update ldap deplyoment example

deployments/examples/ocis_ldap/config/ocis/entrypoint-override.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-
-set -e
-
-mkdir -p /var/tmp/ocis/.config/
-cp /config/web-config.dist.json /var/tmp/ocis/.config/web-config.json
-sed -i 's/ocis.owncloud.test/'${OCIS_DOMAIN:-ocis.owncloud.test}'/g' /var/tmp/ocis/.config/web-config.json
-
-ocis server&
-sleep 10
-
-# stop builtin accounts since we use LDAP only
-ocis kill accounts
-# stop builtin LDAP server since we use external LDAP only
-ocis kill glauth
-
-wait # wait for oCIS to exit

deployments/examples/ocis_ldap/config/ocis/proxy.yaml

@@ -1,47 +0,0 @@
----
-policy_selector:
-  static:
-    policy: ocis
-policies:
-  - name: ocis
-    routes:
-      - endpoint: "/"
-        backend: http://localhost:9100
-      - endpoint: "/.well-known/"
-        backend: http://localhost:9130
-      - endpoint: "/konnect/"
-        backend: http://localhost:9130
-      - endpoint: "/signin/"
-        backend: http://localhost:9130
-      - type: regex
-        endpoint: "/ocs/v[12].php/cloud/user/signing-key"
-        backend: http://localhost:9110
-      - endpoint: "/ocs/"
-        backend: http://localhost:9140
-      - type: query
-        endpoint: "/remote.php/?preview=1"
-        backend: http://localhost:9115
-      - endpoint: "/remote.php/"
-        backend: http://localhost:9140
-      - endpoint: "/dav/"
-        backend: http://localhost:9140
-      - endpoint: "/webdav/"
-        backend: http://localhost:9140
-      - endpoint: "/status.php"
-        backend: http://localhost:9140
-      - endpoint: "/index.php/"
-        backend: http://localhost:9140
-      - endpoint: "/app/"
-        backend: http://localhost:9140
-      - endpoint: "/archiver"
-        backend: http://localhost:9140
-      - endpoint: "/data"
-        backend: http://localhost:9140
-      - endpoint: "/graph/"
-        backend: http://localhost:9120
-      - endpoint: "/graph-explorer/"
-        backend: http://localhost:9135
-      - endpoint: "/api/v0/settings"
-        backend: http://localhost:9190
-      - endpoint: "/settings.js"
-        backend: http://localhost:9190

deployments/examples/ocis_ldap/config/ocis/web-config.dist.json

@@ -1,22 +0,0 @@
-{
-  "server": "https://ocis.owncloud.test",
-  "theme": "owncloud",
-  "version": "0.1.0",
-  "openIdConnect": {
-    "metadata_url": "https://ocis.owncloud.test/.well-known/openid-configuration",
-    "authority": "https://ocis.owncloud.test",
-    "client_id": "web",
-    "response_type": "code",
-    "scope": "openid profile email"
-  },
-  "apps": ["files"],
-  "external_apps": [
-    {
-      "id": "settings",
-      "path": "/settings.js"
-    }
-  ],
-  "options": {
-    "hideSearchBar": true
-  }
-}

deployments/examples/ocis_ldap/docker-compose.yml

@@ -50,9 +50,13 @@ services:
       - ldap-server
     entrypoint:
       - /bin/sh
-      - /entrypoint-override.sh
+    # run ocis init to initialize a configuration file with random secrets
+    # it will fail on subsequent runs, because the config file already exists
+    # therefore we ignore the error and then start the ocis server
+    command: ["-c", "ocis init || true; ocis server"]
     environment:
-      # CS3 users from ldap specific configuration
+
+      # users/gropups from ldap
       LDAP_URI: ldaps://ldap-server
       LDAP_INSECURE: "true"
       LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com"
@@ -64,32 +68,24 @@ services:
       LDAP_USERFILTER: "(objectclass=owncloud)"
       LDAP_USER_OBEJECTCLASS: "inetOrgPerson"
       LDAP_LOGIN_ATTRIBUTES: "uid,mail"
+      IDP_LDAP_URI: ldap://ldap-server
       IDP_LDAP_LOGIN_ATTRIBUTE: "uid"
       IDP_LDAP_UUID_ATTRIBUTE: "ownclouduuid"
       IDP_LDAP_UUID_ATTRIBUTE_TYPE: binary
-      PROXY_ACCOUNT_BACKEND_TYPE: cs3
-      # web ui
-      WEB_UI_CONFIG: "/var/tmp/ocis/.config/web-config.json"
+      GRAPH_LDAP_SERVER_WRITE_ENABLED: "false" # assuming the external ldap is readonly
+      # OCIS_RUN_EXTENSIONS specifies to start all extensions except glauth, idm and accounts. These are replaced by external services
+      OCIS_RUN_EXTENSIONS: app-registry,app-provider,audit,auth-basic,auth-bearer,auth-machine,frontend,gateway,graph,graph-explorer,groups,idp,nats,notifications,ocdav,ocs,proxy,search,settings,sharing,storage-system,storage-publiclink,storage-shares,storage-users,store,thumbnails,users,web,webdav
       # General oCIS config
       OCIS_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
-      OCIS_DOMAIN: ${OCIS_DOMAIN:-ocis.owncloud.test}
       OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-error} # make oCIS less verbose
       PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
-      # change default secrets
-      OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
-      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET:-replace-me-with-a-transfer-secret}
-      OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
       # INSECURE: needed if oCIS / Traefik is using self generated certificates
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
-      # demo users
-      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
-      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
+      # admin user password
     volumes:
-      - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
-      - ./config/ocis/web-config.dist.json:/config/web-config.dist.json
-      - ./config/ocis/proxy.yaml:/etc/ocis/proxy.yaml
+      - ocis-config:/etc/ocis
       - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
@@ -124,7 +120,7 @@ services:
     restart: always
 
   ldap-manager:
-    image: osixia/phpldapadmin:0.9.0
+    image: osixia/phpldapadmin:latest
     networks:
       ocis-net:
     environment:
@@ -143,6 +139,7 @@ services:
 
 volumes:
   certs:
+  ocis-config:
   ocis-data:
 
 networks: