momar/peopled repository overview

version: "3"
services:
  # Reverse proxy for TLS termination
  proxy:
    image: caddy
    # TODO: adjust the external domain
    command: ["caddy", "reverse-proxy", "--from", "account.werkundkultur.de", "--to", "peopled:80"]
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
    - "./data/caddy:/data/caddy"
  
  # OpenLDAP container with automated backups
  openldap:
    image: tiredofit/openldap:develop
    restart: unless-stopped
    ports:
    - "389:389"
    - "636:636"
    volumes:
    - "./data/ldap-data:/var/lib/openldap"
    - "./data/ldap-slapd.d:/etc/openldap/slapd.d"
    - "./data/ldap-backup:/data/backup"
    - "./data/ldap-certs:/assets/slapd/certs"
    # add :ro at the end when providing own certificates, and make sure that they're readable by UID 999
    - "./data/caddy/certificates/acme-v02.api.letsencrypt.org-directory:/assets/slapd/certs/caddy"
    environment:
      ORGANIZATION: "Werk- und Kulturscheune" # TODO: give your organisation a name
      DOMAIN: "werkundkultur.de" # TODO: choose an LDAP domain
      
      # TODO: generate one password for each user: echo $(cat /dev/urandom | tr -dc 'A-Za-z0-9' | head -c64 | tail)
      ADMIN_PASS: ""
      CONFIG_PASS: ""
      READONLY_USER_PASS: ""
      ENABLE_READONLY_USER: "true"
      
      # TODO: domain must be the same as in Caddy
      # when using own certificates, make sure to use the full chain
      TLS_CRT_FILENAME: caddy/account.werkundkultur.de/account.werkundkultur.de.crt
      TLS_CA_CRT_FILENAME: caddy/account.werkundkultur.de/account.werkundkultur.de.crt
      TLS_KEY_FILENAME: caddy/account.werkundkultur.de/account.werkundkultur.de.key
      TLS_RESET_PERMISSIONS: "true" # TODO: set to "false" when using own certificates
      
      TLS_VERIFY_CLIENT: never
      TLS_ENFORCE: "true"
      ENABLE_NGINX: "false"

  peopled:
    image: momar/peopled
    restart: unless-stopped
    volumes:
    - "./data/peopled:/var/peopled"
    # ports: ["80:80"]
    # peopled doesn't have integrated TLS support, you will need a reverse proxy (like Caddy; see above)
    environment:
      # TODO: domain must be the same as in Caddy, but with a "https://" prefix - for embedding, see below
      CANONICAL_ROOT_URL: "https://account.werkundkultur.de"
      TRUST_PROXY: "true"
      # LOG_LEVEL: trace # uncomment to enable debugging
      
      LDAP_ADDRESS: ldaps://account.werkundkultur.de:636 # TODO: must be the same as in Caddy
      LDAP_DOMAIN: "werkundkultur.de" # TODO: must be the same as LDAP_DOMAIN above
      LDAP_PASSWORD: "" # TODO: must be the same as LDAP_ADMIN_PASSWORD above
      
      REQUIRE_ACCEPT: terms,privacy
      # TODO: adjust these links, they will be shown during the signup!
      LINK_terms: "https://www.werkundkultur.de/nutzungsbedingungen/"
      LINK_privacy: "https://www.werkundkultur.de/impressum/"
      LINK_mail: "[email protected]"
      
      # TODO: set up an SMTP server here for sending email - only required when signups and password resets are enabled
      SMTP_SERVER: "example.org:587"
      SMTP_USERNAME: "..."
      SMTP_PASSWORD: "..."
      SMTP_FROM: "Werk- und Kulturscheune <[email protected]>"
      
      # For the full documentation, see THE YET-TO-EXIST DOCUMENTATION LINK!

<iframe src="data:text/plain;charset=utf-8,JavaScript must be enabled to access peopled!" frameborder="0" width="100%" height="130" id="peopled"></iframe>
<script>
    document.getElementById("peopled").src = "https://account.werkundkultur.de" + location.hash; // TODO: must be the real URL of the peopled UI
    window.addEventListener("message", ev => {
        if (typeof ev.data.peopledScrollHeight !== "undefined") document.getElementById("peopled").height = ev.data.peopledScrollHeight + 2;
        if (ev.data.peopledRemoveHash === true) history.replaceState(null, "", " ");
        if (ev.data.peopledScrollToTop === true) window.scrollTo(0, 0);
    }, false);
</script>