29 lines
1.2 KiB
YAML
Executable File
29 lines
1.2 KiB
YAML
Executable File
---
|
|
# Passwords supplied in a Vault-encrypted inventory, never in this example.
|
|
dex_issuer: https://dex.eom.dev/
|
|
dex_hostname: dex.eom.dev
|
|
dex_postgres_manage: false
|
|
dex_postgres_host: postgresql
|
|
dex_postgres_database: dex
|
|
dex_postgres_user: dex
|
|
# Legacy credential names are still supported by defaults:
|
|
# dex_admin_password, openldap_readonly_password, matrix_dex_oidc_client_secret.
|
|
|
|
# Existing Secret in the Dex namespace. WWW_DEX_CLIENT_SECRET must match the
|
|
# www membership app's DEX_CLIENT_SECRET. DEX_LDAP_BIND_PASSWORD is the search
|
|
# account password; no real values go in this public file.
|
|
dex_env_secret_name: dex-client-secrets
|
|
dex_static_clients:
|
|
- id: www-membership
|
|
name: eom.dev Membership
|
|
secretEnv: WWW_DEX_CLIENT_SECRET
|
|
redirectURIs:
|
|
- https://www.eom.dev/members/oidc/callback/
|
|
|
|
# One LDAP connector admits both legacy POSIX accounts and website accounts.
|
|
# Keep its ID and idAttr unchanged so existing OIDC subjects remain stable.
|
|
dex_ldap_connector_id: ldap
|
|
dex_ldap_id_attribute: uid
|
|
dex_ldap_user_base_dn: dc=eom,dc=dev
|
|
dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
|