raulcnadal/applivery-authentication-sidecar-client repository overview

⁠Overview

In certain scenarios, customers heavily relying on LDAP may be reluctant to open a direct inbound connection from the internet to their LDAP server due to strict internal security policies.

To address this, Applivery provides a secure, egress-only model to bind to LDAP without requiring a direct inbound firewall rule. This approach consists of two core elements:

⁠1. Applivery Authentication Sidecar - FRP Relay

This container is deployed on the public internet and acts as the secure gateway, allowing the following connections:

• Inbound from Applivery via port 7636 TCP (LDAPS).
• Inbound from the customer's public IP address via port 7000 TCP (Tunnel communication).

⁠2. Applivery Authentication Sidecar - FRP Client

This stack is deployed securely inside the customer's internal network. It initiates a bidirectional Layer 4 TCP connection outbound to the Applivery Authentication Sidecar Relay on the internet to exchange information.

LDAP requests from Applivery travel through this pre-established secure tunnel and are forwarded to GLAuth, which exposes an ACME-provisioned certificate for external LDAP bindings. The authentication request is then delivered to the internal LDAP server. The response is received by GLAuth, routed all the way back up the tunnel to the internet-facing Relay, and finally delivered to Applivery. This completely eliminates the need for any direct inbound connections from the internet.

⁠Network Requirements

Each container within the internal stack requires the following bidirectional network connections to function properly:

FRP Client:

• Outbound to the Applivery Authentication Sidecar Relay IP (the public internet component) via port 7000 TCP.
• Outbound to the internal LDAP server via port 636 TCP.

GLAuth:

• Inbound and Outbound to/from the FRP Client (handled internally within the same Docker network).
• Outbound to the internal LDAP server via port 636 TCP.

⁠Part 2: Deploying the Local Internal Stack (Client)

This stack sits safely behind your corporate firewall. Thanks to the unified Applivery Authentication Sidecar Client image, the internal LDAP server (GLAuth) and the outbound secure tunnel (FRP Client) are managed entirely via environment variables in a single container.

⁠1. Directory Structure

Create a working directory on your internal server to hold your automated certificates:

mkdir -p applivery-sidecar/certs applivery-sidecar/certs-data
cd applivery-sidecar

⁠2. Generate Certificates with Certbot

Before starting the agent, it needs TLS certificates to serve secure LDAPS. We use a temporary Certbot container to fetch them. Run this command locally:

docker run -it --rm --name certbot \
  -v "$(pwd)/certs:/etc/letsencrypt" \
  -v "$(pwd)/certs-data:/var/lib/letsencrypt" \
  certbot/certbot certonly \
  --manual --preferred-challenges dns \
  -d ldap.yourcompany.com

(Follow the prompts to add the TXT record to your DNS provider to verify ownership).

⁠3. Create the Compound docker-compose.yml

Create the final stack. Notice that no configuration files are required—everything is handled natively by the Applivery Agent using your environment variables!

version: '3.8'

services:
  # 1. Automated Certificate Renewal
  certbot:
    image: certbot/certbot:latest
    container_name: applivery-certbot
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certs-data:/var/lib/letsencrypt
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

  # 2. Unified Applivery Sidecar Agent (GLAuth + FRPC)
  applivery-agent:
    image: raulcnadal/applivery-authentication-sidecar-client:latest
    container_name: applivery-sidecar-agent
    restart: unless-stopped
    depends_on:
      - certbot
    environment:
      # Tunnel Configuration
      - RELAY_IP=ldap.yourcompany.com
      - RELAY_PORT=7000
      - TUNNEL_TOKEN=CHANGE_THIS_TO_A_LONG_SECURE_PASSWORD
      - PUBLIC_LDAP_PORT=7636
      # LDAP Configuration
      - LDAP_BASE_DN=dc=applivery,dc=io
      - LDAP_USER=applivery_svc
      - LDAP_PASS_HASH=6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a # Hash for 'password'
    volumes:
      - ./certs:/certs:ro

⁠4. Start the Sidecar

Run the following command to bring the stack online:

docker-compose up -d

The applivery-agent container will automatically write its own configurations, boot the internal LDAP directory, and punch an encrypted tunnel to your Public VPS.

You can now configure Applivery LDAP to securely connect to ldaps://ldap.yourcompany.com:7636!