dir"
+      fi
+  done
+}
+
+########################
+# Initialize OpenLDAP server
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_initialize() {
+    info "Initializing OpenLDAP..."
+
+    ldap_configure_permissions
+    if ! is_dir_empty "$LDAP_DATA_DIR"; then
+        info "Using persisted data"
+    else
+        # Create OpenLDAP online configuration
+        ldap_create_online_configuration
+        info "Start BG"
+        ldap_start_bg
+        ldap_admin_credentials
+        if is_boolean_yes "$LDAP_ENABLE_TLS"; then
+            ldap_configure_tls
+        fi
+        if is_boolean_yes "$LDAP_SKIP_DEFAULT_TREE"; then
+            info "Skipping default schemas/tree structure"
+        else
+            # Initialize OpenLDAP with schemas/tree structure
+            ldap_add_schemas
+            if [[ -f "$LDAP_CUSTOM_SCHEMA_FILE" ]]; then
+                ldap_add_custom_schema
+            fi
+            if ! is_dir_empty "$LDAP_CUSTOM_LDIF_DIR"; then
+                ldap_add_custom_ldifs
+            else
+                ldap_create_tree
+            fi
+        fi
+        ldap_stop
+    fi
+}
+
+########################
+# OpenLDAP configure TLS
+# Globals:
+#   LDAP_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+ldap_configure_tls() {
+    info "Configuring TLS"
+    cat > "${LDAP_SHARE_DIR}/certs.ldif" << EOF
+dn: cn=config
+changetype: modify
+replace: olcTLSCACertificateFile
+olcTLSCACertificateFile: $LDAP_TLS_CA_FILE
+-
+replace: olcTLSCertificateFile
+olcTLSCertificateFile: $LDAP_TLS_CERT_FILE
+-
+replace: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: $LDAP_TLS_KEY_FILE
+EOF
+    if [[ -f "$LDAP_TLS_DH_PARAMS_FILE" ]]; then
+        cat >> "${LDAP_SHARE_DIR}/certs.ldif" << EOF
+-
+replace: olcTLSDHParamFile
+olcTLSDHParamFile: $LDAP_TLS_DH_PARAMS_FILE
+EOF
+    fi
+    debug_execute ldapmodify -Y EXTERNAL -H "ldapi:///" -f "${LDAP_SHARE_DIR}/certs.ldif"
+}

services/30-openldap/volume/nine/init.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [[ ! -f /bitnami/openldap/.isinit ]]
+then
+    echo ""
+    echo "Initialisation annuaire"
+    echo ""
+
+    # Suppression de l'entrée users généré automatiquement par l'image docker bitnami/openldap
+    ldapdelete ou=users,${LDAP_BASEDN} -r -H ldap://${LDAP_HOST}:${LDAP_PORT} -D ${LDAP_USER} -w ${LDAP_PASSWORD} 2>/dev/null
+
+    # Integration du ldif de base
+    ldapadd -H ldap://${LDAP_HOST}:${LDAP_PORT} -D ${LDAP_USER} -w ${LDAP_PASSWORD} -f '/nine/ldif/cadoles.ldif' 2>/dev/null
+
+    /nine/changepassword.sh admin ${ADMIN_PASSWORD}
+
+    touch /bitnami/openldap/.isinit
+fi

services/30-openldap/volume/nine/ldif/cadoles.ldif

@@ -0,0 +1,66 @@
+# Entrée 3: ou=ninegate,dc=nine,dc=org
+dn: ou=ninegate,dc=nine,dc=org
+objectclass: organizationalUnit
+objectclass: top
+ou: ninegate
+
+# Entrée 4: ou=niveau01,ou=ninegate,dc=nine,dc=org
+dn: ou=niveau01,ou=ninegate,dc=nine,dc=org
+objectclass: organizationalUnit
+objectclass: top
+ou: niveau01
+
+# Entrée 5: cn=nine,ou=niveau01,ou=ninegate,dc=nine,dc=org
+dn: cn=nine,ou=niveau01,ou=ninegate,dc=nine,dc=org
+objectclass: posixGroup
+objectclass: top
+objectclass: sambaGroupMapping
+objectclass: cadolesGroup
+objectclass: cadolesSiren
+cn: nine
+gidnumber: 1
+memberuid: admin
+cadolesMember: uid=admin,ou=users,ou=ninegate,dc=nine,dc=org
+sambagrouptype: 2
+sambasid: 1
+siren: Ninegate
+
+# Entrée 6: ou=niveau02,ou=ninegate,dc=nine,dc=org
+dn: ou=niveau02,ou=ninegate,dc=nine,dc=org
+objectclass: organizationalUnit
+objectclass: top
+ou: niveau02
+
+# Entrée 7: ou=groups,ou=ninegate,dc=nine,dc=org
+dn: ou=groups,ou=ninegate,dc=nine,dc=org
+objectclass: organizationalUnit
+objectclass: top
+ou: groups
+
+# Entrée 8: ou=users,ou=ninegate,dc=nine,dc=org
+dn: ou=users,ou=ninegate,dc=nine,dc=org
+objectclass: organizationalUnit
+objectclass: top
+ou: users
+
+# Entrée 9: uid=admin,ou=users,ou=ninegate,dc=nine,dc=org
+dn: uid=admin,ou=users,ou=ninegate,dc=nine,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+objectclass: cadolesPerson
+objectclass: cadolesSiren
+objectclass: cadolesSiret
+authlevel: simple
+uid: admin
+cn: nine
+sn: nine
+displayname: Administrateur nine
+givenname: Administrateur
+mail: admin@no-reply.fr
+siren: 0000000A
+niveau01: nine
+userpassword: {SSHA}JYfvUM9Hf/v/NbWR5zgUkt4E5lBRGuR2
+
+

