✨ Allow list of LDAP servers

.env

@@ -0,0 +1,50 @@
+# Set all your environment variables here
+
+
+#########################################
+## GENERAL
+#########################################
+
+HOSTNAME=localhost
+# Adapt to your production domain and use a reverse proxy
+#HOSTNAME=taiga.company.com
+
+PORT=80
+
+TAIGA_DB_PWD=somethingverysecure,changethis!
+
+
+#########################################
+## SECURITY
+#########################################
+
+TAIGA_SECRET=somethingevenmoresecure!!really,changethis!
+
+TAIGA_ADMIN_PASSWORD=betterthan123123
+
+#########################################
+## EMAIL
+#########################################
+
+TAIGA_EMAIL_DOMAIN=company.com
+TAIGA_SMTP_USER=
+TAIGA_SMTP_PWD=
+
+#########################################
+## LDAP
+#########################################
+
+TAIGA_ENABLE_LDAP=True
+# Adapt to your base domain name
+TAIGA_LDAP_DOMAIN=ldap.company.com
+TAIGA_LDAP_BASE_DN=ou=People,dc=company,dc=com
+
+TAIGA_LDAP_BIND_DN=
+TAIGA_LDAP_BIND_PASSWORD=
+
+#########################################
+## EVENTS
+#########################################
+
+TAIGA_RABBIT_USER=taiga
+TAIGA_RABBIT_PASSWORD=somethingverysecure

.gitignore

@@ -2,3 +2,5 @@ __pycache__
 *.eggs
 *.egg-info
 dist
+.idea
+.env

Dockerfile

@@ -0,0 +1,39 @@
+#TODO: How to give ability to another version and variant?
+FROM monogramm/docker-taiga-back-base:4.2-alpine
+LABEL maintainer="Monogramm maintainers <opensource at monogramm dot io>"
+
+# Taiga additional properties
+ENV TAIGA_ENABLE_LDAP=False \
+    TAIGA_LDAP_USE_TLS=True \
+    TAIGA_LDAP_SERVERS= \
+    TAIGA_LDAP_PORT=389 \
+    TAIGA_LDAP_BIND_DN= \
+    TAIGA_LDAP_BIND_PASSWORD= \
+    TAIGA_LDAP_BASE_DN= \
+    TAIGA_LDAP_USERNAME_ATTRIBUTE=uid \
+    TAIGA_LDAP_EMAIL_ATTRIBUTE=mail \
+    TAIGA_LDAP_FULL_NAME_ATTRIBUTE=cn \
+    TAIGA_LDAP_SAVE_LOGIN_PASSWORD=True \
+    TAIGA_LDAP_FALLBACK=normal
+
+# Erase original entrypoint and conf with custom one
+COPY local.py /taiga/
+COPY entrypoint.sh ./
+
+RUN set -ex ; \
+    mkdir /usr/src/taiga-contrib-ldap-auth-ext;
+
+COPY . /usr/src/taiga-contrib-ldap-auth-ext/
+
+RUN set -ex ; \
+    python /usr/src/taiga-contrib-ldap-auth-ext/setup.py bdist_wheel;
+
+COPY dist/taiga_contrib_ldap_auth_ext-0.4.4-py3-none-any.whl ./
+# Fix entrypoint permissions
+# Install LDAP extension
+RUN set -ex; \
+    chmod 755 /entrypoint.sh; \
+    LC_ALL=C pip install --no-cache-dir /usr/src/taiga-contrib-ldap-auth-ext/dist/taiga_contrib_ldap_auth_ext-0.4.4-py3-none-any.whl;
+    #rm -r /usr/local/lib/python3.6/site-packages/taiga_contrib_ldap_auth_ext
+# Backend healthcheck
+HEALTHCHECK CMD curl --fail http://127.0.0.1:8001/api/v1/ || exit 1

README.md

@@ -33,7 +33,7 @@ Add the following to `settings/local.py`:
 INSTALLED_APPS += ["taiga_contrib_ldap_auth_ext"]
 
