LabLDAP
Guide 03

Deploy

LabLDAP is a laboratory. Images stay local. The management listener is bound to loopback. There is no public registry and no Helm chart in v0.1.0.

Host

  • Linux amd64 (advertised). arm64 is not advertised.
  • Docker Engine 24+, Compose v2.24+
  • Loopback ports 8443, 3389, 3636

Topology

Three roles, plus a one-shot secret copier.

  • directory — pinned 389 DS, owns /data
  • bootstrap — labldap-bootstrap:dev, Directory Manager via a password file, then exits
  • control — labldap-control:dev, non-root, no DM, no Docker socket
  • secret-prep — copies secrets into a 0400 volume for uid 65532

One command

make compose-up              # ephemeral tmpfs /data
make compose-up-persistent   # named volume + TLS import
make compose-down
make compose-reset           # down -v, then up

Ephemeral is not a forensic wipe. Host swap can still hold pages. Persistent runtime entries survive restart. Soft reset restores the compiled baseline without deleting the volume.

Images

make image-bootstrap
make image

Local tags only: labldap-bootstrap:dev and labldap-control:dev. Compose files pin digests, never floating tags. make image checks that both images report the same version and smokes /health.

Secrets and TLS

Generated on first compose-up, mode 0600, gitignored. Rotate with go run ./tools/setupsecrets --dir secrets --force, then recreate the stack so control sees the new files.

Directory Manager lives in secrets/dm.pw and is mounted only into bootstrap. Never pass it on a command line.

The private CA key stays on the host. Ephemeral labs trust secrets/tls/instance-ca.crt. Persistent labs import the lab CA into 389 DS after first boot. Wrong CA or SAN fails closed. Keep :8443 on loopback.

Reset

  • Soft — UI Reset, POST /api/v1/reset, or ldap_reset_suffix. Needs scope, scenario name, revision.
  • Hard — make compose-reset only. Not on the API.

docker compose restart directory on a persistent lab can drop published ports. Prefer up -d --wait and wait for /health/ready.

Not in v0.1.0

  • No image push, Helm, or cloud module
  • No multi-suffix / multi-instance 389 DS
  • No Active Directory emulation
  • No project LICENSE file yet

Full version: docs/guides/deploy.md. Day-2: operator guide.