22 lines
972 B
Plaintext
22 lines
972 B
Plaintext
|
THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET.
|
||
|
|
|
||
|
|
The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e`
|
||
|
|
(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally
|
||
|
|
NOT committed here because:
|
||
|
|
* the real host age recipients are not available to the author of this change
|
||
|
|
(they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and
|
||
|
|
* fabricating an encrypted blob or fake host keys would be misleading.
|
||
|
|
|
||
|
|
Committing this file as `ldap-bind.age` would let modules/sssd.nix reference
|
||
|
|
`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at
|
||
|
|
runtime. Do ONE of the following before deploying:
|
||
|
|
|
||
|
|
1. Preferred: generate the real secret (secrets/README.md), commit it as
|
||
|
|
secrets/ldap-bind.age, and delete this .PLACEHOLDER file.
|
||
|
|
|
||
|
|
The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare
|
||
|
|
password):
|
||
|
|
|
||
|
|
[domain/default]
|
||
|
|
ldap_default_authtok = <the sssd-bind service-account password>
|