Add guacamole.yaml — Pattern B migration, all secrets/OIDC via host .env vars

guacamole.yaml

@@ -0,0 +1,88 @@
+services:
+  some-guacamole:
+    image: "guacamole/guacamole:latest"
+    environment:
+      - "GUACAMOLE_HOME=/opt/guacamole"
+      # Guacd connection
+      - "GUACD_HOSTNAME=some-guacd"
+      - "GUACD_PORT=4822"
+      # LDAP
+      - "LDAP_CONFIG_BASE_DN=OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net"
+      - "LDAP_HOSTNAME=${LDAP_HOST}"
+      - "LDAP_USERNAME_ATTRIBUTE=userPrincipalName"
+      - "LDAP_USER_BASE_DN=OU=AAD Sync,OU=House Members,OU=Topside Pinnacle,DC=bryanmail,DC=net"
+      - "LDAP_ENCRYPTION_METHOD=ssl"
+      - "LDAP_PORT=636"
+      - "LDAP_CONNECTION_TIMEOUT=60000"
+      - "LDAP_SEARCH_BIND_DN=${GUACAMOLE_LDAP_SEARCH_BIND_DN}"
+      - "LDAP_SEARCH_BIND_PASSWORD=${GUACAMOLE_LDAP_BIND_PASSWORD}"
+      # OpenID Connect
+      - "OPENID_ENABLED=true"
+      - "OPENID_AUTHORIZATION_ENDPOINT=${GUACAMOLE_OIDC_AUTHORIZATION_ENDPOINT}"
+      - "OPENID_JWKS_ENDPOINT=${GUACAMOLE_OIDC_JWKS_ENDPOINT}"
+      - "OPENID_ISSUER=${GUACAMOLE_OIDC_ISSUER}"
+      - "OPENID_CLIENT_ID=${GUACAMOLE_OIDC_CLIENT_ID}"
+      - "OPENID_CLIENT_SECRET=${GUACAMOLE_OIDC_CLIENT_SECRET}"
+      - "OPENID_REDIRECT_URI=${GUACAMOLE_OIDC_REDIRECT_URI}"
+      - "OPENID_USERNAME_CLAIM_TYPE=email"
+      # PostgreSQL
+      - "POSTGRESQL_ENABLED=true"
+      - "POSTGRESQL_HOSTNAME=db.postgresql_db-backend"
+      - "POSTGRESQL_PORT=5432"
+      - "POSTGRESQL_SSL_MODE=allow"
+      - "POSTGRESQL_DATABASE=guacamole_db"
+      - "POSTGRESQL_USER=guacamole"
+      - "POSTGRESQL_PASSWORD=${GUACAMOLE_DB_PASSWORD}"
+      - "REMOTE_IP_VALVE_ENABLED=true"
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    volumes:
+      - /volume1/docker/guacamole/extensions:/opt/guacamole/extensions
+      - /volume1/docker/guacamole/usr/local/openjdk-8/jre/lib/security:/usr/local/openjdk-8/jre/lib/security
+      - /volume1/docker/guacamole/opt/guacamole/bin:/opt/guacamole/bin/initdb.sql
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.guacamole.rule=Host(`remote.${DOMAIN}`)
+        - traefik.http.routers.guacamole.tls=true
+        - traefik.http.routers.guacamole.tls.certresolver=letsencrypt
+        - traefik.http.routers.guacamole.entrypoints=websecure
+        - traefik.http.services.guacamole.loadbalancer.server.port=8080
+        - traefik.http.routers.guacamole.middlewares=crowdsec@file, guacamole-add-path
+        - traefik.http.services.guacamole.loadbalancer.responseForwarding.flushInterval=-1
+        - traefik.http.services.guacamole.loadbalancer.passhostheader=true
+        - traefik.http.middlewares.guacamole-add-path.redirectregex.regex=^https://remote.${DOMAIN}/?$$
+        - traefik.http.middlewares.guacamole-add-path.redirectregex.replacement=https://remote.${DOMAIN}/guacamole
+        - traefik.http.middlewares.guacamole-add-path.redirectregex.permanent=true
+        - traefik.http.services.guacamole.loadbalancer.sticky.cookie=true
+        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.name=GUAC_AFFINITY
+        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.httponly=true
+        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.secure=true
+        - traefik.http.services.guacamole.loadbalancer.sticky.cookie.samesite=strict
+        - traefik.swarm.network=traefik_backend
+      resources:
+        limits:
+          cpus: '2'
+          memory: 2G
+
+  some-guacd:
+    image: "guacamole/guacd:latest"
+    hostname: "some-guacd"
+    networks:
+      - traefik_backend
+    healthcheck:
+      disable: true
+    deploy:
+      labels:
+        - traefik.enable=false
+      resources:
+        limits:
+          cpus: '2'
+          memory: 512M
+
+networks:
+  traefik_backend:
+    external: true
+  postgresql_db-backend:
+    external: true