From b6d09af9259fd2a0de0dd1376b8ed602cfb86252 Mon Sep 17 00:00:00 2001 From: "info@pi-farm.de" <6+pi-farm@noreply.git.pi-farm.de> Date: Sat, 10 Oct 2026 13:35:35 +0000 Subject: [PATCH] change to lxqt --- entrypoint.sh | 154 ++++++++++++++++++++++++-------------------------- 1 file changed, 75 insertions(+), 79 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 4404e9c..d175e47 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,89 +1,85 @@ -ARG BUILD_BASE_IMAGE +#!/bin/bash +set -e -FROM ${BUILD_BASE_IMAGE} +LDAP_URI=${LDAP_URI:-"ldap://localhost:389"} +LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"} +LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"} +LDAP_BIND_PASSWORD=${LDAP_BIND_PASSWORD} +LDAP_SUDO_GROUP=${LDAP_SUDO_GROUP:-"sudo_users"} +SSSD_DEBUG=${SSSD_DEBUG_LEVEL:-0} -ARG BUILD_MAINTAINER -ARG BUILD_TZ -ARG BUILD_APP_NAME -ARG BUILD_LANG -ARG BUILD_LANGUAGE -ARG BUILD_LC_ALL -ARG BUILD_COUNTRY +echo ">>> Erstelle SSSD Konfiguration..." +cat < /etc/sssd/sssd.conf +[sssd] +config_file_version = 2 +services = nss, pam, sudo +domains = LDAP -LABEL maintainer="${BUILD_MAINTAINER}" -LABEL org.opencontainers.image.title="${BUILD_APP_NAME}" +[domain/LDAP] +id_provider = ldap +auth_provider = ldap +sudo_provider = ldap +chpass_provider = ldap -ENV TZ=${BUILD_TZ} -ENV LANG=${BUILD_LANG} -ENV LANGUAGE=${BUILD_LANGUAGE} -ENV LC_ALL=${BUILD_LC_ALL} -ENV COUNTRY=${BUILD_COUNTRY} -ENV DEBIAN_FRONTEND=noninteractive +ldap_uri = ${LDAP_URI} +ldap_search_base = ${LDAP_BASE_DN} +ldap_sudo_search_base = ou=SUDOers,${LDAP_BASE_DN} -COPY packages.txt /tmp/packages.txt +ldap_default_bind_dn = ${LDAP_BIND_DN} +ldap_default_authtok = ${LDAP_BIND_PASSWORD} -RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \ - apt-get update && apt-get install -y --no-install-recommends \ - $(cat /tmp/packages.txt) \ - firefox-esr-l10n-${BUILD_COUNTRY} \ - thunderbird-l10n-${BUILD_COUNTRY} && \ - apt-get build-dep -y pulseaudio && \ - cd /tmp && \ - apt-get source pulseaudio && \ - PULSE_DIR=$(find /tmp -maxdepth 1 -type d -name "pulseaudio-*" | head -n 1) && \ - cd $PULSE_DIR && \ - meson setup build \ - -Dman=false \ - -Dtests=false \ - -Ddoxygen=false && \ - cd /tmp && \ - git clone https://github.com/neutrinolabs/pulseaudio-module-xrdp.git && \ - cd pulseaudio-module-xrdp && \ - ./bootstrap && \ - ./configure PULSE_DIR=$PULSE_DIR && \ - make && \ - make install && \ - cd / && \ - rm -rf /tmp/pulseaudio-* /tmp/pulseaudio-module-xrdp && \ - apt-get remove -y build-essential dpkg-dev meson ninja-build autoconf libtool && \ - apt-get autoremove -y && \ - rm -rf /var/lib/apt/lists/* && \ - echo "${LANG} UTF-8" > /etc/locale.gen && \ - locale-gen ${LANG} && \ - update-locale LANG=${LANG} LANGUAGE=${LANGUAGE} && \ - ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \ - dpkg-reconfigure -f noninteractive tzdata && \ - printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \ - dpkg-reconfigure -f noninteractive keyboard-configuration && \ - rm -rf /var/lib/apt/lists/* /tmp/packages.txt +ldap_schema = rfc2307bis +ldap_group_member = uniqueMember +ldap_auth_disable_tls_never_use_in_production = true +ldap_id_use_start_tls = false +ldap_tls_reqcert = never -RUN sed -i '/%users/s/^/# /' /etc/sudoers && \ - echo "sudoers: files sss" >> /etc/nsswitch.conf && \ - echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077" >> /etc/pam.d/common-session +cache_credentials = true +enumerate = false +EOF -RUN chmod 440 /etc/sudoers && \ - mkdir -p /etc/sssd && chown root:root /etc/sssd && chmod 755 /etc/sssd && \ - mkdir -p /home && chmod 755 /home && \ - chown xrdp:xrdp /etc/xrdp/key.pem /etc/xrdp/cert.pem /etc/xrdp/rsakeys.ini && \ - chmod 600 /etc/xrdp/key.pem /etc/xrdp/rsakeys.ini && \ - chmod 644 /etc/xrdp/cert.pem && \ - echo "LANG=${LANG}" >> /etc/environment && \ - echo "LANGUAGE=${LANGUAGE}" >> /etc/environment && \ - echo "LC_ALL=${LC_ALL}" >> /etc/environment && \ - echo "#!/bin/sh" > /etc/xrdp/startwm.sh && \ - echo "export LANG=${LANG}" >> /etc/xrdp/startwm.sh && \ - echo "export LANGUAGE=${LANGUAGE}" >> /etc/xrdp/startwm.sh && \ - echo "export LC_ALL=${LC_ALL}" >> /etc/xrdp/startwm.sh && \ - echo "export XDG_SESSION_TYPE=x11" >> /etc/xrdp/startwm.sh && \ - echo "setxkbmap ${COUNTRY}" >> /etc/xrdp/startwm.sh && \ - echo "pulseaudio --start" >> /etc/xrdp/startwm.sh && \ - echo "pactl load-module module-xrdp-sink.so" >> /etc/xrdp/startwm.sh && \ - echo "pactl load-module module-xrdp-source.so" >> /etc/xrdp/startwm.sh && \ - echo "exec dbus-launch --exit-with-session startlxqt" >> /etc/xrdp/startwm.sh && \ - chmod +x /etc/xrdp/startwm.sh +chmod 600 /etc/sssd/sssd.conf +chown root:root /etc/sssd/sssd.conf -EXPOSE 3389 +echo ">>> Erstelle Sudoers-Regel für Gruppe: ${LDAP_SUDO_GROUP}..." +echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins +chmod 0440 /etc/sudoers.d/ldap-admins -COPY entrypoint.sh /entrypoint.sh -RUN chmod +x /entrypoint.sh -CMD ["/entrypoint.sh"] \ No newline at end of file +echo ">>> Erzwinge TLS für xrdp (Guacamole Fix)..." +if [ -f /etc/xrdp/xrdp.ini ]; then + sed -i 's/^security_layer=.*/security_layer=tls/' /etc/xrdp/xrdp.ini +fi + +echo ">>> Bereinige alte PID-Dateien und SSSD Cache..." +rm -f /var/run/dbus/pid /run/dbus/dbus.pid /var/run/xrdp/*.pid /var/run/xrdp/xrdp-sesman.pid +rm -f /var/lib/sss/db/* +rm -f /var/lib/sss/mc/* + +echo ">>> Starte D-Bus..." +mkdir -p /var/run/dbus /run/dbus +dbus-uuidgen --ensure +dbus-daemon --system --fork + +echo ">>> Starte SSSD..." +sssd -D --debug-level=${SSSD_DEBUG} + +echo ">>> Starte XRDP..." +xrdp-sesman +xrdp + +echo ">>> Leite Logs an Docker weiter..." +mkdir -p /var/log/sssd /var/log/xrdp + +touch /var/log/xrdp.log \ + /var/log/xrdp-sesman.log \ + /var/log/sssd/sssd.log \ + /var/log/sssd/sssd_LDAP.log \ + /var/log/sssd/sssd_nss.log \ + /var/log/sssd/sssd_pam.log + +exec tail -F /var/log/xrdp.log \ + /var/log/xrdp-sesman.log \ + /var/log/sssd/sssd.log \ + /var/log/sssd/sssd_LDAP.log \ + /var/log/sssd/sssd_nss.log \ + /var/log/sssd/sssd_pam.log \ No newline at end of file