Bot Updating Package Versions

(fix) Adding cookie expiration

.editorconfig

@@ -0,0 +1,20 @@
+# This file is globally distributed to all container image projects from
+# https://github.com/linuxserver/docker-jenkins-builder/blob/master/.editorconfig
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+# trim_trailing_whitespace may cause unintended issues and should not be globally set true
+trim_trailing_whitespace = false
+
+[{Dockerfile*,**.yml}]
+indent_style = space
+indent_size = 2
+
+[{**.sh,root/etc/s6-overlay/s6-rc.d/**,root/etc/cont-init.d/**,root/etc/services.d/**}]
+indent_style = space
+indent_size = 4

.github/CONTRIBUTING.md

@@ -0,0 +1,123 @@
+# Contributing to ldap-auth
+
+## Gotchas
+
+* While contributing make sure to make all your changes before creating a Pull Request, as our pipeline builds each commit after the PR is open.
+* Read, and fill the Pull Request template
+  * If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR
+  * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
+* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://linuxserver.io/discord)
+
+## Common files
+
+| File | Use case |
+| :----: | --- |
+| `Dockerfile` | Dockerfile used to build amd64 images |
+| `Dockerfile.aarch64` | Dockerfile used to build 64bit ARM architectures |
+| `Dockerfile.armhf` | Dockerfile used to build 32bit ARM architectures |
+| `Jenkinsfile` | This file is a product of our builder and should not be edited directly. This is used to build the image |
+| `jenkins-vars.yml` | This file is used to generate the `Jenkinsfile` mentioned above, it only affects the build-process |
+| `package_versions.txt` | This file is generated as a part of the build-process and should not be edited directly. It lists all the installed packages and their versions |
+| `README.md` | This file is a product of our builder and should not be edited directly. This displays the readme for the repository and image registries |
+| `readme-vars.yml` | This file is used to generate the `README.md` |
+
+## Readme
+
+If you would like to change our readme, please __**do not**__ directly edit the readme, as it is auto-generated on each commit.
+Instead edit the [readme-vars.yml](https://github.com/linuxserver/docker-ldap-auth/edit/master/readme-vars.yml).
+
+These variables are used in a template for our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) as part of an ansible play.
+Most of these variables are also carried over to [docs.linuxserver.io](https://docs.linuxserver.io/images/docker-ldap-auth)
+
+### Fixing typos or clarify the text in the readme
+
+There are variables for multiple parts of the readme, the most common ones are:
+
+| Variable | Description |
+| :----: | --- |
+| `project_blurb` | This is the short excerpt shown above the project logo. |
+| `app_setup_block` | This is the text that shows up under "Application Setup" if enabled |
+
+### Parameters
+
+The compose and run examples are also generated from these variables.
+
+We have a [reference file](https://github.com/linuxserver/docker-jenkins-builder/blob/master/vars/_container-vars-blank) in our Jenkins Builder.
+
+These are prefixed with `param_` for required parameters, or `opt_param` for optional parameters, except for `cap_add`.
+Remember to enable param, if currently disabled. This differs between parameters, and can be seen in the reference file.
+
+Devices, environment variables, ports and volumes expects its variables in a certain way.
+
+### Devices
+
+```yml
+param_devices:
+  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
+opt_param_devices:
+  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
+```
+
+### Environment variables
+
+```yml
+param_env_vars:
+  - { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London." }
+opt_param_env_vars:
+  - { env_var: "VERSION", env_value: "latest", desc: "Supported values are LATEST, PLEXPASS or a specific version number." }
+```
+
+### Ports
+
+```yml
+param_ports:
+  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
+opt_param_ports:
+  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
+```
+
+### Volumes
+
+```yml
+param_volumes:
+  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
+opt_param_volumes:
+  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
+```
+
+### Testing template changes
+
+After you make any changes to the templates, you can use our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) to have the files updated from the modified templates. Please use the command found under `Running Locally` [on this page](https://github.com/linuxserver/docker-jenkins-builder/blob/master/README.md) to generate them prior to submitting a PR.
+
+## Dockerfiles
+
+We use multiple Dockerfiles in our repos, this is because sometimes some CPU architectures needs different packages to work.
+If you are proposing additional packages to be added, ensure that you added the packages to all the Dockerfiles in alphabetical order.
+
+### Testing your changes
+
+```bash
+git clone https://github.com/linuxserver/docker-ldap-auth.git
+cd docker-ldap-auth
+docker build \
+  --no-cache \
+  --pull \
+  -t linuxserver/ldap-auth:latest .
+```
+
+The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
+
+```bash
+docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
+```
+
+Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
+
+## Update the changelog
+
+If you are modifying the Dockerfiles or any of the startup scripts in [root](https://github.com/linuxserver/docker-ldap-auth/tree/master/root), add an entry to the changelog
+
+```yml
+changelogs:
+  - { date: "DD.MM.YY:", desc: "Added some love to templates" }
+```

.github/FUNDING.yml

@@ -1 +1,2 @@
+github: linuxserver
 open_collective: linuxserver

.github/ISSUE_TEMPLATE.md

@@ -1,34 +0,0 @@
-[linuxserverurl]: https://linuxserver.io
-[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-
-If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support.
-
-<!--- Provide a general summary of the issue in the Title above -->
-
-------------------------------
-
-## Expected Behavior
-<!--- Tell us what should happen -->
-
-## Current Behavior
-<!--- Tell us what happens instead of the expected behavior -->
-
-## Steps to Reproduce
-<!--- Provide a link to a live example, or an unambiguous set of steps to -->
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-1.
-2.
-3.
-4.
-
-## Environment
-**OS:**      
-**CPU architecture:** x86_64/arm32/arm64      
-**How docker service was installed:**      
-<!--- Providing context helps us come up with a solution that is most useful in the real world -->
-
-## Command used to create docker container (run/create/compose/screenshot)
-<!--- Provide your docker create/run command or compose yaml snippet, or a screenshot of settings if using a gui to create the container -->
-
-## Docker logs
-<!--- Provide a full docker log, output of "docker logs ldap-auth" -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord chat support
+    url: https://linuxserver.io/discord
+    about: Realtime support / chat with the community and the team.
+
+  - name: Discourse discussion forum
+    url: https://discourse.linuxserver.io
+    about: Post on our community forum.
+
+  - name: Documentation
+    url: https://docs.linuxserver.io/images/docker-ldap-auth
+    about: Documentation - information about all of our containers.

.github/ISSUE_TEMPLATE/issue.bug.yml

@@ -0,0 +1,76 @@
+# Based on the issue template
+name: Bug report
+description: Create a report to help us improve
+title: "[BUG] <title>"
+labels: [Bug]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the bug you encountered.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Current Behavior
+      description: Tell us what happens instead of the expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: Tell us what should happen.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Steps To Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. In this environment...
+        2. With this config...
+        3. Run '...'
+        4. See error...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Environment
+      description: |
+        examples:
+          - **OS**: Ubuntu 20.04
+          - **How docker service was installed**: distro's packagemanager
+      value: |
+        - OS:
+        - How docker service was installed:
+      render: markdown
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: CPU architecture
+      options:
+        - x86-64
+        - arm64
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Docker creation
+      description: |
+        Command used to create docker container
+        Provide your docker create/run command or compose yaml snippet, or a screenshot of settings if using a gui to create the container
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      description: |
+        Provide a full docker log, output of "docker logs ldap-auth"
+      label: Container logs
+      placeholder: |
+        Output of `docker logs ldap-auth`
+      render: bash
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/issue.feature.yml

@@ -0,0 +1,31 @@
+# Based on the issue template
+name: Feature request
+description: Suggest an idea for this project
+title: "[FEAT] <title>"
+labels: [enhancement]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is this a new feature request?
+      description: Please search to see if a feature request already exists.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Wanted change
+      description: Tell us what you want to happen.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reason for change
+      description: Justify your request, why do you want it, what is the benefit.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed code change
+      description: Do you have a potential code change in mind?
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,11 +2,11 @@
 
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-	
+
 
 <!--- Before submitting a pull request please check the following -->
 
-<!---  If this is a fix for a typo in code or documentation in the README please file an issue and let us sort it out we do not need a PR  --> 
+<!---  If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR  -->
 <!---  Ask yourself if this modification is something the whole userbase will benefit from, if this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
 <!---  That if the PR is addressing an existing issue include, closes #<issue number> , in the body of the PR commit message   -->
 <!---  You have included links to any files / patches etc your PR may be using in the body of the PR commit message -->
@@ -21,7 +21,11 @@
 
 ------------------------------
 
-We welcome all PR’s though this doesn’t guarantee it will be accepted.
+ - [ ] I have read the [contributing](https://github.com/linuxserver/docker-ldap-auth/blob/master/.github/CONTRIBUTING.md) guideline and understand that I have made the correct modifications
+
+------------------------------
+
+<!--- We welcome all PR’s though this doesn’t guarantee it will be accepted. -->
 
 ## Description:
 <!--- Describe your changes in detail -->

.github/workflows/call_issue_pr_tracker.yml

@@ -0,0 +1,19 @@
+name: Issue & PR Tracker
+
+on:
+  issues:
+    types: [opened,reopened,labeled,unlabeled,closed]
+  pull_request_target:
+    types: [opened,reopened,review_requested,review_request_removed,labeled,unlabeled,closed]
+  pull_request_review:
+    types: [submitted,edited,dismissed]
+
+permissions:
+  contents: read
+
+jobs:
+  manage-project:
+    permissions:
+      issues: write
+    uses: linuxserver/github-workflows/.github/workflows/issue-pr-tracker.yml@v1
+    secrets: inherit

.github/workflows/call_issues_cron.yml

@@ -0,0 +1,16 @@
+name: Mark stale issues and pull requests
+on:
+  schedule:
+    - cron:  '8 13 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: linuxserver/github-workflows/.github/workflows/issues-cron.yml@v1
+    secrets: inherit

.github/workflows/external_trigger.yml

@@ -0,0 +1,147 @@
+name: External Trigger Main
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  external-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.1.1
+
+      - name: External Trigger
+        if: github.ref == 'refs/heads/master'
+        env:
+          SKIP_EXTERNAL_TRIGGER: ${{ vars.SKIP_EXTERNAL_TRIGGER }}
+        run: |
+          printf "# External trigger for docker-ldap-auth\n\n" >> $GITHUB_STEP_SUMMARY
+          if grep -q "^ldap-auth_master_" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` contains \`ldap-auth_master_\`; will skip trigger if version matches." >> $GITHUB_STEP_SUMMARY
+          elif grep -q "^ldap-auth_master" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` contains \`ldap-auth_master\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+          echo "> External trigger running off of master branch. To disable this trigger, add \`ldap-auth_master\` into the Github organizational variable \`SKIP_EXTERNAL_TRIGGER\`." >> $GITHUB_STEP_SUMMARY
+          printf "\n## Retrieving external version\n\n" >> $GITHUB_STEP_SUMMARY
+          EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/python-ldap/json" |jq -r '. | .info.version')
+          echo "Type is \`pip_version\`" >> $GITHUB_STEP_SUMMARY
+          if grep -q "^ldap-auth_master_${EXT_RELEASE}" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` matches current external release; skipping trigger." >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Can't retrieve external version, exiting" >> $GITHUB_STEP_SUMMARY
+            FAILURE_REASON="Can't retrieve external version for ldap-auth branch master"
+            GHA_TRIGGER_URL="https://github.com/linuxserver/docker-ldap-auth/actions/runs/${{ github.run_id }}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n**Trigger URL:** '"${GHA_TRIGGER_URL}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          EXT_RELEASE_SANITIZED=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
+          echo "Sanitized external version: \`${EXT_RELEASE_SANITIZED}\`" >> $GITHUB_STEP_SUMMARY
+          echo "Retrieving last pushed version" >> $GITHUB_STEP_SUMMARY
+          image="linuxserver/ldap-auth"
+          tag="latest"
+          token=$(curl -sX GET \
+            "https://ghcr.io/token?scope=repository%3Alinuxserver%2Fldap-auth%3Apull" \
+            | jq -r '.token')
+          multidigest=$(curl -s \
+            --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+            --header "Accept: application/vnd.oci.image.index.v1+json" \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/manifests/${tag}")
+          if jq -e '.layers // empty' <<< "${multidigest}" >/dev/null 2>&1; then
+            # If there's a layer element it's a single-arch manifest so just get that digest
+            digest=$(jq -r '.config.digest' <<< "${multidigest}")
+          else
+            # Otherwise it's multi-arch or has manifest annotations
+            if jq -e '.manifests[]?.annotations // empty' <<< "${multidigest}" >/dev/null 2>&1; then
+              # Check for manifest annotations and delete if found
+              multidigest=$(jq 'del(.manifests[] | select(.annotations))' <<< "${multidigest}")
+            fi
+            if [[ $(jq '.manifests | length' <<< "${multidigest}") -gt 1 ]]; then
+              # If there's still more than one digest, it's multi-arch
+              multidigest=$(jq -r ".manifests[] | select(.platform.architecture == \"amd64\").digest?" <<< "${multidigest}")
+            else
+              # Otherwise it's single arch
+              multidigest=$(jq -r ".manifests[].digest?" <<< "${multidigest}")
+            fi
+            if digest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Accept: application/vnd.oci.image.manifest.v1+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${multidigest}"); then
+              digest=$(jq -r '.config.digest' <<< "${digest}");
+            fi
+          fi
+          image_info=$(curl -sL \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/blobs/${digest}")
+          if [[ $(echo $image_info | jq -r '.container_config') == "null" ]]; then
+            image_info=$(echo $image_info | jq -r '.config')
+          else
+            image_info=$(echo $image_info | jq -r '.container_config')
+          fi
+          IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
+          IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
+          if [ -z "${IMAGE_VERSION}" ]; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "Can't retrieve last pushed version, exiting" >> $GITHUB_STEP_SUMMARY
+            FAILURE_REASON="Can't retrieve last pushed version for ldap-auth tag latest"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          echo "Last pushed version: \`${IMAGE_VERSION}\`" >> $GITHUB_STEP_SUMMARY
+          if [ "${EXT_RELEASE_SANITIZED}" == "${IMAGE_VERSION}" ]; then
+            echo "Sanitized version \`${EXT_RELEASE_SANITIZED}\` already pushed, exiting" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "New version \`${EXT_RELEASE}\` found; but there already seems to be an active build on Jenkins; exiting" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          else
+            if [[ "${artifacts_found}" == "false" ]]; then
+              echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+              echo "> New version detected, but not all artifacts are published yet; skipping trigger" >> $GITHUB_STEP_SUMMARY
+              FAILURE_REASON="New version ${EXT_RELEASE} for ldap-auth tag latest is detected, however not all artifacts are uploaded to upstream release yet. Will try again later."
+              curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+                "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
+                "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            else
+              printf "\n## Trigger new build\n\n" >> $GITHUB_STEP_SUMMARY
+              echo "New sanitized version \`${EXT_RELEASE_SANITIZED}\` found; old version was \`${IMAGE_VERSION}\`. Triggering new build" >> $GITHUB_STEP_SUMMARY
+              if [[ "${artifacts_found}" == "true" ]]; then
+                echo "All artifacts seem to be uploaded." >> $GITHUB_STEP_SUMMARY
+              fi
+              response=$(curl -iX POST \
+                https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/master/buildWithParameters?PACKAGE_CHECK=false \
+                --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+              echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
+              echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
+              sleep 10
+              buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+              buildurl="${buildurl%$'\r'}"
+              echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
+              echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
+              curl -iX POST \
+                "${buildurl}submitDescription" \
+                --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+                --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+                --data-urlencode "Submit=Submit"
+              echo "**** Notifying Discord ****"
+              TRIGGER_REASON="A version change was detected for ldap-auth tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE_SANITIZED}"
+              curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+                "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
+                "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            fi
+          fi

.github/workflows/external_trigger_scheduler.yml

@@ -0,0 +1,48 @@
+name: External Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '45 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  external-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.1.1
+        with:
+          fetch-depth: '0'
+
+      - name: External Trigger Scheduler
+        run: |
+          printf "# External trigger scheduler for docker-ldap-auth\n\n" >> $GITHUB_STEP_SUMMARY
+          printf "Found the branches:\n\n%s\n" "$(git for-each-ref --format='- %(refname:lstrip=3)' refs/remotes)" >> $GITHUB_STEP_SUMMARY
+          for br in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes)
+          do
+            if [[ "${br}" == "HEAD" ]]; then
+              printf "\nSkipping %s.\n" ${br} >> $GITHUB_STEP_SUMMARY
+              continue
+            fi
+            printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
+            ls_jenkins_vars=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-ldap-auth/${br}/jenkins-vars.yml)
+            ls_branch=$(echo "${ls_jenkins_vars}" | yq -r '.ls_branch')
+            ls_trigger=$(echo "${ls_jenkins_vars}" | yq -r '.external_type')
+            if [[ "${br}" == "${ls_branch}" ]] && [[ "${ls_trigger}" != "os" ]]; then
+              echo "Branch appears to be live and trigger is not os; checking workflow." >> $GITHUB_STEP_SUMMARY
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-ldap-auth/${br}/.github/workflows/external_trigger.yml > /dev/null 2>&1; then
+                echo "Triggering external trigger workflow for branch." >> $GITHUB_STEP_SUMMARY
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-ldap-auth/actions/workflows/external_trigger.yml/dispatches
+              else
+                echo "Skipping branch due to no external trigger workflow present." >> $GITHUB_STEP_SUMMARY
+              fi
+            else
+              echo "Skipping branch due to being detected as dev branch or having no external version." >> $GITHUB_STEP_SUMMARY
+            fi
+          done

.github/workflows/greetings.yml

@@ -0,0 +1,19 @@
+name: Greetings
+
+on: [pull_request_target, issues]
+
+permissions:
+  contents: read
+
+jobs:
+  greeting:
+    permissions:
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/first-interaction@v1
+      with:
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.'
+        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-ldap-auth/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package_trigger_scheduler.yml

@@ -0,0 +1,103 @@
+name: Package Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '17 13 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.1.1
+        with:
+          fetch-depth: '0'
+
+      - name: Package Trigger Scheduler
+        env:
+          SKIP_PACKAGE_TRIGGER: ${{ vars.SKIP_PACKAGE_TRIGGER }}
+        run: |
+          printf "# Package trigger scheduler for docker-ldap-auth\n\n" >> $GITHUB_STEP_SUMMARY
+          printf "Found the branches:\n\n%s\n" "$(git for-each-ref --format='- %(refname:lstrip=3)' refs/remotes)" >> $GITHUB_STEP_SUMMARY
+          for br in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes)
+          do
+            if [[ "${br}" == "HEAD" ]]; then
+              printf "\nSkipping %s.\n" ${br} >> $GITHUB_STEP_SUMMARY
+              continue
+            fi
+            printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
+            JENKINS_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-ldap-auth/${br}/jenkins-vars.yml)
+            if ! curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-ldap-auth/${br}/Jenkinsfile >/dev/null 2>&1; then
+              echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+              echo "> No Jenkinsfile found. Branch is either deprecated or is an early dev branch." >> $GITHUB_STEP_SUMMARY
+              skipped_branches="${skipped_branches}${br} "
+            elif [[ "${br}" == $(yq -r '.ls_branch' <<< "${JENKINS_VARS}") ]]; then
+              echo "Branch appears to be live; checking workflow." >> $GITHUB_STEP_SUMMARY
+              README_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-ldap-auth/${br}/readme-vars.yml)
+              if [[ $(yq -r '.project_deprecation_status' <<< "${README_VARS}") == "true" ]]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Branch appears to be deprecated; skipping trigger." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif [[ $(yq -r '.skip_package_check' <<< "${JENKINS_VARS}") == "true" ]]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Skipping branch ${br} due to \`skip_package_check\` being set in \`jenkins-vars.yml\`." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif grep -q "^ldap-auth_${br}" <<< "${SKIP_PACKAGE_TRIGGER}"; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Github organizational variable \`SKIP_PACKAGE_TRIGGER\` contains \`ldap-auth_${br}\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/${br}/lastBuild/api/json | jq -r '.building' 2>/dev/null) == "true" ]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> There already seems to be an active build on Jenkins; skipping package trigger for ${br}" >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              else
+                echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+                echo "> Triggering package trigger for branch ${br}" >> $GITHUB_STEP_SUMMARY
+                printf "> To disable, add \`ldap-auth_%s\` into the Github organizational variable \`SKIP_PACKAGE_TRIGGER\`.\n\n" "${br}" >> $GITHUB_STEP_SUMMARY
+                triggered_branches="${triggered_branches}${br} "
+                response=$(curl -iX POST \
+                  https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/${br}/buildWithParameters?PACKAGE_CHECK=true \
+                  --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+                if [[ -z "${response}" ]]; then
+                  echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                  echo "> Jenkins build could not be triggered. Skipping branch."
+                  continue
+                fi
+                echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
+                echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
+                sleep 10
+                buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+                buildurl="${buildurl%$'\r'}"
+                echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
+                echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
+                if ! curl -ifX POST \
+                  "${buildurl}submitDescription" \
+                  --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+                  --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+                  --data-urlencode "Submit=Submit"; then
+                  echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                  echo "> Unable to change the Jenkins job description."
+                fi
+                sleep 20
+              fi
+            else
+              echo "Skipping branch ${br} due to being detected as dev branch." >> $GITHUB_STEP_SUMMARY
+            fi
+          done
+          if [[ -n "${triggered_branches}" ]] || [[ -n "${skipped_branches}" ]]; then
+            if [[ -n "${triggered_branches}" ]]; then
+              NOTIFY_BRANCHES="**Triggered:** ${triggered_branches} \n"
+              NOTIFY_BUILD_URL="**Build URL:** https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-ldap-auth/activity/ \n"
+              echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
+            fi
+            if [[ -n "${skipped_branches}" ]]; then
+              NOTIFY_BRANCHES="${NOTIFY_BRANCHES}**Skipped:** ${skipped_branches} \n"
+            fi
+            echo "**** Notifying Discord ****"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+              "description": "**Package Check Build(s) for ldap-auth** \n'"${NOTIFY_BRANCHES}"''"${NOTIFY_BUILD_URL}"'"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+          fi

.github/workflows/permissions.yml

@@ -0,0 +1,12 @@
+name: Permission check
+on:
+  pull_request_target:
+    paths:
+      - '**/run'
+      - '**/finish'
+      - '**/check'
+      - 'root/migrations/*'
+
+jobs:
+  permission_check:
+    uses: linuxserver/github-workflows/.github/workflows/init-svc-executable-permissions.yml@v1

.gitignore

@@ -41,3 +41,7 @@ $RECYCLE.BIN/
 Network Trash Folder
 Temporary Items
 .apdisk
+.jenkins-external
+
+# Local virtual environment
+.venv/

Dockerfile

@@ -1,4 +1,6 @@
-FROM lsiobase/alpine:3.11
+# syntax=docker/dockerfile:1
+
+FROM ghcr.io/linuxserver/baseimage-alpine:3.21
 
 # set version label
 ARG BUILD_DATE
@@ -8,33 +10,34 @@ LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DA
 LABEL maintainer="aptalca"
 
 RUN \
- echo "**** install build packages ****" && \
+  echo "**** install build packages ****" && \
- apk add --no-cache --virtual=build-dependencies \
+  apk add --no-cache --virtual=build-dependencies \
-	build-base \
+    build-base \
-	libffi-dev \
+    openldap-dev \
-	openldap-dev \
+    python3-dev && \
-	python3-dev && \
+  echo "**** install runtime packages ****" && \
- echo "**** install runtime packages ****" && \
+  apk add --no-cache \
- apk add --no-cache \
+    libffi \
-	libffi \
+    libldap \
-	libldap \
+    python3 && \
-	python3 && \
+  if [ -z ${LDAP_VERSION+x} ]; then \
- if [ -z ${LDAP_VERSION+x} ]; then \
+    LDAP_VERSION=$(curl -sL  https://pypi.python.org/pypi/python-ldap/json |jq -r '. | .info.version'); \
-  LDAP_INSTALL="python-ldap"; \
+  fi && \
- else \
+  python3 -m venv /lsiopy && \
-  LDAP_INSTALL="python-ldap==${LDAP_VERSION}"; \
+  pip install -U --no-cache-dir \
- fi && \
+    pip \
- pip3 install -U --no-cache-dir \
+    wheel && \
-        pip && \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.21/ \
- pip install -U \
+    cryptography \
-        cryptography \
+    legacy-cgi \
-        ${LDAP_INSTALL} && \
+    python-ldap=="${LDAP_VERSION}" && \
- echo "**** cleanup ****" && \
+  printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
- apk del --purge \
+  echo "**** cleanup ****" && \
-        build-dependencies && \
+  apk del --purge \
- rm -rf \
+    build-dependencies && \
-        /tmp/* \
+  rm -rf \
-        /root/.cache/pip
+    /tmp/* \
+    $HOME/.cache
 
 # copy local files
 COPY root/ /

Dockerfile.aarch64

@@ -1,4 +1,6 @@
-FROM lsiobase/alpine:arm64v8-3.11
+# syntax=docker/dockerfile:1
+
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.21
 
 # set version label
 ARG BUILD_DATE
@@ -8,33 +10,34 @@ LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DA
 LABEL maintainer="aptalca"
 
 RUN \
- echo "**** install build packages ****" && \
+  echo "**** install build packages ****" && \
- apk add --no-cache --virtual=build-dependencies \
+  apk add --no-cache --virtual=build-dependencies \
-	build-base \
+    build-base \
-	libffi-dev \
+    openldap-dev \
-	openldap-dev \
+    python3-dev && \
-	python3-dev && \
+  echo "**** install runtime packages ****" && \
- echo "**** install runtime packages ****" && \
+  apk add --no-cache \
- apk add --no-cache \
+    libffi \
-	libffi \
+    libldap \
-	libldap \
+    python3 && \
-	python3 && \
+  if [ -z ${LDAP_VERSION+x} ]; then \
- if [ -z ${LDAP_VERSION+x} ]; then \
+    LDAP_VERSION=$(curl -sL  https://pypi.python.org/pypi/python-ldap/json |jq -r '. | .info.version'); \
-  LDAP_INSTALL="python-ldap"; \
+  fi && \
- else \
+  python3 -m venv /lsiopy && \
-  LDAP_INSTALL="python-ldap==${LDAP_VERSION}"; \
+  pip install -U --no-cache-dir \
- fi && \
+    pip \
- pip3 install -U --no-cache-dir \
+    wheel && \
-        pip && \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.21/ \
- pip install -U \
+    cryptography \
-        cryptography \
+    legacy-cgi \
-        ${LDAP_INSTALL} && \
+    python-ldap=="${LDAP_VERSION}" && \
- echo "**** cleanup ****" && \
+  printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
- apk del --purge \
+  echo "**** cleanup ****" && \
-        build-dependencies && \
+  apk del --purge \
- rm -rf \
+    build-dependencies && \
-        /tmp/* \
+  rm -rf \
-        /root/.cache/pip
+    /tmp/* \
+    $HOME/.cache
 
 # copy local files
 COPY root/ /

Dockerfile.armhf

@@ -1,43 +0,0 @@
-FROM lsiobase/alpine:arm32v7-3.11
-
-# set version label
-ARG BUILD_DATE
-ARG VERSION
-ARG LDAP_VERSION
-LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="aptalca"
-
-RUN \
- echo "**** install build packages ****" && \
- apk add --no-cache --virtual=build-dependencies \
-	build-base \
-	libffi-dev \
-	openldap-dev \
-	python3-dev && \
- echo "**** install runtime packages ****" && \
- apk add --no-cache \
-	libffi \
-	libldap \
-	python3 && \
- if [ -z ${LDAP_VERSION+x} ]; then \
-  LDAP_INSTALL="python-ldap"; \
- else \
-  LDAP_INSTALL="python-ldap==${LDAP_VERSION}"; \
- fi && \
- pip3 install -U --no-cache-dir \
-        pip && \
- pip install -U \
-        cryptography \
-        ${LDAP_INSTALL} && \
- echo "**** cleanup ****" && \
- apk del --purge \
-        build-dependencies && \
- rm -rf \
-        /tmp/* \
-        /root/.cache/pip
-
-# copy local files
-COPY root/ /
-
-# ports and volumes
-EXPOSE 8888 9000

README.md

@@ -1,192 +1,315 @@
+<!-- DO NOT EDIT THIS FILE MANUALLY -->
+<!-- Please read https://github.com/linuxserver/docker-ldap-auth/blob/master/.github/CONTRIBUTING.md -->
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)
 
