30 lines
1.2 KiB
Bash
30 lines
1.2 KiB
Bash
# Copy to .env, fill in, then: chmod 600 .env
|
|
# Values here are rendered into unbound.conf, authproxy.cfg and pam_radius
|
|
# config at container start — this is the ONLY place DC IPs live.
|
|
|
|
# ── Domain controllers ────────────────────────────────────────────────
|
|
# AHDC01 (Trochalakis, 192.168.20.0/24)
|
|
TROCH_DC1_IP=192.168.20.CHANGEME
|
|
# AHDC03 (Trochalakis, 192.168.20.0/24)
|
|
TROCH_DC2_IP=192.168.20.CHANGEME
|
|
# AH-OSWLDC (Oswald, 192.168.7.0/24)
|
|
OSWALD_DC_IP=192.168.7.CHANGEME
|
|
|
|
# ── Duo (create an "OpenVPN" / RADIUS application in the Duo Admin Panel) ──
|
|
DUO_IKEY=
|
|
DUO_SKEY=
|
|
DUO_API_HOST=api-XXXXXXXX.duosecurity.com
|
|
|
|
# ── AD service account for the Duo Auth Proxy (read-only domain user) ──
|
|
# sAMAccountName, not UPN
|
|
DUO_SVC_USER=svc-duoproxy
|
|
DUO_SVC_PASSWORD=
|
|
AD_SEARCH_DN=DC=ad,DC=atlashorizon,DC=net
|
|
# Optional: restrict VPN to a group. Leave empty to allow any enabled user.
|
|
# Used only if you uncomment security_group_dn in authproxy.cfg.template.
|
|
DUO_SECURITY_GROUP_DN=
|
|
|
|
# ── OpenVPN ↔ Duo Auth Proxy RADIUS shared secret ─────────────────────
|
|
# Generate with: openssl rand -hex 24
|
|
RADIUS_SECRET=
|