47 lines
2.1 KiB
Bash
47 lines
2.1 KiB
Bash
# Copy to .env, fill in, then: chmod 600 .env
|
|
# Values here are rendered into authproxy.cfg, pam_radius config and the
|
|
# Technitium forwarder zones at container start — the ONLY place DC IPs live.
|
|
|
|
# ── Domain controllers ────────────────────────────────────────────────
|
|
# AHDC01 (Trochalakis, 192.168.20.0/24)
|
|
TROCH_DC1_IP=192.168.20.CHANGEME
|
|
# AHDC03 (Trochalakis, 192.168.20.0/24)
|
|
TROCH_DC2_IP=192.168.20.CHANGEME
|
|
# AH-OSWLDC (Oswald, 192.168.7.0/24)
|
|
OSWALD_DC_IP=192.168.7.CHANGEME
|
|
|
|
# ── Duo (create an "OpenVPN" / RADIUS application in the Duo Admin Panel) ──
|
|
DUO_IKEY=
|
|
DUO_SKEY=
|
|
DUO_API_HOST=api-XXXXXXXX.duosecurity.com
|
|
|
|
# ── AD service account for the Duo Auth Proxy (read-only domain user) ──
|
|
# sAMAccountName, not UPN
|
|
DUO_SVC_USER=svc-duoproxy
|
|
DUO_SVC_PASSWORD=
|
|
AD_SEARCH_DN=DC=ad,DC=atlashorizon,DC=net
|
|
# Optional: restrict VPN to a group. Leave empty to allow any enabled user.
|
|
# Used only if you uncomment security_group_dn in authproxy.cfg.template.
|
|
DUO_SECURITY_GROUP_DN=
|
|
|
|
# ── OpenVPN ↔ Duo Auth Proxy RADIUS shared secret ─────────────────────
|
|
# Generate with: openssl rand -hex 24
|
|
RADIUS_SECRET=
|
|
|
|
# ── Technitium DNS web console admin password ─────────────────────────
|
|
# Applied on FIRST start only; change later via the console itself.
|
|
TECHNITIUM_ADMIN_PASSWORD=
|
|
|
|
# ── DNS zone for VPN client registration (A + PTR via learn-address) ──
|
|
# Leave empty to disable client DNS registration entirely.
|
|
VPN_DNS_ZONE=roam.atlashorizon.net
|
|
|
|
# ── Optional (defaults shown) ─────────────────────────────────────────
|
|
# Duo Auth Proxy version; pin (e.g. 6.5.1) for deterministic updates
|
|
#DUO_AUTHPROXY_VERSION=latest
|
|
# Service directories — only set these when the stack lives in /opt
|
|
# (the Ansible deploy writes them automatically)
|
|
#OPENVPN_DIR=/opt/openvpn
|
|
#DUO_DIR=/opt/duo-authproxy
|
|
#TECHNITIUM_DIR=/opt/technitium
|