; Duo Authentication Proxy — rendered from env vars at container start.
; Chain: OpenVPN (pam_radius) -> [radius_server_auto] -> [ad_client] LDAPS
;        to AHDC01/AHDC03 over wg0, factor via Duo cloud (outbound 443).

[main]
log_stdout=true
debug=false

[ad_client]
host=${TROCH_DC1_IP}
host_2=${TROCH_DC2_IP}
service_account_username=${DUO_SVC_USER}
service_account_password=${DUO_SVC_PASSWORD}
search_dn=${AD_SEARCH_DN}
transport=ldaps
port=636
ssl_ca_certs_file=/certs/ad-ldaps-ca.pem
; We target the DCs by IP, so hostname verification can't match the cert
; SAN. The chain is still validated against your AD CA. To go strict:
; use DC FQDNs in host/host_2, point the VPS resolver at Unbound, and
; set this to true.
ssl_verify_hostname=false
; Restrict VPN access to one AD group (fill DUO_SECURITY_GROUP_DN in .env
; and uncomment):
;security_group_dn=${DUO_SECURITY_GROUP_DN}

[radius_server_auto]
ikey=${DUO_IKEY}
skey=${DUO_SKEY}
api_host=${DUO_API_HOST}
client=ad_client
; Only OpenVPN on this host may talk to us
interface=127.0.0.1
port=1812
radius_ip_1=127.0.0.1
radius_secret_1=${RADIUS_SECRET}
; Password-only = auto (push); "password,123456" appends a passcode —
; the fallback for connect-before-logon when the phone is offline.
allow_concat=true
; safe = allow password-only auth if Duo cloud is unreachable (Duo default).
; Set to "secure" to fail closed instead.
failmode=safe