working ig

duo-authproxy/Dockerfile

@@ -1,5 +1,11 @@
 # Duo publishes no official image; build from their source tarball.
 # Install flags match Duo's documented non-interactive install.
+#
+# Slimming option: switch BOTH stages to debian:bookworm-slim (~80MB less,
+# and the base layer is shared with the openvpn image). Both must move
+# together — the proxy links against the builder's glibc. Alpine/musl
+# will not work.
+#FROM debian:bookworm-slim AS build
 
 FROM ubuntu:24.04 AS build
 
@@ -20,6 +26,8 @@ RUN groupadd -r -g 35505 duo \
  && ./install --install-dir /opt/duoauthproxy --service-user duo \
       --log-group duo --create-init-script no --enable-selinux no
 
+# Slim variant (must match the build stage base — see note above):
+#FROM debian:bookworm-slim
 FROM ubuntu:24.04
 
 # gettext-base = envsubst for rendering authproxy.cfg from env vars

duo-authproxy/authproxy.cfg.template

@@ -8,7 +8,7 @@ debug=false
 
 [ad_client]
 host=${TROCH_DC1_IP}
-host_2=${TROCH_DC2_IP}
+;host_2=${TROCH_DC2_IP}
 service_account_username=${DUO_SVC_USER}
 service_account_password=${DUO_SVC_PASSWORD}
 search_dn=${AD_SEARCH_DN}
@@ -22,7 +22,7 @@ ssl_ca_certs_file=/certs/ad-ldaps-ca.pem
 ssl_verify_hostname=false
 ; Restrict VPN access to one AD group (fill DUO_SECURITY_GROUP_DN in .env
 ; and uncomment):
-;security_group_dn=${DUO_SECURITY_GROUP_DN}
+security_group_dn=${DUO_SECURITY_GROUP_DN}
 
 [radius_server_auto]
 ikey=${DUO_IKEY}

duo-authproxy/entrypoint.sh

@@ -13,7 +13,7 @@ if [ ! -f /certs/ad-ldaps-ca.pem ]; then
   exit 1
 fi
 
-envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${DUO_IKEY} ${DUO_SKEY} ${DUO_API_HOST} ${DUO_SVC_USER} ${DUO_SVC_PASSWORD} ${AD_SEARCH_DN} ${RADIUS_SECRET}' \
+envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${DUO_IKEY} ${DUO_SKEY} ${DUO_API_HOST} ${DUO_SVC_USER} ${DUO_SVC_PASSWORD} ${AD_SEARCH_DN} ${RADIUS_SECRET} ${DUO_SECURITY_GROUP_DN}' \
   < /opt/duoauthproxy/conf/authproxy.cfg.template \
   > /opt/duoauthproxy/conf/authproxy.cfg
 chmod 600 /opt/duoauthproxy/conf/authproxy.cfg