26 lines
1.0 KiB
Bash
26 lines
1.0 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
for v in TROCH_DC1_IP TROCH_DC2_IP DUO_IKEY DUO_SKEY DUO_API_HOST \
|
|
DUO_SVC_USER DUO_SVC_PASSWORD AD_SEARCH_DN RADIUS_SECRET; do
|
|
eval "val=\${$v:-}"
|
|
[ -n "$val" ] || { echo "ERROR: $v is not set (see .env.example)" >&2; exit 1; }
|
|
done
|
|
|
|
if [ ! -f /certs/ad-ldaps-ca.pem ]; then
|
|
echo "ERROR: /certs/ad-ldaps-ca.pem missing — export your AD LDAPS issuing" >&2
|
|
echo "CA chain into duo-authproxy/certs/ (see certs/README.md)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${DUO_IKEY} ${DUO_SKEY} ${DUO_API_HOST} ${DUO_SVC_USER} ${DUO_SVC_PASSWORD} ${AD_SEARCH_DN} ${RADIUS_SECRET} ${DUO_SECURITY_GROUP_DN}' \
|
|
< /opt/duoauthproxy/conf/authproxy.cfg.template \
|
|
> /opt/duoauthproxy/conf/authproxy.cfg
|
|
chmod 600 /opt/duoauthproxy/conf/authproxy.cfg
|
|
|
|
# Optional pre-flight (LDAPS reachability, Duo API ping). Non-fatal so a
|
|
# temporarily unreachable DC doesn't crash-loop the container.
|
|
/opt/duoauthproxy/bin/authproxy_connectivity_tool || true
|
|
|
|
exec /opt/duoauthproxy/bin/authproxy
|