-[![Blog](https://img.shields.io/static/v1.svg?style=flat-square&color=E68523&label=linuxserver.io&message=Blog)](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!")
+[![Blog](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Blog)](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!")
-[![Discord](https://img.shields.io/discord/354974912613449730.svg?style=flat-square&color=E68523&label=Discord&logo=discord&logoColor=FFFFFF)](https://discord.gg/YWrKVTn "realtime support / chat with the community and the team.")
+[![Discord](https://img.shields.io/discord/354974912613449730.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Discord&logo=discord)](https://linuxserver.io/discord "realtime support / chat with the community and the team.")
-[![Discourse](https://img.shields.io/discourse/https/discourse.linuxserver.io/topics.svg?style=flat-square&color=E68523&logo=discourse&logoColor=FFFFFF)](https://discourse.linuxserver.io "post on our community forum.")
+[![Discourse](https://img.shields.io/discourse/https/discourse.linuxserver.io/topics.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=discourse)](https://discourse.linuxserver.io "post on our community forum.")
-[![Fleet](https://img.shields.io/static/v1.svg?style=flat-square&color=E68523&label=linuxserver.io&message=Fleet)](https://fleet.linuxserver.io "an online web interface which displays all of our maintained images.")
+[![GitHub](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub&logo=github)](https://github.com/linuxserver "view the source for all of our repositories.")
-[![GitHub](https://img.shields.io/static/v1.svg?style=flat-square&color=E68523&label=linuxserver.io&message=GitHub&logo=github&logoColor=FFFFFF)](https://github.com/linuxserver "view the source for all of our repositories.")
+[![Open Collective](https://img.shields.io/opencollective/all/linuxserver.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Supporters&logo=open%20collective)](https://opencollective.com/linuxserver "please consider helping us by either donating or contributing to our budget")
-[![Open Collective](https://img.shields.io/opencollective/all/linuxserver.svg?style=flat-square&color=E68523&label=Supporters&logo=open%20collective&logoColor=FFFFFF)](https://opencollective.com/linuxserver "please consider helping us by either donating or contributing to our budget")
 
-The [LinuxServer.io](https://linuxserver.io) team brings you another container release featuring :-
+The [LinuxServer.io](https://linuxserver.io) team brings you another container release featuring:
 
- * regular and timely application updates
+* regular and timely application updates
- * easy user mappings (PGID, PUID)
+* easy user mappings (PGID, PUID)
- * custom base image with s6 overlay
+* custom base image with s6 overlay
- * weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
+* weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
- * regular security updates
+* regular security updates
 
 Find us at:
+
 * [Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more!
-* [Discord](https://discord.gg/YWrKVTn) - realtime support / chat with the community and the team.
+* [Discord](https://linuxserver.io/discord) - realtime support / chat with the community and the team.
 * [Discourse](https://discourse.linuxserver.io) - post on our community forum.
-* [Fleet](https://fleet.linuxserver.io) - an online web interface which displays all of our maintained images.
 * [GitHub](https://github.com/linuxserver) - view the source for all of our repositories.
 * [Open Collective](https://opencollective.com/linuxserver) - please consider helping us by either donating or contributing to our budget
 
 # [linuxserver/ldap-auth](https://github.com/linuxserver/docker-ldap-auth)
 
-[![GitHub Stars](https://img.shields.io/github/stars/linuxserver/docker-ldap-auth.svg?style=flat-square&color=E68523&logo=github&logoColor=FFFFFF)](https://github.com/linuxserver/docker-ldap-auth)
+[![Scarf.io pulls](https://scarf.sh/installs-badge/linuxserver-ci/linuxserver%2Fldap-auth?color=94398d&label-color=555555&logo-color=ffffff&style=for-the-badge&package-type=docker)](https://scarf.sh)
-[![GitHub Release](https://img.shields.io/github/release/linuxserver/docker-ldap-auth.svg?style=flat-square&color=E68523&logo=github&logoColor=FFFFFF)](https://github.com/linuxserver/docker-ldap-auth/releases)
+[![GitHub Stars](https://img.shields.io/github/stars/linuxserver/docker-ldap-auth.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-ldap-auth)
-[![GitHub Package Repository](https://img.shields.io/static/v1.svg?style=flat-square&color=E68523&label=linuxserver.io&message=GitHub%20Package&logo=github&logoColor=FFFFFF)](https://github.com/linuxserver/docker-ldap-auth/packages)
+[![GitHub Release](https://img.shields.io/github/release/linuxserver/docker-ldap-auth.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-ldap-auth/releases)
-[![GitLab Container Registry](https://img.shields.io/static/v1.svg?style=flat-square&color=E68523&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab&logoColor=FFFFFF)](https://gitlab.com/Linuxserver.io/docker-ldap-auth/container_registry)
+[![GitHub Package Repository](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub%20Package&logo=github)](https://github.com/linuxserver/docker-ldap-auth/packages)
-[![Quay.io](https://img.shields.io/static/v1.svg?style=flat-square&color=E68523&label=linuxserver.io&message=Quay.io)](https://quay.io/repository/linuxserver.io/ldap-auth)
+[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/linuxserver.io/docker-ldap-auth/container_registry)
-[![MicroBadger Layers](https://img.shields.io/microbadger/layers/linuxserver/ldap-auth.svg?style=flat-square&color=E68523)](https://microbadger.com/images/linuxserver/ldap-auth "Get your own version badge on microbadger.com")
+[![Quay.io](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Quay.io)](https://quay.io/repository/linuxserver.io/ldap-auth)
-[![Docker Pulls](https://img.shields.io/docker/pulls/linuxserver/ldap-auth.svg?style=flat-square&color=E68523&label=pulls&logo=docker&logoColor=FFFFFF)](https://hub.docker.com/r/linuxserver/ldap-auth)
+[![Docker Pulls](https://img.shields.io/docker/pulls/linuxserver/ldap-auth.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=pulls&logo=docker)](https://hub.docker.com/r/linuxserver/ldap-auth)
-[![Docker Stars](https://img.shields.io/docker/stars/linuxserver/ldap-auth.svg?style=flat-square&color=E68523&label=stars&logo=docker&logoColor=FFFFFF)](https://hub.docker.com/r/linuxserver/ldap-auth)
+[![Docker Stars](https://img.shields.io/docker/stars/linuxserver/ldap-auth.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=stars&logo=docker)](https://hub.docker.com/r/linuxserver/ldap-auth)
-[![Build Status](https://ci.linuxserver.io/view/all/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/master/badge/icon?style=flat-square)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/master/)
+[![Jenkins Build](https://img.shields.io/jenkins/build?labelColor=555555&logoColor=ffffff&style=for-the-badge&jobUrl=https%3A%2F%2Fci.linuxserver.io%2Fjob%2FDocker-Pipeline-Builders%2Fjob%2Fdocker-ldap-auth%2Fjob%2Fmaster%2F&logo=jenkins)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-ldap-auth/job/master/)
-[![](https://lsio-ci.ams3.digitaloceanspaces.com/linuxserver/ldap-auth/latest/badge.svg)](https://lsio-ci.ams3.digitaloceanspaces.com/linuxserver/ldap-auth/latest/index.html)
+[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Fci-tests.linuxserver.io%2Flinuxserver%2Fldap-auth%2Flatest%2Fci-status.yml)](https://ci-tests.linuxserver.io/linuxserver/ldap-auth/latest/index.html)
 
 [Ldap-auth](https://github.com/nginxinc/nginx-ldap-auth) software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user’s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012).
 
-[![ldap-auth](https://jumpcloud.com/wp-content/uploads/2016/12/LDAP_Logo-1420591101.jpg)](https://github.com/nginxinc/nginx-ldap-auth)
+[![ldap-auth](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ldap-auth-logo.png)](https://github.com/nginxinc/nginx-ldap-auth)
 
 ## Supported Architectures
 
-Our images support multiple architectures such as `x86-64`, `arm64` and `armhf`. We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
+We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://distribution.github.io/distribution/spec/manifest-v2-2/#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
 
-Simply pulling `linuxserver/ldap-auth` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
+Simply pulling `lscr.io/linuxserver/ldap-auth:latest` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
 
 The architectures supported by this image are:
 
-| Architecture | Tag |
+| Architecture | Available | Tag |
-| :----: | --- |
+| :----: | :----: | ---- |
-| x86-64 | amd64-latest |
+| x86-64 | ✅ | amd64-\<version tag\> |
-| arm64 | arm64v8-latest |
+| arm64 | ✅ | arm64v8-\<version tag\> |
-| armhf | arm32v7-latest |
 
+## Application Setup
+
+- This container itself does not have any settings and it relies on the pertinent information passed through in http headers of incoming requests. Make sure that your webserver is set up with the right config.
+- Here's a sample config: [nginx-ldap-auth.conf](https://github.com/nginxinc/nginx-ldap-auth/blob/master/nginx-ldap-auth.conf).
+- Unlike the upstream project, this image encodes the cookie information with fernet, using a randomly generated key during container creation (or optionally user defined).
+- Also unlike the upstream project, this image serves the login page at `/ldaplogin` (as well as `/login`) to prevent clashes with reverse proxied apps that may also use `/login` for their internal auth.
+
+## Read-Only Operation
+
+This image can be run with a read-only container filesystem. For details please [read the docs](https://docs.linuxserver.io/misc/read-only/).
+
+## Non-Root Operation
+
+This image can be run with a non-root user. For details please [read the docs](https://docs.linuxserver.io/misc/non-root/).
 
 ## Usage
 
-Here are some example snippets to help you get started creating a container.
+To help you get started creating a container from this image you can either use docker-compose or the docker cli.
 
