services:
  openldap:
    image: osixia/openldap
    restart: always
    environment:
      - TZ=Asia/Shanghai
      - LDAP_ORGANISATION=my-company
      - LDAP_DOMAIN=my-company.com
      - LDAP_ADMIN_PASSWORD=123456
      - LDAP_TLS=true
      - LDAP_TLS_CRT_FILENAME=live/<hostname>/cert.pem
      - LDAP_TLS_KEY_FILENAME=live/<hostname>/privkey.pem
      - LDAP_TLS_CA_CRT_FILENAME=live/<hostname>/fullchain.pem
      - LDAP_TLS_VERIFY_CLIENT=try
    ports:
      - 389:389
      - 636:636
    command: [--copy-service,  --loglevel, debug]
    volumes:
      - ./data:/var/lib/ldap
      - ./config:/etc/ldap/slapd.d
      # - <letsencrypt-dir>:/container/service/slapd/assets/certs
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "10"
  admin:
    image: osixia/phpldapadmin
    restart: always
    environment:
      - TZ=Asia/Shanghai
      - PHPLDAPADMIN_HTTPS="false"
      - PHPLDAPADMIN_LDAP_HOSTS=openldap
    ports:
      - 10004:80
    depends_on:
      - openldap
    links:
      - openldap
    volumes:
      - ./admin-data:/var/www/phpldapadmin
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "10"
  nginx-ldap:
    image: bitnami/nginx-ldap-auth-daemon:0
    restart: always
    ports:
      - 10005:8888
    environment:
      NGINXLDAP_LDAP_URI: ldaps://<hostname>
      NGINXLDAP_LDAP_BASE_DN: ou=users,dc=xxxx,dc=com
      NGINXLDAP_LDAP_BIND_DN: cn=admin,dc=xxxx,dc=com
      NGINXLDAP_LDAP_BIND_PASSWORD: <password>
      NGINXLDAP_LDAP_FILTER: "(cn=%(username)s)"
  ssp-ldap:
    image: ltbproject/self-service-password:latest
    restart: always
    ports:
      - 10006:80
    configs:
      - source: ssp.conf.php
        target: /var/www/conf/config.inc.local.php
configs:
  ssp.conf.php:
    content: |
      <?php // My SSP configuration
      $ldap_url = "ldap://openldap";
      $ldap_starttls = false;
      $ldap_binddn = "cn=admin,dc=xxxx,dc=com";
      $ldap_bindpw = "<password>";
      $ldap_base = "ou=users,dc=xxxx,dc=com";
      $ldap_login_attribute = "cn";
      $keyphrase = "mysecret";
      $debug = true;
      ?>

# 查询验证
# docker-compose exec openldap ldapsearch -x -H ldap://localhost -b dc=my-company,dc=com -D "cn=admin,dc=my-company,dc=com" -w 123456