https://github.com/lldap/lldap logo
Powered by
MinerSebas - I am trying to set up lldap behind...
# troubleshooting
m
For further Information, i am running this on nixos (unstable) and this should be the relevant Part of the config:
Copy code
nix
{ config, ... }:

let
  localDomain = "${config.networking.hostName}.tailb9bed.ts.net";
in
{
  services.lldap = {
    enable = true;
    settings = {
      ldap_base_dn = "dc=minersebas,dc=com";
      http_url = "https://${localDomain}/lldap";
    };
  };

  services.caddy.virtualHosts.${localDomain}.extraConfig = ''
    @lldap path /lldap /lldap/*
    handle @lldap {
      reverse_proxy http://127.0.0.1:${toString config.services.lldap.settings.http_port}
    }
  '';
}
Putting lldap not behind a subpath, i can use it succesfully though caddy.
Copy code
nix
services.caddy.virtualHosts.${localDomain}.extraConfig = ''
      reverse_proxy http://127.0.0.1:${toString config.services.lldap.settings.http_port}
  '';
But that makes it annoying for me, as Tailscale doesnt allow subdomains for its MagicDNS. 😢
After reseting it now back to the original config, instead of showing a blank screen it redirects to 
oracle.tailb9bed.ts.net/login
(presumably it cached something), but that doesnt work because it should redirect to 
oracle.tailb9bed.ts.net/lldap/login
. 😒
n
Hmm, yes, there's an old issue asking for subpath support, but it doesn't work yet (and I'm not sure I want to do the work for it)
(but yeah, if you feel like doing it, I would accept a PR adding support for subpath)
m
⚡ ⚡ ⚡ IT LIVES ⚡ ⚡ ⚡ By using 
handle_path /lldap*
in caddy which automatically strips the 
lldap/
prefix away and this override:
Copy code
nix
pkgs.lldap.overrideAttrs
      (_: prev:
        let
          frontend = prev.passthru.frontend.overrideAttrs (_: previousAttrs: {
            postPatch = (previousAttrs.postPatch or "") + ''
              substituteInPlace app/src/infra/api.rs --replace "/api/" "/lldap/api/"
              substituteInPlace app/src/infra/api.rs --replace "/auth/" "/lldap/auth/"
            '';
            installPhase = ''
              substituteInPlace app/index.html --replace "</title>" "</title><base href=\"/lldap/\" />"
              substituteInPlace app/index.html --replace "/static/" "/lldap/static/"
              substituteInPlace app/static/main.js --replace "/pkg/" "/lldap/pkg/"
            '' + previousAttrs.installPhase;
          });

        in
        {
          postPatch = ''
            substituteInPlace server/src/infra/tcp_server.rs --subst-var-by frontend '${frontend}'
          '';
          doCheck = false;
        }
      );
I got a hardcoded version working. A customisable Version shouldn't be too hard, now that i know the five Locations/URI to change. Now Time for 🛏️
n
Niiiice! Do you think you could post your solution to https://github.com/lldap/lldap/issues/247 ? Or maybe write an example config for caddy and add it to the repo
m
n
Nice! I quickly glanced at it (on my phone), did you make sure the email reset link has the base URL as well?
m
I think that should be correctly handled, as i am reusing the existing:
Copy code
## The public URL of the server, for password reset links.
#http_url = "http://localhost"
But i havent activly tested it, as dont know how to test it.
n
You can reset the password for a user, and click on the link that gets sent
assuming that you have a working SMTP setup
m
Nope, i have no SMTP setup.
n
Could you set it up? You can send the reset emails from your personal email
m
Tried to set it up, but i cant even send it:
Copy code
Dez 05 18:09:39 oracle lldap[1459566]: 2023-12-05T17:09:39.863875716+00:00  DEBUG    │  ┝━ 🐛 [debug]: Sending email to 'scherthan_sebastian@web.de' as 'LLDAP Admin <scherthan_sebastian@web.de>' via 'scherthan_sebastian@web.de'@'smtp.web.de':'587'
Dez 05 18:09:39 oracle lldap[1459566]: 2023-12-05T17:09:39.934350708+00:00  DEBUG    │  ┝━ 🐛 [debug]: No cached session for DnsName(DnsName(DnsName("smtp.web.de"))) | log.target: "rustls::client::hs" | log.module_path: "rustls::client::hs" | log.file: "/build/cargo-vendor-dir/rustls-0.20.8/src/client/hs.rs" | log.line: 55
Dez 05 18:09:39 oracle lldap[1459566]: 2023-12-05T17:09:39.934420188+00:00  DEBUG    │  ┝━ 🐛 [debug]: Not resuming any session | log.target: "rustls::client::hs" | log.module_path: "rustls::client::hs" | log.file: "/build/cargo-vendor-dir/rustls-0.20.8/src/client/hs.rs" | log.line: 127
Dez 05 18:09:39 oracle lldap[1459566]: 2023-12-05T17:09:39.938659200+00:00  WARN     │  ┝━ 🚧 [warn]: Error sending email: lettre::transport::smtp::Error {
Dez 05 18:09:39 oracle lldap[1459566]:     kind: Connection,
Dez 05 18:09:39 oracle lldap[1459566]:     source: lettre::transport::smtp::Error {
Dez 05 18:09:39 oracle lldap[1459566]:         kind: Connection,
Dez 05 18:09:39 oracle lldap[1459566]:         source: Custom {
Dez 05 18:09:39 oracle lldap[1459566]:             kind: InvalidData,
Dez 05 18:09:39 oracle lldap[1459566]:             error: CorruptMessage,
Dez 05 18:09:39 oracle lldap[1459566]:         },
Dez 05 18:09:39 oracle lldap[1459566]:     },
Dez 05 18:09:39 oracle lldap[1459566]: }
Dez 05 18:09:39 oracle lldap[1459566]: 2023-12-05T17:09:39.938660760+00:00  INFO     │  ┕━ ｉ [info]: Reset token: cYuBHilhGjnnm3MY4Audw8ZMhOJFXKHRXEOJnCoolc0rPGY3vyylNlQKq1HJ8ehHlhZXO8MK2976RqjYqphloEqu1RTDmDHNGMvf
Dez 05 18:09:39 oracle lldap[1459566]: 2023-12-05T17:09:39.938673240+00:00  DEBUG    ┕━ 🐛 [debug]:  | status_code: 500
The same happens when i try my gmail address. 🤷‍♂️
n
Corrupt message usually means that you have TLS instead of starttls or vice versa
SSL/starttls
m
Setting 
starttls
was the Solution, and the link succesfully worked. P.S. The Webui should only show/allow a password reset when 
enable_password_reset
is true. I was confused initally why i could "succesfully" send the email, and nothing appeared.
n
Nice!
It's supposed not to show the reset password link
That's the point of the password reset probe
m
🤔 Strange
n
But you're not the first person to report the issue
So I don't think it's due to your patch
m
Yeah, still happens when i revert my Patch 🤷‍♂️
2 Views
PreviousNext
Powered by