services/30-openldap/volume/nine/schema/cadoles.ldif

@@ -0,0 +1,96 @@
+dn: cn=cadoles,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: cadoles
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.101 NAME 'givensName' DESC 'Prénoms Agent' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.102 NAME 'usualname' DESC 'Nom Usage' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.103 NAME 'birthdate' DESC 'Date de Naissance' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.104 NAME 'birthcountry' DESC 'Code INSEE Pays de Naissance' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.105 NAME 'birthplace' DESC 'Code INSEE Lieu de Naissance' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.106 NAME 'gender' DESC 'Sexe de la Personne' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.107 NAME 'job' DESC 'Métier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.108 NAME 'position' DESC 'Fonction relative à Unité Organisationnelle' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.109 NAME 'belongingpopulation' DESC 'Population Appartenance' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.110 NAME 'authlevel' DESC 'Niveau Authentification Demandé' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.111 NAME 'siren' DESC 'Identifiant Entreprise' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.112 NAME 'siret' DESC 'Identifiant Etablissement' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.113 NAME 'cadolesMember' DESC 'Membres du groupe' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.114 NAME 'niveau01' DESC 'Label Entreprise' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 2.16.840.1.113732.3.1.115 NAME 'niveau02' DESC 'Label Etablissement' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcObjectClasses:  ( 2.16.840.1.113732.3.1.1 NAME 'cadolesPerson' DESC 'Description Personne Cadoles' SUP top AUXILIARY MAY ( givensName $ usualname $ birthdate $ birthcountry $ birthplace $ gender $ job $ position $ belongingpopulation $ authlevel ) )
+olcObjectClasses: (  2.16.840.1.113732.3.1.2 NAME 'cadolesSiren' DESC 'Siren' SUP top AUXILIARY MAY ( siren $ niveau01 ) )  
+olcObjectClasses: (  2.16.840.1.113732.3.1.3 NAME 'cadolesSiret' DESC 'Siret' SUP top AUXILIARY MAY ( siret $ postalAddress $ niveau02 ) )  
+olcObjectClasses: (  2.16.840.1.113732.3.1.4 NAME 'cadolesGroup' DESC 'Descirption Groupe Cadoles' SUP top AUXILIARY MAY  ( cadolesMember $ mail ) )  
+
+dn: cn=samba,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: samba
+olcAttributeTypes: {0}( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
+olcAttributeTypes: {1}( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
+olcAttributeTypes: {2}( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE )
+olcAttributeTypes: {3}( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'Timestamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {4}( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 'Timestamp of when the user is allowed to update the password' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {5}( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC 'Timestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {6}( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Timestamp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {7}( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'Timestamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {8}( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC 'Timestamp of when the user will be logged off automatically' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {9}( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' DESC 'Bad password attempt count' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {10}( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' DESC 'Time of the last bad password attempt' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {11}( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42} SINGLE-VALUE )
+olcAttributeTypes: {12}( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
+olcAttributeTypes: {13}( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+olcAttributeTypes: {14}( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+olcAttributeTypes: {15}( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+olcAttributeTypes: {16}( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+olcAttributeTypes: {17}( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+olcAttributeTypes: {18}( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+olcAttributeTypes: {19}( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC 'Concatenated MD5 hashes of the salted NT passwords used on this account' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} )
+olcAttributeTypes: {20}( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+olcAttributeTypes: {21}( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+olcAttributeTypes: {22}( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} )
+olcAttributeTypes: {23}( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'NT Group Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {24}( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 'Next NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {25}( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC 'Next NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {26}( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Next NT rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {27}( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' DESC 'Base at which the samba RID generation algorithm should operate' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {28}( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' DESC 'Share Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: {29}( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+olcAttributeTypes: {30}( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' DESC 'A boolean option' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+olcAttributeTypes: {31}( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' DESC 'An integer option' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {32}( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' DESC 'A string option' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcAttributeTypes: {33}( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption' DESC 'A string list option' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: {34}( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' DESC 'Trust Password Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {35}( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' DESC 'Minimal password length (default: 5)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {36}( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength' DESC 'Length of Password History Entries (default: 0 => off)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {37}( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' DESC 'Force Users to logon for password change (default: 0 => off, 2 => on)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {38}( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' DESC 'Maximum password age, in seconds (default: -1 => never expire passwords)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {39}( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' DESC 'Minimum password age, in seconds (default: 0 => allow immediate password change)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {40}( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' DESC 'Lockout duration in minutes (default: 30, -1 => forever)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {41}( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservationWindow' DESC 'Reset time after lockout in minutes (default: 30)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {42}( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold' DESC 'Lockout users after bad logon attempts (default: 0 => off)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {43}( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' DESC 'Disconnect Users outside logon hours (default: -1 => off, 0 => on)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {44}( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdChange' DESC 'Allow Machine Password changes (default: 0 => off)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {45}( 1.3.6.1.4.1.7165.2.1.68 NAME 'sambaClearTextPassword' DESC 'Clear text password (used for trusted domain passwords)' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+olcAttributeTypes: {46}( 1.3.6.1.4.1.7165.2.1.69 NAME 'sambaPreviousClearTextPassword' DESC 'Previous clear text password (used for trusted domain passwords)' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+olcAttributeTypes: {47}( 1.3.6.1.4.1.7165.2.1.70 NAME 'sambaTrustType' DESC 'Type of trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {48}( 1.3.6.1.4.1.7165.2.1.71 NAME 'sambaTrustAttributes' DESC 'Trust attributes for a trusted domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {49}( 1.3.6.1.4.1.7165.2.1.72 NAME 'sambaTrustDirection' DESC 'Direction of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {50}( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Fully qualified name of the domain with which a trust exists' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+olcAttributeTypes: {51}( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+olcAttributeTypes: {52}( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing'DESC 'Authentication information for the outgoing portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+olcAttributeTypes: {53}( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming'DESC 'Authentication information for the incoming portion of a trust' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+olcAttributeTypes: {54}( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DESC 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+olcAttributeTypes: {55}( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' DESC 'Forest trust information for a trusted domain object' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+olcAttributeTypes: {56}( 1.3.6.1.4.1.7165.2.1.79 NAME 'sambaTrustPosixOffset'DESC 'POSIX offset of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcAttributeTypes: {57}( 1.3.6.1.4.1.7165.2.1.80 NAME 'sambaSupportedEncryptionTypes' DESC 'Supported encryption types of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+olcObjectClasses: {0}( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) )
+olcObjectClasses: {1}( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description $ sambaSIDList ) )
+olcObjectClasses: {2}( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) )
+olcObjectClasses: {3}( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' DESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviousClearTextPassword )
+olcObjectClasses: {4}( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange ) )
+olcObjectClasses: {5}( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber ) )
+olcObjectClasses: {6}( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gidNumber ) )
+olcObjectClasses: {7}( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structural Class for a SID' SUP top STRUCTURAL MUST sambaSID )
+olcObjectClasses: {8}( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Configuration Section' SUP top AUXILIARY MAY description )
+olcObjectClasses: {9}( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share Section' SUP top STRUCTURAL MUST sambaShareName MAY description )
+olcObjectClasses: {10}( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sambaBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListoption $ description ) )
+olcObjectClasses: {11}( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Samba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $ sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlatName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdentifier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes) )

services/30-redis/dockercompose/dockercompose.yml

@@ -0,0 +1,12 @@
+
+  # Redis
+  # Base de données redis pour les services qui souhaitent stocker leur session en bdd
+  # Port interne 6379
+  redis:
+    image: redis:4.0
+    container_name: nine-redis
+    env_file: ./services/30-redis/env/.env.merge
+    networks:
+      - nine-network    
+    environment:
+      - TZ=Europe/Paris

