dataset/seed/lemonldap/README.md

---
gitea: none
include_toc: true
---


[Return to the list of application services.](../README.md)
# lemonldap

## Synopsis


[LemonLDAP, a Web Single Sign On and Access Management.](https://lemonldap-ng.org/)

## Basic variables

### General

#### Reverse proxy

##### Clients configuration

This family is a leadership.

| Parameter                                                                                                                                                                                                                                                                       | Comments                                                           |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
| **[general.revprox.revprox_client.revprox_client_external_domainnames](dictionaries/21_revprox_client.xml)**<br/>mandatory, multiple<br/>**Type:** [`domainname`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable) | Service external domain name.<br/>**Example:** service.example.net |
| **[general.revprox.revprox_client.revprox_client_location](dictionaries/21_revprox_client.xml)**<br/>mandatory<br/>**Type:** [`filename`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable)                         | URI to route request to the correct service.<br/>**Default:** /    |

#### LemonLDAP

Configuration de la solution d'authentification unique LemonLDAP::NG.

| Parameter                                                                                                                                                                                                                     | Comments                                                         |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------|
| **[general.lemonldap.lemon_mail_admin](dictionaries/70_lemonldap_ng.xml)**<br/>mandatory<br/>**Type:** [`mail`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable) | Courriel de l'administrateur.<br/>**Example:** admin@example.net |


## Variables for expert

### General

#### OpenLDAP directory

##### Client

| Parameter                                                                                                                                                                                                                             | Comments                                                                                           |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
| **[general.ldap.client.ldapclient_family](dictionaries/70_lemonldap_ng.xml)**<br/>mandatory<br/>**Type:** [`unix_user`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable) | Restrict service configuration for a LDAP family.<br/>"all" for all families.<br/>**Default:** all |

#### NGINX

| Parameter                                                                                                                                                                                                                  | Comments                                                                                                       |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------|
| **[general.nginx.nginx_hash_bucket_size](dictionaries/21_nginx.xml)**<br/>mandatory<br/>**Type:** [`choice`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable) | The bucket size for the server names hash tables.<br/>**Choices:**<br/>- `128` ← default<br/>- `64`<br/>- `32` |
| **[general.nginx.nginx_post_max_size](dictionaries/21_nginx.xml)**<br/>mandatory<br/>**Type:** [`number`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable)    | The maximum allowed size of the client request body.<br/>This value is in Mb.<br/>**Default:** 32              |

#### Reverse proxy

##### Clients configuration

This family is a leadership.

| Parameter                                                                                                                                                                                                                                    | Comments                                             |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------|
| **[general.revprox.revprox_client.revprox_client_max_body_size](dictionaries/21_revprox_client.xml)**<br/>**Type:** [`string`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable) | The maximum allowed size of the client request body. |

#### LemonLDAP

Configuration de la solution d'authentification unique LemonLDAP::NG.

| Parameter                                                                                                                                                                                                                 | Comments                                                                                        |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|
| **[general.lemonldap.lemon_proc](dictionaries/70_lemonldap_ng.xml)**<br/>mandatory<br/>**Type:** [`number`](https://forge.cloud.silique.fr/risotto/rougail/src/branch/main/doc/variable/README.md#le-type-de-la-variable) | Nombre de processus dédié à LemonLdap (équivalent au nombre de processeurs).<br/>**Default:** 1 |

## Requirements services

### Mandatories

- LocalDNS: [nsd-local](../nsd-local/README.md)
- SMTP: [postfix-relay](../postfix-relay/README.md)
- LDAP: [openldap](../openldap/README.md)
- ReverseProxy: [nginx-reverse-proxy](../nginx-reverse-proxy/README.md)

### Optionals

- Journald: [vector](../vector/README.md)

**bold**: provider is mandatory

## Example

Zone names are provided as examples. Think about adapting with the value of provider_zone in configuration file.

```
lemonldap:
  applicationservice: lemonldap
  provider_zone: oauth2
  zones_name:
    - ldap
    - localdns
    - reverseproxy
    - smtp
  values:
    general.revprox.revprox_client.revprox_client_external_domainnames:
      - service.example.net
    general.lemonldap.lemon_mail_admin: admin@example.net
```

## Dependances

- [ldap-client](../ldap-client/README.md)
- [relay-mail-client](../relay-mail-client/README.md)
- [nginx-https](../nginx-https/README.md)
  - [nginx-common](../nginx-common/README.md)
  - [reverse-proxy-client](../reverse-proxy-client/README.md)
- [base-debian-bullseye](../base-debian-bullseye/README.md)
  - [base-debian](../base-debian/README.md)
    - [systemd](../systemd/README.md)
      - [base-machine](../base-machine/README.md)
        - [base](../base/README.md)
        - [dns-local](../dns-local/README.md)
        - [pki-tls](../pki-tls/README.md)
      - [journald](../journald/README.md)
      - [resolved](../resolved/README.md)

## Useful for services

- [dovecot](../dovecot/README.md): Postfix and Dovecot as mail servers (IMAP and submission).
- [forgejo](../forgejo/README.md): Forgejo, a community managed lightweight code hosting solution.
- [gitea](../gitea/README.md): Transitional package for Gitea to Forgejo.
- [grafana](../grafana/README.md): Grafana is an analytics and interactive visualization web application.
- [mailman](../mailman/README.md): GNU Mailman, managing electronic mail discussion and e-newsletter lists.
- [nextcloud](../nextcloud/README.md): Nextcloud, Online collaboration platform.
- [odoo](../odoo/README.md): Odoo, an ERP and CRM.
- [peertube](../peertube/README.md): Peertube, a federated (ActivityPub) video streaming platform.
- [piwigo](../piwigo/README.md): Piwigo, a photo management software.
- [roundcube](../roundcube/README.md): Roundcube, a webmail.