 # TODO https://github.com/Monogramm/taiga-contrib-ldap-auth-ext/issues/16
-LDAP_SERVER = 'ldap://ldap.example.com'
+LDAP_SERVERS = ['ldap://ldap.example1.com','ldap://ldap.example2.com']
 LDAP_PORT = 389
 
 # Flag to enable LDAP with STARTTLS before bind

docker-compose.yml

@@ -0,0 +1,230 @@
+version: '2'
+
+services:
+  taigadb:
+    image: postgres:10-alpine
+    container_name: taigadb
+    #restart: always
+    ports:
+      - 5432:5432
+    volumes:
+      - /srv/taiga/db/data:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=taiga
+      - POSTGRES_USER=taiga
+      - POSTGRES_PASSWORD=${TAIGA_DB_PWD}
+
+  taiga_back:
+    # For CI or local modifications
+    build:
+      context: .
+      dockerfile: Dockerfile
+    # For production
+    #image: monogramm/docker-taiga-back:4.2-alpine
+    hostname: ${HOSTNAME}
+    container_name: taiga_back
+    #restart: always
+    depends_on:
+      - taigadb
+    ports:
+      - 8001:8001
+    volumes:
+      # Media and uploads directory. Required (or you will lose all uploads)
+      - /srv/taiga/back/media:/usr/src/taiga-back/media
+      - /srv/taiga/back/static:/usr/src/taiga-back/static
+      # Taiga configuration directory. Makes it easier to change configuration with your own
+      #- /srv/taiga/back/conf:/taiga
+      - /usr/local/lib/python3.6/site-packages/taiga_contrib_ldap_auth_ext
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/timezone:/etc/timezone:ro
+    environment:
+      # Your hostname (REQUIRED)
+      - TAIGA_HOSTNAME=${HOSTNAME}:${PORT}
+      #- TAIGA_SSL=False
+      #- TAIGA_SSL_BY_REVERSE_PROXY=True
+      # Secret key for cryptographic signing
+      - TAIGA_SECRET_KEY=${TAIGA_SECRET}
+      # Admin account default password
+      - TAIGA_ADMIN_PASSWORD=${TAIGA_ADMIN_PASSWORD}
+      # Database settings
+      - TAIGA_DB_HOST=taigadb
+      - TAIGA_DB_NAME=taiga
+      - TAIGA_DB_USER=taiga
+      - TAIGA_DB_PASSWORD=${TAIGA_DB_PWD}
+      # when the db comes up from docker, it is usually too quick
+      - TAIGA_SLEEP=5
+      # To use an external SMTP for emails, fill in these values:
+      - TAIGA_ENABLE_EMAIL=True
+      - TAIGA_EMAIL_FROM=taiga@${TAIGA_EMAIL_DOMAIN}
+      - TAIGA_EMAIL_USE_TLS=True
+      - TAIGA_EMAIL_HOST=smtp.${TAIGA_EMAIL_DOMAIN}
+      - TAIGA_EMAIL_PORT=587
+      - TAIGA_EMAIL_USER=${TAIGA_SMTP_USER}
+      - TAIGA_EMAIL_PASS=${TAIGA_SMTP_PWD}
+      # Backend settings
+      - TAIGA_DEBUG=False
+      - TAIGA_PUBLIC_REGISTER_ENABLED=False
+      - TAIGA_FEEDBACK_ENABLED=True
+      - TAIGA_FEEDBACK_EMAIL=taiga@${TAIGA_EMAIL_DOMAIN}
+      # Events settings
+      - TAIGA_EVENTS_ENABLED=True
+      - RABBIT_USER=${TAIGA_RABBIT_USER}