services/30-redis/env/.env

@@ -0,0 +1,3 @@
+
+# == REDIS ================================================================================================================================
+

services/30-redis/misc/nine.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+function upredis {
+    if [[ $REDIS_ACTIVATE == 1 && $REDIS_LOCAL == 1 ]]
+    then
+        Title "REDIS"
+        EchoVert "CONTAINER"
+        upservice $REDIS_SERVICE_NAME
+        Echo
+    fi
+}
+
+function destroyredis(){
+    if [[ $REDIS_LOCAL == 1 ]]
+    then
+        Title "DESTROY $REDIS_SERVICE_NAME"
+
+        stop $REDIS_SERVICE_NAME 1
+        docker-compose rm -s -v -f "$REDIS_SERVICE_NAME"  
+
+        echo ""
+   fi  
+}

services/50-ninegate/dockercompose/dockercompose.yml

@@ -0,0 +1,14 @@
+
+  # Ninegate
+  # Portail collaboratif
+  # Port interne 80
+  ninegate:
+    image: reg.cadoles.com/envole/ninegate
+    container_name: nine-ninegate
+    restart: unless-stopped  
+    env_file: ./services/50-ninegate/env/.env.merge
+    networks:
+      - nine-network
+    volumes:
+      - ./services/50-ninegate/volume/data/private:/app/uploads
+      - ./services/50-ninegate/volume/data/public:/app/public/uploads

services/50-ninegate/env/.env

@@ -0,0 +1,27 @@
+
+# == NINEGATE =============================================================================================================================
+
+# BDD
+DATABASE_NAME=${NINEGATE_SERVICE_NAME}
+DATABASE_USER=${MARIADB_USER}
+DATABASE_PASSWORD=${MARIADB_PASSWORD}
+DATABASE_HOST=${MARIADB_SERVICE_NAME}
+
+# Activation Widget
+ACTIVATE_WIDADMINER=${ADMINER_ACTIVATE}
+WIDADMINER_URL="${ADMINER_URL}"
+
+ACTIVATE_WIDPHPLDAPADMIN=${PHPLDAPADMIN_ACTIVATE}
+WIDPHPLDAPADMIN_URL=${PHPLDAPADMIN_URL}
+
+ACTIVATE_WIDNEXTCLOUD=${NEXTCLOUD_ACTIVATE}
+WIDNEXTCLOUD_URL=${NEXTCLOUD_URL}
+
+ACTIVATE_WIDNINEBOARD=${NINEBOARD_ACTIVATE}
+WIDNINEBOARD_URL=${NINEBOARD_URL}
+
+ACTIVATE_WIDWORDPRESS=${WORDPRESS_ACTIVATE}
+WIDWORDPRESS_URL=${WORDPRESS_URL}
+
+INITPWDADMIN=${ADMIN_PASSWORD}
+

services/50-ninegate/misc/nine.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+
+function upninegate {
+    if [[ $NINEGATE_ACTIVATE == 1 && $NINEGATE_LOCAL == 1 ]]
+    then
+        Title ${NINEGATE_SERVICE_NAME^^}
+
+        if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
+        then
+            EchoVert "DATABASE"
+            Echo ${NINEGATE_SERVICE_NAME^^}
+            docker-compose exec $MARIADB_SERVICE_NAME /nine/init.sh $NINEGATE_SERVICE_NAME
+            Echo
+        fi
+
+        EchoVert "CONTAINER"
+        upservice ${NINEGATE_SERVICE_NAME}
+        chmod -R a+wr ./services/50-ninegate/volume/data
+        Echo
+    fi    
+}
+
+function destroyninegate {
+    if [[ $NINEGATE_LOCAL == 1 ]]
+    then
+        Title "DESTROY $NINEGATE_SERVICE_NAME"
+
+        stop $NINEGATE_SERVICE_NAME 1
+        docker-compose rm -s -v -f "$NINEGATE_SERVICE_NAME"
+        
+
+        if [[ -z $1 ]]; then Question_ouinon "Souhaitez-vous supprimer la BDD associé à $NINEGATE_SERVICE_NAME ?";fi
+        if [[ "$?" = 0 || -z $1 ]]
+        then
+            docker-compose exec $MARIADB_SERVICE_NAME /nine/delete.sh $NINEGATE_SERVICE_NAME
+        fi
+
+        echo ""
+    fi   
+}