-### docker
+>[!NOTE]
+>Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided.
 
-```
+### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
-docker create \
-  --name=ldap-auth \
-  -e TZ=Europe/London \
-  -p 8888:8888 \
-  -p 9000:9000 \
-  --restart unless-stopped \
-  linuxserver/ldap-auth
-```
 
-
+```yaml
-### docker-compose
-
-Compatible with docker-compose v2 schemas.
-
-```
 ---
-version: "2"
 services:
   ldap-auth:
-    image: linuxserver/ldap-auth
+    image: lscr.io/linuxserver/ldap-auth:latest
     container_name: ldap-auth
     environment:
-      - TZ=Europe/London
+      - PUID=1000
+      - PGID=1000
+      - TZ=Etc/UTC
+      - FERNETKEY= #optional
+      - CERTFILE= #optional
+      - KEYFILE= #optional
     ports:
       - 8888:8888
       - 9000:9000
     restart: unless-stopped
 ```
 
+### docker cli ([click here for more info](https://docs.docker.com/engine/reference/commandline/cli/))
+
+```bash
+docker run -d \
+  --name=ldap-auth \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  -e TZ=Etc/UTC \
+  -e FERNETKEY= `#optional` \
+  -e CERTFILE= `#optional` \
+  -e KEYFILE= `#optional` \
+  -p 8888:8888 \
+  -p 9000:9000 \
+  --restart unless-stopped \
+  lscr.io/linuxserver/ldap-auth:latest
+```
+
 ## Parameters
 
-Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
+Containers are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
 
 | Parameter | Function |
 | :----: | --- |
-| `-p 8888` | the port for ldap auth daemon |
+| `-p 8888:8888` | the port for ldap auth daemon |
-| `-p 9000` | the port for ldap login page |
+| `-p 9000:9000` | the port for ldap login page |
-| `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London |
+| `-e PUID=1000` | for UserID - see below for explanation |
-
+| `-e PGID=1000` | for GroupID - see below for explanation |
+| `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
+| `-e FERNETKEY=` | Optionally define a custom valid fernet key (only needed if container is frequently recreated, or if using multi-node setups, invalidating previous authentications) |
+| `-e CERTFILE=` | Optionally point this to a certificate file to enable HTTP over SSL (HTTPS) for the ldap auth daemon |
+| `-e KEYFILE=` | Optionally point this to the private key file, matching the certificate file referred to in CERTFILE |
+| `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
+| `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |
 
 ## Environment variables from files (Docker secrets)
 
-You can set any environment variable from a file by using a special prepend `FILE__`. 
+You can set any environment variable from a file by using a special prepend `FILE__`.
 
 As an example:
 
-```
+```bash
--e FILE__PASSWORD=/run/secrets/mysecretpassword
+-e FILE__MYVAR=/run/secrets/mysecretvariable
 ```
 
-Will set the environment variable `PASSWORD` based on the contents of the `/run/secrets/mysecretpassword` file.
+Will set the environment variable `MYVAR` based on the contents of the `/run/secrets/mysecretvariable` file.
 
+## Umask for running applications
 
-&nbsp;
+For all of our images we provide the ability to override the default umask settings for services started within the containers using the optional `-e UMASK=022` setting.
-## Application Setup
+Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up [here](https://en.wikipedia.org/wiki/Umask) before asking for support.
 
-- This container itself does not have any settings and it relies on the pertinent information passed through in http headers of incoming requests. Make sure that your webserver is set up with the right config.
+## User / Group Identifiers
-- Here's a sample config: [nginx-ldap-auth.conf](https://github.com/nginxinc/nginx-ldap-auth/blob/master/nginx-ldap-auth.conf).
 
+When using volumes (`-v` flags), permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`.
 
+Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
+
+In this instance `PUID=1000` and `PGID=1000`, to find yours use `id your_user` as below:
+
+```bash
+id your_user
+```
+
+Example output:
+
+```text
+uid=1000(your_user) gid=1000(your_user) groups=1000(your_user)
+```
+
+## Docker Mods
+
+[![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=ldap-auth&query=%24.mods%5B%27ldap-auth%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=ldap-auth "view available mods for this container.") [![Docker Universal Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=universal&query=%24.mods%5B%27universal%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=universal "view available universal mods.")
+
+We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.
 
 ## Support Info
 
-* Shell access whilst the container is running: `docker exec -it ldap-auth /bin/bash`
+* Shell access whilst the container is running:
-* To monitor the logs of the container in realtime: `docker logs -f ldap-auth`
+
-* container version number
+    ```bash
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' ldap-auth`
+    docker exec -it ldap-auth /bin/bash
-* image version number
+    ```
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' linuxserver/ldap-auth`
+
+* To monitor the logs of the container in realtime:
+
+    ```bash
+    docker logs -f ldap-auth
+    ```
+
+* Container version number:
+
+    ```bash
+    docker inspect -f '{{ index .Config.Labels "build_version" }}' ldap-auth
+    ```
+
+* Image version number:
+
+    ```bash
+    docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/ldap-auth:latest
+    ```
 
 ## Updating Info
 
-Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (ie. nextcloud, plex), we do not recommend or support updating apps inside the container. Please consult the [Application Setup](#application-setup) section above to see if it is recommended for the image.
+Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (noted in the relevant readme.md), we do not recommend or support updating apps inside the container. Please consult the [Application Setup](#application-setup) section above to see if it is recommended for the image.
 
 Below are the instructions for updating containers:
 
-### Via Docker Run/Create
-* Update the image: `docker pull linuxserver/ldap-auth`
-* Stop the running container: `docker stop ldap-auth`
-* Delete the container: `docker rm ldap-auth`
-* Recreate a new container with the same docker create parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
-* Start the new container: `docker start ldap-auth`
-* You can also remove the old dangling images: `docker image prune`
-
 ### Via Docker Compose
-* Update all images: `docker-compose pull`
-  * or update a single image: `docker-compose pull ldap-auth`
-* Let compose update all containers as necessary: `docker-compose up -d`
-  * or update a single container: `docker-compose up -d ldap-auth`
-* You can also remove the old dangling images: `docker image prune`
 
-### Via Watchtower auto-updater (especially useful if you don't remember the original parameters)
+* Update images:
-* Pull the latest image at its tag and replace it with the same env variables in one run:
+    * All images:
-  ```
-  docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  containrrr/watchtower \
-  --run-once ldap-auth
-  ```
 
-**Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using Docker Compose.
+        ```bash
+        docker-compose pull
+        ```
 
-* You can also remove the old dangling images: `docker image prune`
+    * Single image:
+
+        ```bash
+        docker-compose pull ldap-auth
+        ```
+
+* Update containers:
+    * All containers:
+
+        ```bash
+        docker-compose up -d
+        ```
+
+    * Single container:
+
+        ```bash
+        docker-compose up -d ldap-auth
+        ```
+
+* You can also remove the old dangling images:
+
+    ```bash
+    docker image prune
+    ```
+
+### Via Docker Run
+
+* Update the image:
+
+    ```bash
+    docker pull lscr.io/linuxserver/ldap-auth:latest
+    ```
+
+* Stop the running container:
+
+    ```bash
+    docker stop ldap-auth
+    ```
+
+* Delete the container:
+
+    ```bash
+    docker rm ldap-auth
+    ```
+
+* Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
+* You can also remove the old dangling images:
+
+    ```bash
+    docker image prune
+    ```
+
+### Image Update Notifications - Diun (Docker Image Update Notifier)
+
+>[!TIP]
+>We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
 
 ## Building locally
 
 If you want to make local modifications to these images for development purposes or just to customize the logic:
-```
+
+```bash
 git clone https://github.com/linuxserver/docker-ldap-auth.git
 cd docker-ldap-auth
 docker build \
   --no-cache \
   --pull \
-  -t linuxserver/ldap-auth:latest .
+  -t lscr.io/linuxserver/ldap-auth:latest .
 ```
 
-The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
-```
+
-docker run --rm --privileged multiarch/qemu-user-static:register --reset
+```bash
+docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
 ```
 
 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
 
 ## Versions
 
+* **25.12.24:** - Add `legacy-cgi`. Fix fernet key storage.
+* **22.12.24:** - Rebase to Alpine 3.21. Add support for read-only and non-root.
+* **30.06.24:** - Rebase to Alpine 3.20.
+* **23.12.23:** - Rebase to Alpine 3.19.
+* **20.06.23:** - Sync upstream changes, including the ability to disable referrals with `X-Ldap-DisableReferrals`.
+* **25.05.23:** - Rebase to Alpine 3.18, deprecate armhf.
+* **30.12.22:** - Rebase to alpine 3.17.
+* **19.09.22:** - Rebase to alpine 3.15.
+* **14.05.21:** - Add linuxserver wheel index.
+* **12.02.21:** - Clean up cargo/rust cache.
+* **10.02.21:** - Rebasing to alpine 3.13.
+* **08.09.20:** - Set form action correctly.
+* **30.07.20:** - Fix bug related to unset optional `CERTFILE` and `KEYFILE` vars.
+* **27.07.20:** - Add support for HTTP over SSL (HTTPS).
+* **21.07.20:** - Add support for optional user defined fernet key.
+* **02.06.20:** - Rebasing to alpine 3.12, serve login page at `/ldaplogin` as well as `/login`, to prevent clashes with reverese proxied apps.
+* **17.05.20:** - Add support for self-signed CA certs.
 * **20.02.20:** - Switch to python3.
 * **19.12.19:** - Rebasing to alpine 3.11.
 * **01.07.19:** - Fall back to base64 encoding when basic http auth is used.

jenkins-vars.yml

@@ -19,10 +19,10 @@ repo_vars:
   - DIST_IMAGE = 'alpine'
   - MULTIARCH='true'
   - CI='true'
-  - CI_WEB='false'
+  - CI_WEB='true'
-  - CI_PORT=''
+  - CI_PORT='9000'
-  - CI_SSL=''
+  - CI_SSL='false'
-  - CI_DELAY='30'
+  - CI_DELAY='60'
-  - CI_DOCKERENV='TZ=US/Pacific'
+  - CI_DOCKERENV=''
   - CI_AUTH=''
-  - CI_WEBPATH=''
+  - CI_WEBPATH='/test'

package_versions.txt

@@ -1,36 +1,78 @@
-alpine-baselayout-3.2.0-r3
+NAME                    VERSION           TYPE                    
-alpine-keys-2.1-r2
+Simple Launcher         1.1.0.14          binary  (+5 duplicates)  
-apk-tools-2.10.4-r3
+acl-libs                2.3.2-r1          apk                      
-bash-5.0.11-r1
+alpine-baselayout       3.6.8-r1          apk                      
-busybox-1.31.1-r9
+alpine-baselayout-data  3.6.8-r1          apk                      
-ca-certificates-20191127-r1
+alpine-keys             2.5-r0            apk                      
-ca-certificates-cacert-20191127-r1
+alpine-release          3.21.6-r0         apk                      
-coreutils-8.31-r0
+apk-tools               2.14.6-r3         apk                      
-db-5.3.28-r1
+bash                    5.2.37-r0         apk                      
-expat-2.2.9-r1
+brotli-libs             1.1.0-r2          apk                      
-gdbm-1.13-r1
+busybox                 1.37.0-r14        apk                      
-libacl-2.2.53-r0
+busybox-binsh           1.37.0-r14        apk                      
-libattr-2.4.48-r0
+c-ares                  1.34.6-r0         apk                      
-libbz2-1.0.8-r1
+ca-certificates         20250911-r0       apk                      
-libc-utils-0.7.2-r0
+ca-certificates-bundle  20250911-r0       apk                      
-libcrypto1.1-1.1.1d-r3
+catatonit               0.2.0-r0          apk                      
-libffi-3.2.1-r6
+cffi                    2.0.0             python                   
-libldap-2.4.48-r1
+coreutils               9.5-r2            apk                      
-libsasl-2.1.27-r5
+coreutils-env           9.5-r2            apk                      
-libssl1.1-1.1.1d-r3
+coreutils-fmt           9.5-r2            apk                      
-libtls-standalone-2.9.1-r0
+coreutils-sha512sum     9.5-r2            apk                      
-linux-pam-1.3.1-r1
+cryptography            46.0.5            python                   
-musl-1.1.24-r1
+curl                    8.14.1-r2         apk                      
-musl-utils-1.1.24-r1
+findutils               4.10.0-r0         apk                      
-ncurses-libs-6.1_p20200118-r2
+gdbm                    1.24-r0           apk                      
-ncurses-terminfo-base-6.1_p20200118-r2
+jq                      1.7.1-r0          apk                      
-python3-3.8.2-r0
+legacy-cgi              2.6.4             python                   
-readline-8.0.1-r0
+libattr                 2.5.2-r2          apk                      
-scanelf-1.2.4-r0
+libbsd                  0.12.2-r0         apk                      
-shadow-4.7-r1
+libbz2                  1.0.8-r6          apk                      
-sqlite-libs-3.30.1-r1
+libcrypto3              3.3.6-r0          apk                      
-ssl_client-1.31.1-r9
+libcurl                 8.14.1-r2         apk                      
-tzdata-2019c-r0
+libexpat                2.7.4-r0          apk                      
-xz-5.2.4-r0
+libffi                  3.4.7-r0          apk                      
-xz-libs-5.2.4-r0
+libgcc                  14.2.0-r4         apk                      
-zlib-1.2.11-r3
+libidn2                 2.3.7-r0          apk                      
+libintl                 0.22.5-r0         apk                      
+libldap                 2.6.8-r0          apk                      
+libmd                   1.1.0-r0          apk                      
+libncursesw             6.5_p20241006-r3  apk                      
+libpanelw               6.5_p20241006-r3  apk                      
+libproc2                4.0.4-r2          apk                      
+libpsl                  0.21.5-r3         apk                      
+libsasl                 2.1.28-r8         apk                      
+libssl3                 3.3.6-r0          apk                      
+libstdc++               14.2.0-r4         apk                      
+libunistring            1.2-r0            apk                      
+linux-pam               1.6.1-r1          apk                      
+mpdecimal               4.0.0-r0          apk                      
+musl                    1.2.5-r9          apk                      
+musl-utils              1.2.5-r9          apk                      
+ncurses-terminfo-base   6.5_p20241006-r3  apk                      
+netcat-openbsd          1.226.1.1-r0      apk                      
+nghttp2-libs            1.64.0-r0         apk                      
+oniguruma               6.9.9-r0          apk                      
+packaging               26.0              python                   
+pip                     26.0.1            python                   
+procps-ng               4.0.4-r2          apk                      
+pyasn1                  0.6.2             python                   
+pyasn1-modules          0.4.2             python                   
+pyc                     3.12.12-r0        apk                      
+pycparser               3.0               python                   
+python-ldap             3.4.5             python                   
+python3                 3.12.12-r0        apk                      
+python3-pyc             3.12.12-r0        apk                      
+python3-pycache-pyc0    3.12.12-r0        apk                      
+readline                8.2.13-r0         apk                      
+scanelf                 1.3.8-r1          apk                      
+shadow                  4.16.0-r1         apk                      
+skalibs-libs            2.14.3.0-r0       apk                      
+sqlite-libs             3.48.0-r4         apk                      
+ssl_client              1.37.0-r14        apk                      
+tzdata                  2025c-r0          apk                      
+utmps-libs              0.1.2.3-r2        apk                      
+wheel                   0.46.3            python                   
+xz-libs                 5.6.3-r1          apk                      
+zlib                    1.3.1-r2          apk                      
+zstd-libs               1.5.6-r2          apk                      