+      - RABBIT_PASSWORD=${TAIGA_RABBIT_PASSWORD}
+      - RABBIT_VHOST='/'
+      - RABBIT_HOST=taiga_rabbit
+      - RABBIT_PORT=5672
+      # Async settings
+      # To enable async mode, uncomment the following lines:
+      #- TAIGA_ASYNC_ENABLED=True
+      #- REDIS_HOST=taiga_redis
+      #- REDIS_PORT=6379
+      ### Additional parameters
+      # LDAP Settings
+      - TAIGA_ENABLE_LDAP=${TAIGA_ENABLE_LDAP}
+      - TAIGA_LDAP_USE_TLS=False
+      - TAIGA_LDAP_SERVERS=ldaps://${TAIGA_LDAP_DOMAIN_1},ldaps://${TAIGA_LDAP_DOMAIN_2},ldaps://${TAIGA_LDAP_DOMAIN_3}
+      - TAIGA_LDAP_PORT=636
+      - TAIGA_LDAP_BIND_DN=${TAIGA_LDAP_BIND_DN}
+      - TAIGA_LDAP_BIND_PASSWORD=${TAIGA_LDAP_BIND_PASSWORD}
+      - TAIGA_LDAP_BASE_DN=${TAIGA_LDAP_BASE_DN}
+      - TAIGA_LDAP_USERNAME_ATTRIBUTE=uid
+      - TAIGA_LDAP_EMAIL_ATTRIBUTE=mail
+      - TAIGA_LDAP_FULL_NAME_ATTRIBUTE=displayName
+      - TAIGA_LDAP_FALLBACK=normal
+
+  taiga_front:
+    # For CI or local modifications
+    #build: ./front
+    # For production
+    image: monogramm/docker-taiga-front:4.2-alpine
+    hostname: ${HOSTNAME}
+    container_name: taiga_front
+    #restart: always
+    depends_on:
+      - taiga_back
+      # To disable taiga-events, comment the following lines:
+      - taiga_events
+      - taiga_rabbit
+      # To enable async mode, uncomment the following lines:
+      #- taiga_redis
+    ports:
+      # If using SSL, uncomment 443 and comment out 80
+      - ${PORT}:80
+      #- ${PORT}:443
+    volumes:
+      # Media and uploads directory. Required for NGinx
+      - /srv/taiga/back/media:/usr/src/taiga-back/media:ro
+      - /srv/taiga/back/static:/usr/src/taiga-back/static:ro
+      # Taiga configuration directory. Makes it easier to change configuration with your own
+      #- /srv/taiga/front/conf:/taiga
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/timezone:/etc/timezone:ro
+    environment:
+      # Your hostname (REQUIRED)
+      - TAIGA_HOSTNAME=${HOSTNAME}:${PORT}
+      #- TAIGA_SSL=True
+      #- TAIGA_SSL_BY_REVERSE_PROXY=True
+      #- TAIGA_BACKEND_SSL=True
+      # Frontend settings
+      - TAIGA_DEBUG=false
+      - TAIGA_DEBUG_INFO=false
+      - TAIGA_DEFAULT_LANGUAGE=en
+      - TAIGA_THEMES=taiga material-design high-contrast
+      - TAIGA_DEFAULT_THEME=taiga
+      - TAIGA_PUBLIC_REGISTER_ENABLED=false
+      - TAIGA_FEEDBACK_ENABLED=true
+      - TAIGA_SUPPORT_URL=https://tree.taiga.io/support
+      - TAIGA_PRIVACY_POLICY_URL=
+      # Backend settings
+      - TAIGA_BACK_HOST=taiga_back
+      - TAIGA_BACK_PORT=8001
+      # Events settings
+      - TAIGA_EVENTS_ENABLED=True
+      - TAIGA_EVENTS_HOST=taiga_events
+      - TAIGA_EVENTS_PORT=8888
+
