mkdir -p /data/openldap/{data,config}

cat > docker-compose.yaml << EOF
version: "2"
services:
  openldap:
    container_name: "openldap"
    image: "osixia/openldap:latest"
    restart: always
    environment:
      LDAP_ORGANISATION: "openldap"
      LDAP_DOMAIN: "treesir.pub"
      LDAP_ADMIN_PASSWORD: "123456"
      LDAP_CONFIG_PASSWORD: "123456"
    volumes:
      - /data/openldap/data:/var/lib/ldap
      - /data/openldap/config:/etc/ldap/slapd.d
    ports:
      - '389:389'
  phpldapadmin:
    container_name: "phpldapadmin"
    image: "osixia/phpldapadmin:latest"
    restart: always
    links:
      - "openldap"
    environment:
      PHPLDAPADMIN_HTTPS: "false"
      PHPLDAPADMIN_LDAP_HOSTS: "openldap"
    ports:
      - '30004:80'
EOF

docker-compose up -d

docker pull grams/ltb-self-service-password 

mkdir -p /etc/ldap-repasswd \
&& cd /etc/ldap-repasswd

wget https://cdn.treesir.pub/application/openldap/config.inc.php

vim config.inc.php  # 修改配置文件中 ldap 信息
$ldap_url = "ldap://192.168.8.1:389";
$ldap_starttls = false;
$ldap_binddn = "cn=admin,dc=treesir,dc=pub";
$ldap_bindpw = "123456";
$ldap_base = "dc=treesir,dc=pub";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";

# 启动容器
docker run -p 8765:80 -d \
--restart always \
-v /etc/ldap-repasswd/config.inc.php:/usr/share/self-service-password/conf/config.inc.php \
--name ldap-repasswd \
grams/ltb-self-service-password

 # 如开启了 防火墙 需要将 端口 开放出来
firewall-cmd --zone=public --add-port=8765/tcp --permanent && firewall-cmd --reload

#!/bin/bash

##########################################################
# Author        : LeafyJohn
# Email         : amoaloas@gmail.com
# Last modified : 2020-12-21 10:38:27
# Description   : openLdap backupup
# License: Attribution-NonCommercial 4.0 International
###########################################################
  
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
export PATH
BACKPATH=/data/rsyncd-backup/openldap
KEEPVERSION=30
function BACK() {
        ldapsearch -x -D "cn=admin,dc=treesir,dc=pub" -w '123456' -b 'dc=treesir,dc=pub' -LLL -H ldap://192.168.8.1 > "${BACKPATH}"/`date +"%Y%m%d"`.ldif
}

function CLEAR() {
        NUB=`ls "$BACKPATH"|wc -l`
        if [ "$NUB" -gt "$KEEPVERSION" ]
        then
                KEEP=`echo "$NUB - $KEEPVERSION"|bc`
                for DEL in `ls "$BACKPATH"|sort -nr 2>&1|tail -n "$KEEP"` 
                do
                        rm -rf  "$BACKPATH"/"$DEL"
                done
        fi
}


function main() {
        BACK
        CLEAR
}
main

0 0 * * 1-5 bash /data/scripts/openldap-backup.sh >/dev/null 2>&1

gitlab_rails['ldap_enabled'] = true
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
    main: # 'main' is the GitLab 'provider ID' of this LDAP server
      label: 'LDAP'
      host: 'treesir.pub'
      port: 389 # usually 636 for SSL
      uid: 'uid' # This should be the attribute, not the value that maps to uid.
      # Examples: 'america\\momo' or 'CN=Gitlab Git,CN=Users,DC=mydomain,DC=com'
      bind_dn: 'cn=admin,dc=treesir,dc=pub'
      password: '123456'
      encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
      active_directory: false
      allow_username_or_email_login: false
      base: 'ou=users,dc=treesir,dc=pub'
      user_filter: ''
      attributes:
        username: ['uid', 'userid', 'sAMAccountName']
        email:    ['mail', 'email', 'userPrincipalName']
        name:       'cn'
        first_name: 'givenName'
        last_name:  'sn'
EOS

gitlab-ctl reconfigure

gitlab-ctl restart  # 重载配置 后 重启服务器生效