claude generated first pass

duo-authproxy/Dockerfile

@@ -0,0 +1,38 @@
+# Duo publishes no official image; build from their source tarball.
+# Install flags match Duo's documented non-interactive install.
+
+FROM ubuntu:24.04 AS build
+
+ARG DUO_VERSION=latest
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential libssl-dev libffi-dev perl zlib1g-dev wget ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN wget -q "https://dl.duosecurity.com/duoauthproxy-${DUO_VERSION}-src.tgz" -O /tmp/duo-src.tgz \
+ && mkdir /tmp/duo \
+ && tar xzf /tmp/duo-src.tgz -C /tmp/duo --strip-components=1
+
+RUN groupadd -r -g 35505 duo \
+ && useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo \
+ && cd /tmp/duo && make \
+ && cd duoauthproxy-build \
+ && ./install --install-dir /opt/duoauthproxy --service-user duo \
+      --log-group duo --create-init-script no --enable-selinux no
+
+FROM ubuntu:24.04
+
+# gettext-base = envsubst for rendering authproxy.cfg from env vars
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates gettext-base \
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd -r -g 35505 duo \
+ && useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo
+
+COPY --from=build --chown=duo:duo /opt/duoauthproxy /opt/duoauthproxy
+COPY --chown=duo:duo authproxy.cfg.template /opt/duoauthproxy/conf/authproxy.cfg.template
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+USER duo
+ENTRYPOINT ["/entrypoint.sh"]

duo-authproxy/authproxy.cfg.template

@@ -0,0 +1,42 @@
+; Duo Authentication Proxy — rendered from env vars at container start.
+; Chain: OpenVPN (pam_radius) -> [radius_server_auto] -> [ad_client] LDAPS
+;        to AHDC01/AHDC03 over wg0, factor via Duo cloud (outbound 443).
+
+[main]
+log_stdout=true
+debug=false
+
+[ad_client]
+host=${TROCH_DC1_IP}
+host_2=${TROCH_DC2_IP}
+service_account_username=${DUO_SVC_USER}
+service_account_password=${DUO_SVC_PASSWORD}
+search_dn=${AD_SEARCH_DN}
+transport=ldaps
+port=636
+ssl_ca_certs_file=/certs/ad-ldaps-ca.pem
+; We target the DCs by IP, so hostname verification can't match the cert
+; SAN. The chain is still validated against your AD CA. To go strict:
+; use DC FQDNs in host/host_2, point the VPS resolver at Unbound, and
+; set this to true.
+ssl_verify_hostname=false
+; Restrict VPN access to one AD group (fill DUO_SECURITY_GROUP_DN in .env
+; and uncomment):
+;security_group_dn=${DUO_SECURITY_GROUP_DN}
+
+[radius_server_auto]
+ikey=${DUO_IKEY}
+skey=${DUO_SKEY}
+api_host=${DUO_API_HOST}
+client=ad_client
+; Only OpenVPN on this host may talk to us
+interface=127.0.0.1
+port=1812
+radius_ip_1=127.0.0.1
+radius_secret_1=${RADIUS_SECRET}
+; Password-only = auto (push); "password,123456" appends a passcode —
+; the fallback for connect-before-logon when the phone is offline.
+allow_concat=true
+; safe = allow password-only auth if Duo cloud is unreachable (Duo default).
+; Set to "secure" to fail closed instead.
+failmode=safe

duo-authproxy/certs/README.md

@@ -0,0 +1,18 @@
+# AD LDAPS CA chain
+
+Place the PEM-encoded CA chain that issued your domain controllers' LDAPS
+certificates here as **`ad-ldaps-ca.pem`** (root + any intermediates,
+concatenated).
+
+If you run AD CS, export it from any domain-joined box:
+
+```powershell
+# Grab the issuing chain from AHDC01's LDAPS cert
+$tcp = New-Object Net.Sockets.TcpClient('ahdc01.ad.atlashorizon.net', 636)
+# ...or just export from the CA console / certutil:
+certutil -ca.cert ca.der
+certutil -encode ca.der ad-ldaps-ca.pem
+```
+
+The Duo Auth Proxy refuses to start LDAPS without it (checked in
+`entrypoint.sh`). Everything except this README is gitignored.

duo-authproxy/entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -eu
+
+for v in TROCH_DC1_IP TROCH_DC2_IP DUO_IKEY DUO_SKEY DUO_API_HOST \
+         DUO_SVC_USER DUO_SVC_PASSWORD AD_SEARCH_DN RADIUS_SECRET; do
+  eval "val=\${$v:-}"
+  [ -n "$val" ] || { echo "ERROR: $v is not set (see .env.example)" >&2; exit 1; }
+done
+
+if [ ! -f /certs/ad-ldaps-ca.pem ]; then
+  echo "ERROR: /certs/ad-ldaps-ca.pem missing — export your AD LDAPS issuing" >&2
+  echo "CA chain into duo-authproxy/certs/ (see certs/README.md)" >&2
+  exit 1
+fi
+
+envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${DUO_IKEY} ${DUO_SKEY} ${DUO_API_HOST} ${DUO_SVC_USER} ${DUO_SVC_PASSWORD} ${AD_SEARCH_DN} ${RADIUS_SECRET}' \
+  < /opt/duoauthproxy/conf/authproxy.cfg.template \
+  > /opt/duoauthproxy/conf/authproxy.cfg
+chmod 600 /opt/duoauthproxy/conf/authproxy.cfg
+
+# Optional pre-flight (LDAPS reachability, Duo API ping). Non-fatal so a
+# temporarily unreachable DC doesn't crash-loop the container.
+/opt/duoauthproxy/bin/authproxy_connectivity_tool || true
+
+exec /opt/duoauthproxy/bin/authproxy