first commit

2026-10-09 02:35:14 +07:00
commit 4ca7a9a58e
108 changed files with 23035 additions and 0 deletions
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# =============================================================================
+# eBdesk SiCABE — print-openldap-requirements.sh
+# -----------------------------------------------------------------------------
+# Mencetak KEBUTUHAN OpenLDAP (nilai konkret dari .env) untuk diserahkan ke
+# administrator LDAP — pasangan dari docs/openldap-existing-requirements.md.
+#
+# Read-only: hanya menampilkan.
+#
+# Usage:
+#   ./scripts/print-openldap-requirements.sh
+#   ./scripts/print-openldap-requirements.sh --env-file generated/host-control/.env
+#   ./scripts/print-openldap-requirements.sh --mask      # sembunyikan bind password
+# =============================================================================
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=../lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+# shellcheck source=../config/environment.defaults.sh
+source "${SCRIPT_DIR}/config/environment.defaults.sh"
+
+MASK=0
+ARGS=()
+for _a in "$@"; do
+  case "${_a}" in
+    --mask) MASK=1 ;;
+    *) ARGS+=("${_a}") ;;
+  esac
+done
+sicabe_load_env "${SCRIPT_DIR}" "${ARGS[@]}"
+
+BASE_DN="${LDAP_BASE_DN:-dc=sicabe,dc=local}"
+USERS_DN="${LDAP_USERS_DN:-ou=users,${BASE_DN}}"
+GROUPS_DN="${LDAP_GROUPS_DN:-ou=groups,${BASE_DN}}"
+BIND_DN="${LDAP_ADMIN_DN:-cn=admin,${BASE_DN}}"
+LDAP_URL="${LDAP_URL:-ldap://openldap:389}"
+LDAP_HOST="${LDAP_HOST:-localhost}"
+LDAP_PORT="${LDAP_PORT:-389}"
+
+show_secret() { # <value> <dev-default>
+  local v="${1:-}" d="${2:-}"
+  if [[ -z "${v}" ]]; then echo "(KOSONG!)"; return; fi
+  if [[ "${MASK}" == "1" ]]; then echo "********"; return; fi
+  if [[ "${v}" == "${d}" ]]; then echo "${v}   ← DEFAULT DEV, ganti di produksi"; else echo "${v}"; fi
+}
+
+printf '%s\n' "================================================================================"
+printf '%s\n' " KEBUTUHAN OPENLDAP (existing) — dari: ${SICABE_ENV_FILE:-${SCRIPT_DIR}/.env}"
+printf '%s\n' "================================================================================"
+printf '%s\n' " Peran LDAP di SiCABE = SUMBER GRUP (bukan autentikasi; auth = Keycloak OIDC)."
+printf '\n'
+printf ' URL (dari container) : %s\n' "${LDAP_URL}"
+printf ' host:port (dari host): %s:%s\n' "${LDAP_HOST}" "${LDAP_PORT}"
+printf '\n'
+printf ' Base DN              : %s\n' "${BASE_DN}"
+printf ' OU users             : %s\n' "${USERS_DN}"
+printf ' OU groups            : %s\n' "${GROUPS_DN}"
+printf '\n'
+printf ' Akun BIND (buat baca) : %s\n' "${BIND_DN}"
+printf '   → boleh akun READ-ONLY, bukan harus admin.\n'
+printf ' password              : %s\n' "$(show_secret "${LDAP_ADMIN_PASSWORD:-}" "ldap_admin_DevOnly")"
+printf '\n'
+printf '%s\n' " Grup (WAJIB, objectClass=groupOfNames, atribut cn + member=DN user):"
+printf '%s\n' "   data-admin   data-engineer   data-analyst   data-viewer"
+printf '%s\n' "   → nama ini HARUS sama dengan kunci roles di config/opa/data.json"
+printf '%s\n' "     DAN permitted_groups StarRocks."
+printf '\n'
+printf '%s\n' " User (objectClass inetOrgPerson + posixAccount):"
+printf '%s\n' "   uid  HARUS = username Keycloak (preferred_username)  ← krusial"
+printf '%s\n' "   atribut minimal: uid, cn, sn, mail, uidNumber, gidNumber, homeDirectory"
+printf '\n'
+printf '%s\n' " Kembalikan ke SiCABE: LDAP_URL, host:port, bind DN + password, base DN/OU,"
+printf '%s\n' " dan konfirmasi bahwa uid user = username Keycloak & keanggotaan grup benar."
+if [[ "${MASK}" == "0" ]]; then
+  printf '\n'
+  printf '%s\n' " ⚠ KELUARAN MEMUAT PASSWORD — kirim lewat kanal aman; jangan tempel di tiket publik."
+fi
+printf '%s\n' "================================================================================"