Kanidm setup

servers/containers/jade-website-frontend.container

@@ -9,6 +9,7 @@ After=network-online.target
 ContainerName=jade-website-frontend
 NoNewPrivileges=true
 Image=oci-archive:/opt/images/jade-website-frontend
+ReadOnly=true
 # Volume=/var/opt/thelounge:/var/opt/thelounge:z,U
 AutoUpdate=local
 Network=web.network

servers/containers/kanidm-certs.volume

@@ -0,0 +1 @@
+[Volume]

servers/containers/kanidm.container

@@ -0,0 +1,61 @@
+
+
+
+[Unit]
+Description=Kanidm identity server
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=kanidm
+
+NoNewPrivileges=true
+Image=docker.io/kanidm/server:latest
+
+ReadOnly=true
+# Volume=/run/podman/podman.sock:/var/run/docker.sock:z
+Volume=/var/opt/kanidm_data:/data:Z
+Volume=kanidm-certs.volume:/data/certs:z
+Volume=/etc/kanidm/entrypoint.sh:/entrypoint.sh:ro,z
+Volume=/etc/kanidm/data/server.toml:/data/server.toml:ro,z
+
+Exec="/entrypoint.sh"
+
+AutoUpdate=registry
+Network=web.network
+
+
+Label="traefik.enable=true"
+Label="traefik.http.routers.kanidm.rule=Host(`idm.ellis.link`)"
+Label="traefik.http.routers.kanidm.entrypoints=https"
+Label="traefik.http.routers.kanidm.service=kanidm"
+
+Label="traefik.http.routers.kanidm.tls.certresolver=letsencrypt"
+
+# Kanidm is a bit odd here
+Label="traefik.http.services.kanidm.loadbalancer.server.port=8443"
+Label="traefik.http.services.kanidm.loadbalancer.server.scheme=https"
+Label="traefik.http.services.kanidm.loadbalancer.serversTransport=kanidm@file"
+# Label="traefik.http.serversTransports.kanidm.insecureSkipVerify=true"
+
+Label="traefik.http.middlewares.compress.compress=true"
+
+Label="traefik.http.middlewares.hsts.headers.stsincludesubdomains=false"
+Label="traefik.http.middlewares.hsts.headers.stspreload=true"
+Label="traefik.http.middlewares.hsts.headers.stsseconds=31536000"
+Label="traefik.http.middlewares.hsts.headers.isdevelopment=false"
+
+Label="traefik.http.routers.kanidm.middlewares=compress" # hsts,
+
+Label="homepage.group=Services"
+Label="homepage.name=Kanidm"
+Label="homepage.href=https://idm.ellis.link/"
+Label="homepage.description=Identity server"
+
+
+[Service]
+Restart=on-failure
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target

servers/containers/pitch-tagai.container

@@ -9,6 +9,7 @@ After=network-online.target
 ContainerName=pitch-tagai
 NoNewPrivileges=true
 Image=localhost/pitch-tagai:latest
+ReadOnly=true
 PodmanArgs=--stop-timeout=0
 # StopTimeout=1
 

servers/containers/traefik.container

@@ -5,12 +5,13 @@
 Description=traefik web server
 Wants=network-online.target
 After=network-online.target
+After=kanidm.service
 
 [Container]
 ContainerName=traefik
 PodmanArgs=--privileged
 NoNewPrivileges=true
-Image=docker.io/library/traefik:latest
+Image=docker.io/library/traefik:3.0
 PublishPort=0.0.0.0:80:80/tcp
 PublishPort=0.0.0.0:443:443/tcp
 PublishPort=0.0.0.0:443:443/udp
@@ -24,6 +25,8 @@ ReadOnly=true
 Volume=/run/podman/podman.sock:/var/run/docker.sock:z
 Volume=/var/srv/traefik:/certificates:z
 Volume=/etc/traefik:/etc/traefik:ro,z
+Volume=kanidm-certs.volume:/kanidm_certs:ro,z
+
 # Volume=/var/srv/matrix/caddy/config:/config:z
 # Volume=/var/srv/matrix/caddy/data:/data:z
 # Volume=/var/srv/matrix/caddy/Caddyfile:/etc/caddy/Caddyfile:ro,z
@@ -34,7 +37,7 @@ Network=web.network
 # IP6=fe80::9724:38eb:9b0f:df7c
 
 Exec=traefik --configFile=/etc/traefik/config.toml 
-
+Environment="SSL_CERT_FILE=/kanidm_certs/ca.pem"
 
 Label="traefik.http.middlewares.compress.compress=true"