readme-vars.yml

@@ -3,43 +3,103 @@
 # project information
 project_name: ldap-auth
 project_url: "https://github.com/nginxinc/nginx-ldap-auth"
-project_logo: "https://jumpcloud.com/wp-content/uploads/2016/12/LDAP_Logo-1420591101.jpg"
+project_logo: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ldap-auth-logo.png"
 project_blurb: "[{{ project_name|capitalize }}]({{ project_url }}) software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user’s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012)."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"
-
+project_categories: "Administration,Security"
 # supported architectures
 available_architectures:
-  - { arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
+  - {arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
-  - { arch: "{{ arch_arm64 }}", tag: "arm64v8-latest"}
+  - {arch: "{{ arch_arm64 }}", tag: "arm64v8-latest"}
-  - { arch: "{{ arch_armhf }}", tag: "arm32v7-latest"}
-
 # container parameters
-common_param_env_vars_enabled: false
-param_container_name: "{{ project_name }}"
-param_usage_include_vols: false
-param_volumes: ""
 param_usage_include_ports: true
+param_container_name: "{{ project_name }}"
 param_ports:
-  - { external_port: "8888", internal_port: "8888", port_desc: "the port for ldap auth daemon" }
+  - {external_port: "8888", internal_port: "8888", port_desc: "the port for ldap auth daemon"}
-  - { external_port: "9000", internal_port: "9000", port_desc: "the port for ldap login page" }
+  - {external_port: "9000", internal_port: "9000", port_desc: "the port for ldap login page"}
-param_usage_include_env: true
+# optional container parameters
-param_env_vars:
+opt_param_usage_include_env: true
-  - { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London"}
+opt_param_env_vars:
-
+  - {env_var: "FERNETKEY", env_value: "", desc: "Optionally define a custom valid fernet key (only needed if container is frequently recreated, or if using multi-node setups, invalidating previous authentications)"}
+  - {env_var: "CERTFILE", env_value: "", desc: "Optionally point this to a certificate file to enable HTTP over SSL (HTTPS) for the ldap auth daemon"}
+  - {env_var: "KEYFILE", env_value: "", desc: "Optionally point this to the private key file, matching the certificate file referred to in CERTFILE"}
+readonly_supported: true
+nonroot_supported: true
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |
   - This container itself does not have any settings and it relies on the pertinent information passed through in http headers of incoming requests. Make sure that your webserver is set up with the right config.
   - Here's a sample config: [nginx-ldap-auth.conf](https://github.com/nginxinc/nginx-ldap-auth/blob/master/nginx-ldap-auth.conf).
-
+  - Unlike the upstream project, this image encodes the cookie information with fernet, using a randomly generated key during container creation (or optionally user defined).
+  - Also unlike the upstream project, this image serves the login page at `/ldaplogin` (as well as `/login`) to prevent clashes with reverse proxied apps that may also use `/login` for their internal auth.
+# init diagram
+init_diagram: |
+  "ldap-auth:latest": {
+    docker-mods
+    base {
+      fix-attr +\nlegacy cont-init
+    }
+    docker-mods -> base
+    legacy-services
+    custom services
+    init-services -> legacy-services
+    init-services -> custom services
+    custom services -> legacy-services
+    legacy-services -> ci-service-check
+    init-migrations -> init-adduser
+    init-os-end -> init-config
+    init-config -> init-config-end
+    init-crontab-config -> init-config-end
+    init-ldap-config -> init-config-end
+    init-config -> init-crontab-config
+    init-mods-end -> init-custom-files
+    init-adduser -> init-device-perms
+    base -> init-envfile
+    init-config -> init-ldap-config
+    base -> init-migrations
+    init-config-end -> init-mods
+    init-mods-package-install -> init-mods-end
+    init-mods -> init-mods-package-install
+    init-adduser -> init-os-end
+    init-device-perms -> init-os-end
+    init-envfile -> init-os-end
+    init-custom-files -> init-services
+    init-services -> svc-cron
+    svc-cron -> legacy-services
+    init-services -> svc-ldap-app
+    svc-ldap-app -> legacy-services
+    init-services -> svc-ldap-daemon
+    svc-ldap-daemon -> legacy-services
+  }
+  Base Images: {
+    "baseimage-alpine:3.21"
+  }
+  "ldap-auth:latest" <- Base Images
 # changelog
 changelogs:
-  - { date: "20.02.20:", desc: "Switch to python3." }
+  - {date: "25.12.24:", desc: "Add `legacy-cgi`. Fix fernet key storage."}
-  - { date: "19.12.19:", desc: "Rebasing to alpine 3.11." }
+  - {date: "22.12.24:", desc: "Rebase to Alpine 3.21. Add support for read-only and non-root."}
-  - { date: "01.07.19:", desc: "Fall back to base64 encoding when basic http auth is used." }
+  - {date: "30.06.24:", desc: "Rebase to Alpine 3.20."}
-  - { date: "28.06.19:", desc: "Rebasing to alpine 3.10." }
+  - {date: "23.12.23:", desc: "Rebase to Alpine 3.19."}
-  - { date: "23.03.19:", desc: "Switching to new Base images, shift to arm32v7 tag." }
+  - {date: "20.06.23:", desc: "Sync upstream changes, including the ability to disable referrals with `X-Ldap-DisableReferrals`."}
-  - { date: "22.02.19:", desc: "Rebasing to alpine 3.9." }
+  - {date: "25.05.23:", desc: "Rebase to Alpine 3.18, deprecate armhf."}
-  - { date: "18.09.18:", desc: "Update pip" }
+  - {date: "30.12.22:", desc: "Rebase to alpine 3.17."}
-  - { date: "14.09.18:", desc: "Add TZ parameter, remove unnecessary PUID/PGID params" }
+  - {date: "19.09.22:", desc: "Rebase to alpine 3.15."}
-  - { date: "11.08.18:", desc: "Initial release." }
+  - {date: "14.05.21:", desc: "Add linuxserver wheel index."}
+  - {date: "12.02.21:", desc: "Clean up cargo/rust cache."}
+  - {date: "10.02.21:", desc: "Rebasing to alpine 3.13."}
+  - {date: "08.09.20:", desc: "Set form action correctly."}
+  - {date: "30.07.20:", desc: "Fix bug related to unset optional `CERTFILE` and `KEYFILE` vars."}
+  - {date: "27.07.20:", desc: "Add support for HTTP over SSL (HTTPS)."}
+  - {date: "21.07.20:", desc: "Add support for optional user defined fernet key."}
+  - {date: "02.06.20:", desc: "Rebasing to alpine 3.12, serve login page at `/ldaplogin` as well as `/login`, to prevent clashes with reverese proxied apps."}
+  - {date: "17.05.20:", desc: "Add support for self-signed CA certs."}
+  - {date: "20.02.20:", desc: "Switch to python3."}
+  - {date: "19.12.19:", desc: "Rebasing to alpine 3.11."}
+  - {date: "01.07.19:", desc: "Fall back to base64 encoding when basic http auth is used."}
+  - {date: "28.06.19:", desc: "Rebasing to alpine 3.10."}
+  - {date: "23.03.19:", desc: "Switching to new Base images, shift to arm32v7 tag."}
+  - {date: "22.02.19:", desc: "Rebasing to alpine 3.9."}
+  - {date: "18.09.18:", desc: "Update pip"}
+  - {date: "14.09.18:", desc: "Add TZ parameter, remove unnecessary PUID/PGID params"}
+  - {date: "11.08.18:", desc: "Initial release."}

root/app/fernet-key.py

@@ -4,4 +4,4 @@
 from cryptography.fernet import Fernet
 
 key = Fernet.generate_key()
-print(key)
+print(key.decode())

root/app/ldap-backend-app.py

@@ -2,14 +2,14 @@
 ''''which python  >/dev/null && exec python  "$0" "$@" # '''
 
 # Copyright (C) 2014-2015 Nginx, Inc.
-# Copyright (C) 2018 LinuxServer.io
+# Copyright (C) 2018-2020 LinuxServer.io
 
 # Example of an application working on port 9000
 # To interact with nginx-ldap-auth-daemon this application
-# 1) accepts GET  requests on /login and responds with a login form
+# 1) accepts GET  requests on /login and /ldaplogin and responds with a login form
-# 2) accepts POST requests on /login, sets a cookie, and responds with redirect
+# 2) accepts POST requests on /login and /ldaplogin, sets a cookie, and responds with redirect
 
-import sys, os, signal, base64, cgi
+import sys, os, signal, base64, cgi, datetime
 if sys.version_info.major == 2:
     from urlparse import urlparse
     from Cookie import BaseCookie
@@ -43,8 +43,11 @@ class AppHandler(BaseHTTPRequestHandler):
 
         url = urlparse(self.path)
 
+        # set the proper login page subfolder and serve form
         if url.path.startswith("/login"):
-            return self.auth_form()
+            return self.auth_form(loginsubfolder="/login")
+        if url.path.startswith("/ldaplogin"):
+            return self.auth_form(loginsubfolder="/ldaplogin")
 
         self.send_response(200)
         self.end_headers()
@@ -52,7 +55,7 @@ class AppHandler(BaseHTTPRequestHandler):
 
 
     # send login form html
-    def auth_form(self, target = None):
+    def auth_form(self, target = None, loginsubfolder = ""):
 
         # try to get target location from header
         if target == None:
@@ -88,7 +91,7 @@ class AppHandler(BaseHTTPRequestHandler):
         <div class="log-in">
             <div class="content">
                 <h1>Log in to your account</h1>
-                <form action="/login" method="post">
+                <form action="LOGINSUBFOLDER" method="post">
                     <p>
                         <input type="text" name="username" placeholder="Username" aria-label="Username" />
                     </p>
@@ -108,7 +111,7 @@ class AppHandler(BaseHTTPRequestHandler):
 
         self.send_response(200)
         self.end_headers()
-        self.wfile.write(ensure_bytes(html.replace('TARGET', target)))
+        self.wfile.write(ensure_bytes(html.replace('TARGET', target).replace('LOGINSUBFOLDER', loginsubfolder)))
 
 
     # processes posted form and sets the cookie with login/password
@@ -134,10 +137,13 @@ class AppHandler(BaseHTTPRequestHandler):
 
             self.send_response(302)
 
-            cipher_suite = Fernet(REPLACEWITHFERNETKEY)
+            fernetkey = os.getenv("FERNET_KEY").encode()
+            cipher_suite = Fernet(fernetkey)
             enc = cipher_suite.encrypt(ensure_bytes(user + ':' + passwd))
             enc = enc.decode()
-            self.send_header('Set-Cookie', 'nginxauth=' + enc + '; httponly')
+            expires = datetime.datetime.now(datetime.UTC) + datetime.timedelta(weeks=1)
+            expires_str = expires.strftime('%a, %d-%b-%Y %H:%M:%S GMT')
+            self.send_header('Set-Cookie', 'nginxauth=' + enc + f'; Expires={expires_str}; httponly')
 
             self.send_header('Location', target)
             self.end_headers()
@@ -167,4 +173,4 @@ def exit_handler(signal, frame):
 if __name__ == '__main__':
     server = AuthHTTPServer(Listen, AppHandler)
     signal.signal(signal.SIGINT, exit_handler)
-    server.serve_forever()
+    server.serve_forever()

root/app/nginx-ldap-auth-daemon.py

@@ -5,7 +5,7 @@
 # Copyright (C) 2014-2015 Nginx, Inc.
 # Copyright (C) 2018 LinuxServer.io
 
-import sys, os, signal, base64, ldap, argparse
+import sys, os, signal, base64, ldap, ldap.filter, argparse
 if sys.version_info.major == 2:
     from Cookie import BaseCookie
     from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
@@ -82,30 +82,69 @@ class AuthHandler(BaseHTTPRequestHandler):
 
             return True
 
-        ctx['action'] = 'decoding credentials'
+        ctx['action'] = 'decoding credentials with fernet key'
 
+        user: str | None
+        passwd: str | None
+        error: str | None
+        user, passwd, error = self.decode_credentials_with_fernet_key(ctx, auth_header)
+
+        if error == "InvalidToken":
+            self.log_message('Incorrect token.')
+            ctx['action'] = 'decoding credentials with base64'
+            user, passwd = self.decode_credentials_with_base64(ctx, auth_header)
+
+        if user is None and passwd is None:
+            return True
+
+        ctx['user'] = ldap.filter.escape_filter_chars(user)
+        ctx['pass'] = passwd
+
+        # Continue request processing
+        return False
+
+
+    def decode_credentials_with_fernet_key(
+        self,
+        ctx: dict,
+        auth_header: str
+    ) -> tuple[str, str, str]:
+        user: str | None = None
+        passwd: str | None = None
+        error: str | None = None
         try:
-            cipher_suite = Fernet(REPLACEWITHFERNETKEY)
+            fernetkey = os.getenv("FERNET_KEY").encode()
-            self.log_message('Trying to dechipher credentials...')
+            cipher_suite = Fernet(fernetkey)
+            self.log_message('Trying to dechipher credentials with Fernet Key...')
             auth_decoded = auth_header[6:].encode()
             auth_decoded = cipher_suite.decrypt(auth_decoded)
             auth_decoded = auth_decoded.decode("utf-8")
             user, passwd = auth_decoded.split(':', 1)
-        except InvalidToken:
+        except (InvalidToken, TypeError, UnicodeDecodeError):
-            self.log_message('Incorrect token. Trying to decode credentials from BASE64...')
+            error = "InvalidToken"
+        except Exception as e:
+            self.auth_failed(ctx)
+            self.log_error(str(e))
+        return user, passwd, error
+
+
+    def decode_credentials_with_base64(
+        self,
+        ctx: dict,
+        auth_header: str
+    ) -> tuple[str, str]:
+        user: str | None = None
+        passwd: str | None = None
+        try:
+            self.log_message('Trying to decode credentials from BASE64...')
             auth_decoded = base64.b64decode(auth_header[6:])
             auth_decoded = auth_decoded.decode("utf-8")
             user, passwd = auth_decoded.split(':', 1)
         except Exception as e:
             self.auth_failed(ctx)
-            self.log_error(e)
+            self.log_error(str(e))
-            return True
+        return user, passwd
 