+  # To disable taiga-events, comment all the following lines:
+  taiga_rabbit:
+    image: rabbitmq:3-alpine
+    hostname: taiga_rabbit
+    container_name: taiga_rabbit
+    #restart: always
+    ports:
+      - 5672:5672
+    environment:
+      - RABBITMQ_DEFAULT_USER=${TAIGA_RABBIT_USER}
+      - RABBITMQ_DEFAULT_PASS=${TAIGA_RABBIT_PASSWORD}
+
+  taiga_events:
+    image: monogramm/docker-taiga-events:alpine
+    container_name: taiga_events
+    #restart: always
+    links:
+      - taiga_rabbit
+    ports:
+      - 8888:8888
+    environment:
+      - RABBIT_USER=${TAIGA_RABBIT_USER}
+      - RABBIT_PASSWORD=${TAIGA_RABBIT_PASSWORD}
+      - RABBIT_VHOST='/'
+      - RABBIT_HOST=taiga_rabbit
+      - RABBIT_PORT=5672
+      - TAIGA_EVENTS_SECRET=${TAIGA_SECRET}
+      - TAIGA_EVENTS_PORT=8888
+
+  taiga_dev_mailer:
+    image: sj26/mailcatcher:latest
+    hostname: taiga_dev_mailer
+    container_name: taiga_dev_mailer
+    restart: always
+    expose:
+      - 1025
+    ports:
+      - 1080:1080
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/timezone:/etc/timezone:ro
+
+  openldap:
+    image: osixia/openldap:latest
+#    environment:
+#      LDAP_LOG_LEVEL: ${LDAP_LOG_LEVEL}
+#      LDAP_ORGANISATION: ${LDAP_ORGANISATION}
+#      LDAP_DOMAIN: ${LDAP_DOMAIN}
+#      LDAP_BASE_DN: ${LDAP_BASE_DN}
+#      LDAP_ADMIN_PASSWORD: ${LDAP_ADMIN_PASSWORD}
+#      LDAP_CONFIG_PASSWORD: ${LDAP_CONFIG_PASSWORD}
+#      LDAP_READONLY_USER: ${LDAP_READONLY_USER}
+#      LDAP_READONLY_USER_USERNAME: ${LDAP_READONLY_USER_USERNAME}
+#      LDAP_READONLY_USER_PASSWORD: ${LDAP_READONLY_USER_PASSWORD}
+#      LDAP_BACKEND: ${LDAP_BACKEND}
+#      LDAP_TLS: ${LDAP_TLS}
+#      LDAP_TLS_CRT_FILENAME: ${LDAP_TLS_CRT_FILENAME}
+#      LDAP_TLS_KEY_FILENAME: ${LDAP_TLS_KEY_FILENAME}
+#      LDAP_TLS_CA_CRT_FILENAME: ${LDAP_TLS_CA_CRT_FILENAME}
+#      LDAP_TLS_ENFORCE: ${LDAP_TLS_ENFORCE}
+#      LDAP_TLS_CIPHER_SUITE: ${LDAP_TLS_CIPHER_SUITE}
+#      LDAP_TLS_VERIFY_CLIENT: ${LDAP_TLS_VERIFY_CLIENT}
+#      LDAP_REPLICATION: ${LDAP_REPLICATION}
+#      LDAP_REMOVE_CONFIG_AFTER_SETUP: ${LDAP_REMOVE_CONFIG_AFTER_SETUP}
+#      LDAP_SSL_HELPER_PREFIX: ${LDAP_SSL_HELPER_PREFIX}
+  # To enable async mode, uncomment the following lines:
+#  taiga_redis:
+#    image: redis:4.0-alpine
+#    container_name: taiga_redis
+#    restart: always
+#    ports:
+#      - 6379:6379
+#    volumes:
+#      - /srv/taiga/redis/:/data
+#      - /etc/localtime:/etc/localtime:ro
+#      - /etc/timezone:/etc/timezone:ro
+#
+#  # FIXME Celery docker image is deprecated since 2017
+#  taiga_celery:
+#    image: celery
+#    container_name: taiga_celery
+#    restart: always
+#    links:
+#      - taiga_rabbit
+#      - taiga_redis