apiVersion: v1
kind: ConfigMap
metadata:
  name: ssp-config
  namespace: samba-directory
data:
  config.inc.local.php: |
    <?php

    $debug = true;
    $lang = "de";

    $keyphrase = getenv('KEYPHRASE');

    /* Samba AD DC */
    $ldap_url = "ldaps://dc.undercloud.local:636";
    $ldap_binddn = "CN=lam,OU=serviceaccounts,OU=users,OU=Undercloud,DC=undercloud,DC=local";
    $ldap_filter = "(&(objectClass=user)(sAMAccountName={login})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))";
    $ldap_bindpw = getenv('LDAP_BINDPW');
    $ldap_base = "DC=undercloud,DC=local";

    /* Users log in with their AD username */
    $ldap_login_attribute = "sAMAccountName";
    $ldap_fullname_attribute = "displayName";

    $use_ssl = true;
    $use_starttls = false;

    $default_action = "change";
    $use_change = true;
    $use_sendtoken = false;

    $show_menu = true;
    $show_help = true;

    /* Active Directory / Samba AD password changes */
    $who_change_password = "manager";
    $ad_mode = true;

    $messages["changehelpextramessage"] = "Bitte Benutzernamen und aktuelles Passwort eingeben.";
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: self-service-password
  namespace: samba-directory
  labels:
    app: self-service-password
spec:
  replicas: 1
  selector:
    matchLabels:
      app: self-service-password
  template:
    metadata:
      labels:
        app: self-service-password
    spec:
      dnsConfig:
        options:
          - name: ndots
            value: "1"
      enableServiceLinks: false
      containers:
        - name: self-service-password
          image: ltbproject/self-service-password:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          env:
            - name: LDAP_BINDPW
              valueFrom:
                secretKeyRef:
                  name: ssp-secrets
                  key: LDAP_BINDPW
            - name: KEYPHRASE
              valueFrom:
                secretKeyRef:
                  name: ssp-secrets
                  key: KEYPHRASE
            - name: LDAPTLS_REQCERT
              value: never
          volumeMounts:
            - name: ssp-config
              mountPath: /var/www/conf/config.inc.local.php
              subPath: config.inc.local.php
              readOnly: true
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 30
            periodSeconds: 20
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
      volumes:
        - name: ssp-config
          configMap:
            name: ssp-config
            items:
              - key: config.inc.local.php
                path: config.inc.local.php
---
apiVersion: v1
kind: Service
metadata:
  name: self-service-password
  namespace: samba-directory
spec:
  selector:
    app: self-service-password
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
  type: ClusterIP