added macos bloat to gitignore

.gitignore

@@ -0,0 +1 @@
+.DS_Store

README.md

@@ -1,3 +1,8 @@
 # kanidm-recipe
 
-KanIDM co-op cloud recipe
+KanIDM co-op cloud recipe
+
+This branch is meant to run on a basic debian install and it requires a running traefik container (supplied but commented out)
+
+ToDo
+[] figure out cert kit

compose.yml

@@ -0,0 +1,78 @@
+services:
+  kanidmd:
+    container_name: kanidmd
+    healthcheck:
+      interval: 30s
+      retries: 3
+      start_period: 30s
+      test:
+        - CMD
+        - /sbin/kanidmd
+        - healthcheck
+        - "-c"
+        - /data/server.toml
+      timeout: 10s
+    image: kanidm/server:latest
+    ports:
+      - "8443:8443" # replace with desired ports on server you deploy to (internal:external)
+    restart: unless-stopped
+    # user: "568:568" # replace with GUID of user running kanidm, this is a TrueNAS Scale example as the 'Apps' user
+    volumes:
+      - source: /var/lib/kanidm/data # Create empty directory for kanidm data here, ensure above user has rw access.
+        target: /data
+        type: bind
+      - source: server.toml
+        target: /data/server.toml
+        type: bind
+      - source: /var/lib/kanidm/config # Create empty directory for kanidm config here, ensure above user has rw access.
+        target: /config
+        type: bind
+    environment:
+      RUST_LOG: info
+      # variables for server.toml
+      #   ⚠️  WARNING ⚠️
+      #
+      #   Changing this value WILL break many types of registered
+      #   credentials for accounts including but not limited to
+      #   webauthn, oauth tokens, and more.
+      #   If you change this value you *must* run
+      #   `kanidmd domain rename` immediately after.
+      KANIDM_DOMAIN: idm.example.com # Is what user accounts will be labelled as eg user@idm.example.com, in theory you could use the root domain eg user@example.com
+      #   The origin for webauthn. This is the url to the server,
+      #   with the port included if it is non-standard (any port
+      #   except 443). This must match or be a descendent of the
+      #   domain name you configure above. If these two items are
+      #   not consistent, the server WILL refuse to start!
+      #   origin = "https://idm.example.com"
+      #   # OR
+      #   origin = "https://idm.example.com:8443"
+      KANIDM_ORIGIN: https://idm.example.com
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.kanidm.entrypoints=websecure
+      - traefik.http.routers.kanidm.rule=Host(${KANIDM_DOMAIN})
+      - traefik.http.routers.kanidm.service=kanidm
+      - traefik.http.services.kanidm.loadbalancer.server.port=8443
+      - traefik.http.services.kanidm.loadbalancer.server.scheme=https
+
+  traefik: # If you don't already have a running traefik container
+    image: traefik:v2.6
+    container_name: traefik
+    command:
+      - "--certificatesresolvers.http.acme.email=admin@example.com"
+      - "--certificatesresolvers.http.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.http.acme.tlschallenge=true"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.websecure.http.tls=true"
+      - "--entrypoints.websecure.http.tls.certResolver=http"
+      - "--log.level=INFO"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedByDefault=false"
+      - "--serverstransport.insecureskipverify=true"
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - "443:443"
+
+version: "3.5"

kanidm.yml

@@ -1,29 +0,0 @@
-services:
-  kanidmd:
-    container_name: kanidmd
-    environment:
-      - RUST_LOG=info
-    healthcheck:
-      interval: 30s
-      retries: 3
-      start_period: 30s
-      test:
-        - CMD
-        - /sbin/kanidmd
-        - healthcheck
-        - '-c'
-        - /data/server.toml
-      timeout: 10s
-    image: kanidm/server:latest
-    ports:
-      - '3443:8443' # replace with desired ports on server you deploy to (internal:external)
-    restart: unless-stopped
-    user: '568:568' # replace with GUID of user running kanidm, this is a TrueNAS Scale example as the 'Apps' user
-    volumes:
-      - source: /mnt/rei/configs/kanidm/data # Create empty directory for kanidm data here, ensure above user has rw access.
-        target: /data
-        type: bind
-      - source: /mnt/rei/configs/kanidm/config # Create empty directory for kanidm config here, ensure above user has rw access.
-        target: /config
-        type: bind
-version: '3.5'

server.toml

@@ -79,7 +79,7 @@ tls_key = "/config/key.pem"
 #   webauthn, oauth tokens, and more.
 #   If you change this value you *must* run
 #   `kanidmd domain rename` immediately after.
-domain = "your.yourdomainhere.com"
+domain = KANIDM_DOMAIN
 #
 #   The origin for webauthn. This is the url to the server,
 #   with the port included if it is non-standard (any port
@@ -89,7 +89,7 @@ domain = "your.yourdomainhere.com"
 #   origin = "https://idm.example.com"
 #   # OR
 #   origin = "https://idm.example.com:8443"
-origin = "https://idm.yourdomainhere.com"
+origin = KANIDM_ORIGIN
 
 #   HTTPS requests can be reverse proxied by a loadbalancer.
 #   To preserve the original IP of the caller, these systems
@@ -144,4 +144,4 @@ schedule = "00 22 * * *"
 #   (it's very similar to the standard cron syntax, it just allows to specify the seconds
 #   at the beginning and the year at the end)
 #   Number of backups to keep (default 7)
-# versions = 7
+# versions = 7