claude generated first pass

duo-authproxy/authproxy.cfg.template

@@ -0,0 +1,42 @@
+; Duo Authentication Proxy — rendered from env vars at container start.
+; Chain: OpenVPN (pam_radius) -> [radius_server_auto] -> [ad_client] LDAPS
+;        to AHDC01/AHDC03 over wg0, factor via Duo cloud (outbound 443).
+
+[main]
+log_stdout=true
+debug=false
+
+[ad_client]
+host=${TROCH_DC1_IP}
+host_2=${TROCH_DC2_IP}
+service_account_username=${DUO_SVC_USER}
+service_account_password=${DUO_SVC_PASSWORD}
+search_dn=${AD_SEARCH_DN}
+transport=ldaps
+port=636
+ssl_ca_certs_file=/certs/ad-ldaps-ca.pem
+; We target the DCs by IP, so hostname verification can't match the cert
+; SAN. The chain is still validated against your AD CA. To go strict:
+; use DC FQDNs in host/host_2, point the VPS resolver at Unbound, and
+; set this to true.
+ssl_verify_hostname=false
+; Restrict VPN access to one AD group (fill DUO_SECURITY_GROUP_DN in .env
+; and uncomment):
+;security_group_dn=${DUO_SECURITY_GROUP_DN}
+
+[radius_server_auto]
+ikey=${DUO_IKEY}
+skey=${DUO_SKEY}
+api_host=${DUO_API_HOST}
+client=ad_client
+; Only OpenVPN on this host may talk to us
+interface=127.0.0.1
+port=1812
+radius_ip_1=127.0.0.1
+radius_secret_1=${RADIUS_SECRET}
+; Password-only = auto (push); "password,123456" appends a passcode —
+; the fallback for connect-before-logon when the phone is offline.
+allow_concat=true
+; safe = allow password-only auth if Duo cloud is unreachable (Duo default).
+; Set to "secure" to fail closed instead.
+failmode=safe