-        ctx['user'] = user
-        ctx['pass'] = passwd
-
-        # Continue request processing
-        return False
 
     def get_cookie(self, name):
         cookies = self.headers.get('Cookie')
@@ -172,6 +211,7 @@ class LDAPAuthHandler(AuthHandler):
              'realm': ('X-Ldap-Realm', 'Restricted'),
              'url': ('X-Ldap-URL', None),
              'starttls': ('X-Ldap-Starttls', 'false'),
+             'disable_referrals': ('X-Ldap-DisableReferrals', 'false'),
              'basedn': ('X-Ldap-BaseDN', None),
              'template': ('X-Ldap-Template', '(cn=%(username)s)'),
              'binddn': ('X-Ldap-BindDN', ''),
@@ -214,6 +254,8 @@ class LDAPAuthHandler(AuthHandler):
                 self.log_message('LDAP baseDN is not set!')
                 return
 
+            ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
+
             ctx['action'] = 'initializing LDAP connection'
             ldap_obj = ldap.initialize(ctx['url']);
 
@@ -231,9 +273,9 @@ class LDAPAuthHandler(AuthHandler):
             if ctx['starttls'] == 'true':
                 ldap_obj.start_tls_s()
 
-            # See http://www.python-ldap.org/faq.shtml
+            # See https://www.python-ldap.org/en/latest/faq.html
-            # uncomment, if required
+            if ctx['disable_referrals'] == 'true':
-            # ldap_obj.set_option(ldap.OPT_REFERRALS, 0)
+                ldap_obj.set_option(ldap.OPT_REFERRALS, 0)
 
             ctx['action'] = 'binding as search user'
             ldap_obj.bind_s(ctx['binddn'], ctx['bindpasswd'], ldap.AUTH_SIMPLE)
@@ -250,13 +292,27 @@ class LDAPAuthHandler(AuthHandler):
                                           searchfilter, ['objectclass'], 1)
 
             ctx['action'] = 'verifying search query results'
-            if len(results) < 1:
+
+            nres = len(results)
+
+            if nres < 1:
                 self.auth_failed(ctx, 'no objects found')
                 return
 
-            ctx['action'] = 'binding as an existing user'
+            if nres > 1:
-            ldap_dn = results[0][0]
+                self.log_message("note: filter match multiple objects: %d, using first" % nres)
-            ctx['action'] += ' "%s"' % ldap_dn
+
+            user_entry = results[0]
+            ldap_dn = user_entry[0]
+
+            if ldap_dn == None:
+                self.auth_failed(ctx, 'matched object has no dn')
+                return
+
+            self.log_message('attempting to bind using dn "%s"' % (ldap_dn))
+
+            ctx['action'] = 'binding as an existing user "%s"' % ldap_dn
+
             ldap_obj.bind_s(ldap_dn, ctx['pass'], ldap.AUTH_SIMPLE)
 
             self.log_message('Auth OK for user "%s"' % (ctx['user']))
@@ -300,6 +356,9 @@ if __name__ == '__main__':
     group.add_argument('-s', '--starttls', metavar="starttls",
         default="false",
         help=("Establish a STARTTLS protected session (Default: false)"))
+    group.add_argument('--disable-referrals', metavar="disable_referrals",
+        default="false",
+        help=("Sets ldap.OPT_REFERRALS to zero (Default: false)"))
     group.add_argument('-b', metavar="baseDn", dest="basedn", default='',
         help="LDAP base dn (Default: unset)")
     group.add_argument('-D', metavar="bindDn", dest="binddn", default='',
@@ -323,6 +382,7 @@ if __name__ == '__main__':
              'realm': ('X-Ldap-Realm', args.realm),
              'url': ('X-Ldap-URL', args.url),
              'starttls': ('X-Ldap-Starttls', args.starttls),
+             'disable_referrals': ('X-Ldap-DisableReferrals', args.disable_referrals),
              'basedn': ('X-Ldap-BaseDN', args.basedn),
              'template': ('X-Ldap-Template', args.filter),
              'binddn': ('X-Ldap-BindDN', args.binddn),
@@ -331,10 +391,13 @@ if __name__ == '__main__':
     }
     LDAPAuthHandler.set_params(auth_params)
     server = AuthHTTPServer(Listen, LDAPAuthHandler)
+    if os.environ.get("CERTFILE") and os.environ.get("KEYFILE") and os.path.isfile(os.environ.get("CERTFILE")) and os.path.isfile(os.environ.get("KEYFILE")):
+        import ssl
+        server.socket = ssl.wrap_socket (server.socket, certfile=os.environ.get("CERTFILE"), keyfile=os.environ.get("KEYFILE"), server_side=True)
+        sys.stdout.write("SSL enabled using certificate file %s and key file %s\n" % (os.environ.get("CERTFILE"), os.environ.get("KEYFILE")))
     signal.signal(signal.SIGINT, exit_handler)
     signal.signal(signal.SIGTERM, exit_handler)
 
     sys.stdout.write("Start listening on %s:%d...\n" % Listen)
     sys.stdout.flush()
     server.serve_forever()
-

root/etc/cont-init.d/30-config

@@ -1,9 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-# generate fernet key for ldap if it doesn't exist
-if grep -q 'REPLACEWITHFERNETKEY' /app/ldap-backend-app.py; then
-    FERNETKEY=$(python3 /app/fernet-key.py)
-    sed -i "s/REPLACEWITHFERNETKEY/${FERNETKEY}/" /app/ldap-backend-app.py
-    sed -i "s/REPLACEWITHFERNETKEY/${FERNETKEY}/" /app/nginx-ldap-auth-daemon.py
-    echo "generated fernet key"
-fi

root/etc/s6-overlay/s6-rc.d/init-ldap-config/run

@@ -0,0 +1,18 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+# generate fernet key for ldap if it doesn't exist
+if [[ ! -f "/run/.fernetkey" ]]; then
+    if [[ -z "${FERNETKEY}" ]]; then
+        KEY=$(python3 /app/fernet-key.py)
+        echo "generated fernet key"
+    elif ! python3 -c "from cryptography.fernet import Fernet; Fernet(b'${FERNETKEY}').encrypt(b'my deep dark secret')" 2>/dev/null; then
+        echo "FERNETKEY env var is not set to a base64 encoded 32-byte key"
+        KEY=$(python3 /app/fernet-key.py)
+        echo "generated fernet key"
+    else
+        KEY="${FERNETKEY}"
+        echo "using FERNETKEY from env variable"
+    fi
+    echo "${KEY}" > /run/.fernetkey
+fi

root/etc/s6-overlay/s6-rc.d/init-ldap-config/type

@@ -0,0 +1 @@
+oneshot

root/etc/s6-overlay/s6-rc.d/init-ldap-config/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-ldap-config/run

root/etc/s6-overlay/s6-rc.d/svc-ldap-app/notification-fd

@@ -0,0 +1 @@
+3

root/etc/s6-overlay/s6-rc.d/svc-ldap-app/run

@@ -0,0 +1,16 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+export FERNET_KEY=$(cat /run/.fernetkey)
+
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 9000" \
+            s6-setuidgid abc python3 /app/ldap-backend-app.py \
+                --host 0.0.0.0 --port 9000
+else
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 9000" \
+            python3 /app/ldap-backend-app.py \
+                --host 0.0.0.0 --port 9000
+fi

root/etc/s6-overlay/s6-rc.d/svc-ldap-app/type

@@ -0,0 +1 @@
+longrun

root/etc/s6-overlay/s6-rc.d/svc-ldap-daemon/notification-fd

@@ -0,0 +1 @@
+4

root/etc/s6-overlay/s6-rc.d/svc-ldap-daemon/run

@@ -0,0 +1,16 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+export FERNET_KEY=$(cat /run/.fernetkey)
+
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 8888" \
+            s6-setuidgid abc python3 /app/nginx-ldap-auth-daemon.py \
+                --host 0.0.0.0 --port 8888
+else
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 8888" \
+            python3 /app/nginx-ldap-auth-daemon.py \
+                --host 0.0.0.0 --port 8888
+fi

root/etc/s6-overlay/s6-rc.d/svc-ldap-daemon/type

@@ -0,0 +1 @@
+longrun

root/etc/services.d/ldap-app/run

@@ -1,3 +0,0 @@
-#!/usr/bin/with-contenv bash
-exec \
-	s6-setuidgid abc python3 /app/ldap-backend-app.py --host 0.0.0.0 --port 9000

root/etc/services.d/ldap-daemon/run

@@ -1,3 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-exec s6-setuidgid abc python3 /app/nginx-ldap-auth-daemon.py --host 0.0.0.0 --port 8888