version: '3.7'

services:
  ldap:
    # openldap 服务器
    image: osixia/openldap:latest
    restart: always
    volumes:
      - ldap_config:/etc/ldap/slapd.d
      - ldap_data:/var/lib/ldap
      # - ldap_certs:/container/service/slapd/assets/certs
    ports:
      # port 636 for TLS
      - "389:389"
      # - "636:636"
    environment:
      - TZ=Asia/Shanghai
      - LDAP_DOMAIN=example.org
      - LDAP_ORGANISATION=Example Inc.
      - LDAP_ADMIN_PASSWORD=admin
      - LDAP_CONFIG_PASSWORD=config
      - LDAP_READONLY_USER=true
      - LDAP_READONLY_USER_USERNAME=readonly
      - LDAP_READONLY_USER_PASSWORD=readonly
      - LDAP_TLS=false
      # - LDAP_TLS_CRT_FILENAME=ldap.crt
      # - LDAP_TLS_KEY_FILENAME=ldap.key
      # - LDAP_TLS_DH_PARAM_FILENAME=dhparam.pem
      # - LDAP_TLS_CA_CRT_FILENAME=ca.crt

#  lam:
#    # 账号管理（管理员使用）
#    image: ldapaccountmanager/lam:latest
#    # restart: always
#    ports:
#      - "8100:80"
#    environment:
#      - TZ=Asia/Shanghai

  ldapadmin:
    # 另一个账号管理的工具
    image: osixia/phpldapadmin:latest
    # restart: always
    ports:
      - "8443:443"
    environment:
      - TZ=Asia/Shanghai
      - PHPLDAPADMIN_LDAP_HOSTS=ldap
    volumes:
      - ldapadmin_data:/var/www/phpldapadmin

  ssp:
    # 自助密码服务（普通用户使用）
    image: tiredofit/self-service-password:latest
    restart: always
    ports:
      - "8200:80"
    environment:
      - TZ=Asia/Shanghai
      - LDAP_SERVER=ldap://ldap
      - LDAP_STARTTLS=false
      - LDAP_BINDDN=cn=admin,dc=example,dc=org
      - LDAP_BINDPASS=admin
      - LDAP_BASE_SEARCH=dc=example,dc=org
      - LDAP_LOGIN_ATTRIBUTE=uid
      - LDAP_FULLNAME_ATTRIBUTE=cn

volumes:
  ldap_config:
  ldap_data:
  #ldap_certs:
  ldapadmin_data: