TLS

README.md

@@ -11,7 +11,8 @@ Both payment methods feed the same LDAP group reconciliation and local expiry.
 1. Anyone can request a free account. A one-hour, single-use email link allows
 	them to choose a password. The account is created as an `inetOrgPerson` in
 	OpenLDAP; the password goes only through RFC 3062 Password Modify over
-	certificate-verified LDAPS/StartTLS. This app never stores a password/hash.
+	certificate-verified LDAPS/StartTLS by default (see the explicit plaintext
+	option below). This app never stores a password/hash.
 2. Sign-in uses Dex Authorization Code + PKCE, state and nonce. Authlib verifies
 	the RS256 ID token, issuer, audience, signature and lifetime. A signed
 	`federated_claims` connector/user ID must match the configured LDAP connector
@@ -89,7 +90,13 @@ of these five prices when inspected.
 	tree**, including other account registrars. Only then set
 	`LDAP_PASSWORD_SCHEME={ARGON2}`. The app does not alter slapd configuration.
 	If a private CA is used, mount its certificate read-only into both membership
-	and worker services and set `LDAP_CA_CERT_FILE`. TLS verification is mandatory.
+	and worker services and set `LDAP_CA_CERT_FILE`. TLS verification is mandatory
+	when TLS is used. To deliberately use plaintext on a trusted internal network,
+	set `LDAP_URL=ldap://openldap.openldap.svc.cluster.local:389` and
+	`LDAP_ALLOW_INSECURE=1` in both web and worker environments. This skips StartTLS
+	and exposes bind passwords, registration passwords and directory data to the
+	network. The default is `0` (StartTLS required for `ldap://`); TLS failures never
+	trigger a plaintext fallback, and `ldaps://` always verifies certificates.
 4. Add a dedicated Dex client/LDAP connector using
 	[membership/deploy/dex-membership.example.yaml](membership/deploy/dex-membership.example.yaml).
 	The exact callback is `https://eom.dev/members/oidc/callback/` (trailing slash).