lldap v0.1.0

Identity

LLDAP — a light, opinionated LDAP server with a friendly web UI for managing users and groups. A simple authentication backend for apps that speak LDAP (Nextcloud, Gitea, Grafana, Authelia, and many more) without the pain of OpenLDAP. Deployed as a host-networked Nomad service using SQLite with a persistent data volume.

nomad-pack run lldap --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- lldap

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 6.5k ⚑ Report an issue

1 task web 17170ldap 3890 1 volume image lldap/lldap:stable pinned :stable image bumped today

Variables 12

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run lldap -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "lldap"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The LLDAP container image. Pin a tag in production.
image = "lldap/lldap:stable"

# Host port for the web UI (LLDAP_HTTP_PORT).
web_port = 17170

# Host port for the LDAP protocol (LLDAP_LDAP_PORT).
ldap_port = 3890

# LDAP base DN (LLDAP_LDAP_BASE_DN). Set this to your domain, e.g. dc=example,dc=com.
base_dn = "dc=example,dc=com"

# Password for the default 'admin' user (LLDAP_LDAP_USER_PASS). CHANGE THIS.
admin_password = "change-me-please"

# Secret used to sign session tokens (LLDAP_JWT_SECRET). CHANGE THIS — generate with: openssl rand -hex 32.
jwt_secret = "change-me-to-a-random-secret"

# Named volume for LLDAP data (/data): the SQLite database and private key.
data_volume = "lldap_data"

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# Resources for the LLDAP task.
resources = {
    cpu    = 200
    memory = 128
  }

Name	Type	Default	Description
job_name	string	"lldap"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"lldap/lldap:stable"	The LLDAP container image. Pin a tag in production.
web_port	number	17170	Host port for the web UI (LLDAP_HTTP_PORT).
ldap_port	number	3890	Host port for the LDAP protocol (LLDAP_LDAP_PORT).
base_dn	string	"dc=example,dc=com"	LDAP base DN (LLDAP_LDAP_BASE_DN). Set this to your domain, e.g. dc=example,dc=com.
admin_password set me	string	"change-me-please"	Password for the default 'admin' user (LLDAP_LDAP_USER_PASS). CHANGE THIS.
jwt_secret set me	string	"change-me-to-a-random-secret"	Secret used to sign session tokens (LLDAP_JWT_SECRET). CHANGE THIS — generate with: openssl rand -hex 32.
data_volume	string	"lldap_data"	Named volume for LLDAP data (/data): the SQLite database and private key.
constraints	list	[]	Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 200 memory = 128 }	Resources for the LLDAP task.

Back up this pack

This pack stores data in one Docker named volume: lldap_data

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/lldap_data/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/lldap_data/_data backup:<bucket>/lldap_data

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

lldap

LLDAP — a light, opinionated LDAP server with a friendly web UI. It gives you a simple, central directory of users and groups that dozens of apps can authenticate against (Nextcloud, Gitea, Grafana, Authelia, Jellyfin, and more) — without the complexity of OpenLDAP.

Single host-networked Nomad service using SQLite with a persistent data volume.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run lldap --registry=nomploy

Configure

Variable	Default	Description
`web_port`	`17170`	Web UI port (`LLDAP_HTTP_PORT`).
`ldap_port`	`3890`	LDAP protocol port (`LLDAP_LDAP_PORT`).
`base_dn`	`dc=example,dc=com`	LDAP base DN (`LLDAP_LDAP_BASE_DN`) — set to your domain.
`admin_password`	`change-me-please`	Password for the `admin` user (`LLDAP_LDAP_USER_PASS`). Change it.
`jwt_secret`	`change-me-…`	Session-token secret (`LLDAP_JWT_SECRET`). Change it (`openssl rand -hex 32`).
`data_volume`	`lldap_data`	`/data` — SQLite DB and private key.
`image`	`lldap/lldap:stable`	Container image. Pin a tag in production.
`resources`	`{ cpu = 200, memory = 128 }`	Task resources.

Log in to the web UI as admin, create users/groups, then point apps at the LDAP endpoint (bind user uid=admin,ou=people,<base_dn>). Serves plain LDAP/HTTP — keep it on an internal network or front the web UI with a reverse proxy for TLS. Pin the job to the node holding the volume with constraints.