Opinionated docker image is currently based on the [Debian](https://www.debian.org/) docker image [`debian:bullseye-slim`](https://hub.docker.com/_/debian?tab=tags&name=bullseye-slim) to run an [OpenLDAP 2.4](https://www.openldap.org/doc/admin24/) server.
To keep the image light and simple, it does not configure TLS. Instead we recommend configuring a [Traefik 2.x](https://traefik.io) [TCP service](https://docs.traefik.io/routing/services/#configuring-tcp-services) with e.g. an auto-renewing [Let's Encrypt configuration](https://docs.traefik.io/https/acme/) in front of the OpenLDAP service.
LDAP_INIT_PASSWORD_RESET_GROUP_DN='cn=ldap-password-reset,ou=Groups,${LDAP_INIT_ORG_DN}' # users in this group can set password/sshPublicKey attribute of other users
1. Using an [env-file](https://docs.docker.com/compose/env-file/) to store all changed variables and use the option `--env-file` with `docker run`, e.g.:
```sh
docker run -itd --env-file environment vegardit/openldap
```
In environment file values must not be enclosed using quotes (`'` or `"`), please remove them. See this example file: [example/docker/example.env](example/docker/example.env).
1. Setting the environment variable `INIT_SH_FILE` pointing to a shell script that should be sourced during the container start.
On **initial** container launch, the [password policy](https://www.openldap.org/doc/admin24/overlays.html#Password%20Policies) is imported from [/opt/ldifs/init_org_ppolicy.ldif](image/ldifs/init_org_ppolicy.ldif)
If more customizations are required, simply mount a custom policy file at `/opt/ldifs/init_org_ppolicy.ldif`**before** initial container launch.
**Password Quality Checker:**
[pqChecker](https://www.meddeb.net/pqchecker/) is configured as default password quality checker using the rule `0|01010101` with
the following meaning:
|Pos. |Value |Effective Rule
|----:|:-----:|:----------
|0-1 | `0\|`|Don't broadcast passwords.
|2-4 | `01` |Minimum 1 uppercase character.
|5-6 | `01` |Minimum 1 lowercase character.
|7-8 | `01` |Minimum 1 digit.
|9-10 | `01` |Minimum 1 special character.
|11-..| empty | No characters are disallowed in passwords.
The pqChecker rule syntax is explained here in more detail: https://www.meddeb.net/pqchecker/?Idx=2
A custom rule can be provided via an environment variable, e.g.:
```sh
LDAP_PPOLICY_PQCHECKER_RULE='0|01020101@!+-#'
```
### <a name="uidgid"></a>Changing UID/GID of OpenLDAP service user
The UID/GID of the user running the OpenLDAP service can be aligned with the docker host, using the environment variables
`LDAP_OPENLDAP_UID` and `LDAP_OPENLDAP_GID`.
During each container start it is verified that the given UID/GID matches the currently effective UID/GID. If not, the UID/GID
of the `openldap` user are changed accordingly and `chown` on `/etc/ldap` and `/var/lib/slapd` is executed before the OpenLDAP service is started.
### <a name="backup"></a>Periodic LDAP Backup
This image automatically generates a daily LDIF export at `2 a.m.` to `/var/lib/ldap/data.ldif`.
The following environment variables can be used to configure the automatic LDAP backup:
```bash
LDAP_BACKUP_TIME='02:00' # Format is "HH:MM", i.e. 24-hour format with minute precision
LDAP_BACKUP_FILE='/var/lib/ldap/data.ldif'
```
To disable automatic backup set an empty value for the environment variable `LDAP_BACKUP_TIME`.
### <a name="timesync"></a>Synchronizing timezone/time with docker host
To use the same timezone and/or time of the docker host you can run the docker image with `--volume /etc/localtime:/etc/localtime:ro --volume /etc/timezone:/etc/timezone:ro`
The database indexes that are configured during initial container launch are imported from [/opt/ldifs/init_backend_indexes.ldif](image/ldifs/init_mdb_indexes.ldif)
To use other indexes, simply mount a custom file at `/opt/ldifs/init_backend_indexes.ldif`**before** initial container launch.
#### Memory usage
The maximum number of open files is set to `1024` by default to prevent excessive RAM consumption as reported [here](https://github.com/docker/docker/issues/8231).
The following environment variable can be used to increase this limit:
```sh
LDAP_NOFILE_LIMIT=2048
```
### <a name="troubleshooting"></a>Troubleshooting
The slapd service logs to stdout. You can change the active log levels by setting this environment variable:
```sh
LDAP_LOG_LEVELS='Config Stats'
```
The following [log levels](https://www.openldap.org/doc/admin24/slapdconfig.html#loglevel%20%3Clevel%3E) are available:
