grafana:
  grafana.ini:
    auth.ldap:
      allow_sign_up: true
      config_file: /etc/grafana/ldap.toml
      enabled: true

grafana:
  ldap:
    config: |
      [[servers]]
      host = "test.zerchin.xyz" 
      port = 389
      use_ssl = false
      start_tls = false
      ssl_skip_verify = true
      bind_dn = "cn=admin,dc=rancherldap,dc=com"
      bind_password = 'Rancher123'
      search_filter = "(cn=%s)"
      search_base_dns = ["cn=group,ou=rancher,dc=rancherldap,dc=com"]
      [servers.attributes]
      name = "givenName"
      surname = "sn"
      username = "cn"
      member_of = "memberOf"
      email = "email"
    enabled: true

# 如下所示，superuser 是在我们的 Elasticsearch 中已经定义好的 role。赋予如下账户 superuser 角色
superuser:
   - "cn=liuxg,ou=users,dc=example,dc=com"
   - "cn=xgliu,ou=users,dc=example,dc=com"
   - "employeeNumber=1,ou=users,dc=example,dc=com"

POST /_security/role_mapping/mapping1
{
  "roles": [ "user"],
  "enabled": true, 
  "rules": {
    "field" : { "username" : "*" }
  },
  "metadata" : { 
    "version" : 1
  }
}

{
  "role_mapping" : {
    "created" : true 
  }
}

POST /_security/role_mapping/mapping2
{
  "roles": [ "user", "admin" ],
  "enabled": true,
  "rules": {
     "field" : { "username" : [ "esadmin01", "esadmin02" ] }
  }
}

POST /_security/role_mapping/mapping3
{
  "roles": [ "ldap-user" ],
  "enabled": true,
  "rules": {
    "field" : { "realm.name" : "ldap1" }
  }
}

POST /_security/role_mapping/mapping4
{
  "roles": [ "superuser" ],
  "enabled": true,
  "rules": {
    "any": [
      {
        "field": {
          "username": "esadmin"
        }
      },
      {
        "field": {
          "groups": "cn=admins,dc=example,dc=com"
        }
      }
    ]
  }
}

POST /_security/role_mapping/mapping5
{
  "role_templates": [
    {
      "template": { "source": "{{#tojson}}groups{{/tojson}}" }, 
      "format" : "json" 
    }
  ],
  "rules": {
    "field" : { "realm.name" : "saml1" }
  },
  "enabled": true
}

POST /_security/role_mapping/mapping6
{
  "roles": [ "example-user" ],
  "enabled": true,
  "rules": {
    "field" : { "dn" : "*,ou=subtree,dc=example,dc=com" }
  }
}

POST /_security/role_mapping/mapping7
{
  "roles": [ "ldap-example-user" ],
  "enabled": true,
  "rules": {
    "all": [
      { "field" : { "dn" : "*,ou=subtree,dc=example,dc=com" } },
      { "field" : { "realm.name" : "ldap1" } }
    ]
  }
}

POST /_security/role_mapping/mapping8
{
  "roles": [ "superuser" ],
  "enabled": true,
  "rules": {
    "all": [
      {
        "any": [
          {
            "field": {
              "dn": "*,ou=admin,dc=example,dc=com"
            }
          },
          {
            "field": {
              "username": [ "es-admin", "es-system" ]
            }
          }
        ]
      },
      {
        "field": {
          "groups": "cn=people,dc=example,dc=com"
        }
      },
      {
        "except": {
          "field": {
            "metadata.terminated_date": null
          }
        }
      }
    ]
  }
}

POST /_security/role_mapping/mapping9
{
  "rules": { "field": { "realm.name": "cloud-saml" } },
  "role_templates": [
    { "template": { "source" : "saml_user" } }, 
    { "template": { "source" : "_user_{{username}}" } }
  ],
  "enabled": true
}

# GET /_security/role_mapping/admins
# DELETE /_security/role_mapping/admins
# GET /_security/role_mapping/basic_users
# DELETE /_security/role_mapping/basic_users

# 对管理员的绑定
PUT /_security/role_mapping/admins
{
  "roles" : [ "superuser" ],
  "rules" : { "field" : {
    "dn" : "uid=xiaowu,ou=people,dc=extension,dc=sopei"
  } },
  "enabled": true
}

# 对普通用户的绑定，例子中仅对开发组成员赋权
PUT /_security/role_mapping/basic_users
{
    "enabled" : true,
    "roles" : [ 
      "log-all-viewer",
      "devlopment",
      "reporting_user" 
    ],
    "rules" : {
      "any" : [
        {
          "field" : {
            "groups" : "cn=od-3d5d12d234493102cbc1ceef154d9c38,ou=feishuroot,dc=extension,dc=sopei"
          }
        }
      ]
    },
    "metadata" : { }
}

version: '3'

services:
  yapi-web:
    image: jayfong/yapi:1.10.2
    container_name: yapi-web
    ports:
      - 40001:3000
    environment:
      - YAPI_ADMIN_ACCOUNT=admin@xxx.yapi
      - YAPI_ADMIN_PASSWORD=xxx
      - YAPI_NPM_REGISTRY=https://registry.npm.taobao.org
      - YAPI_CLOSE_REGISTER=true
      - YAPI_DB_SERVERNAME=<mongoIp>
      - YAPI_DB_PORT=<mongoPort>
      - YAPI_DB_DATABASE=<mongoDatabase>
      - YAPI_DB_USER=<mongoUser>
      - YAPI_DB_PASS=<mongoPass>
      - YAPI_DB_AUTH_SOURCE=<MongoDB 身份认证所用库>
      - YAPI_MAIL_ENABLE=false
      - YAPI_LDAP_LOGIN_ENABLE=true
      - YAPI_LDAP_LOGIN_SERVER=ldap://<ldapIp>:<ldapPort>
      - YAPI_LDAP_LOGIN_BASE_DN=<ldap管理员dn>
      - YAPI_LDAP_LOGIN_BIND_PASSWORD=<ldap管理员密码>
      - YAPI_LDAP_LOGIN_SEARCH_DN=<ldap用户搜索范围>
      # 下面这个是 user filter，按此格式进行进行修改
      - YAPI_LDAP_LOGIN_SEARCH_STANDARD=&(objectClass=inetOrgPerson)(cn=%s)
      # 邮箱后缀，经测试似乎没啥用
      - YAPI_LDAP_LOGIN_EMAIL_POSTFIX='@eryajf.net'
      # ldap 映射字段
      - YAPI_LDAP_LOGIN_EMAIL_KEY=mail
      - YAPI_LDAP_LOGIN_USERNAME_KEY=cn
      - YAPI_PLUGINS=[]
    restart: unless-stopped

gitlab_rails['ldap_enabled'] = true
gitlab_rails['prevent_ldap_sign_in'] = false
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS' # remember to close this block with 'EOS' below
'main' => {
  'label' => 'LDAP',
  'host' =>  'ldap.mydomain.com',
  'port' => 389,
  'uid' => '<sAMAccountName> 或 <uid>',
  'encryption' => 'simple_tls',
  'verify_certificates' => false,
  'bind_dn' => '管理员dn',
  'password' => '管理员pass',
  # 可选
  'tls_options' => {
    'ca_file' => '',
    'ssl_version' => '',
    'ciphers' => '',
    'cert' => '',
    'key' => ''
  },
  'timeout' => 10,
  # 此处配置 ldap 源服务器是否是 ad，如果此处设置 true，那么 allow_username_or_email_login 最好设置为 false
  'active_directory' => true,
  'allow_username_or_email_login' => true,
  'block_auto_created_users' => false,
  # 此处设置 user find dn
  'base' => 'ou=people,dc=extension,dc=net',
  'user_filter' => '',
  # 字段映射
  'attributes' => {
    'username' => ['uid', 'userid', 'sAMAccountName'],
    'email' => ['mail', 'email', 'userPrincipalName'],
    'name' => 'cn',
    'first_name' => 'givenName',
    'last_name' => 'sn'
  },
  'lowercase_usernames' => false,
EOS

'label' => 'LDAP' # 该字段为 LDAP 服务名称，该名称会展示在 GitLab Portal 的登陆界面
'host' =>  'ldap.mydomain.com' # 该字段为 LDAP 服务器的地址
'bind_dn' => '_the_full_dn_of_the_user_you_will_bind_with' # 该字段为 LDAP 管理员用户的 DN
'password' => '_the_password_of_the_bind_user' # 该字段为 LDAP 管理员用户的 password

# 例如，你可以通过配置 user_filter 将部分 ldap 用户同步到 GitLab 中
'(employeeType=developer)'
'(&(objectclass=user)(|(samaccountname=momo)(samaccountname=toto)))'

gitlab_rails['ldap_sync_worker_cron'] = "0 */12 * * *"