setup.sh

#!/bin/bash
# FreeIPA Docker setup script
# Generates .env and docker-compose.yml for your environment

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

###############################################################################
# Helpers
###############################################################################

die() { echo "ERROR: $*" >&2; exit 1; }

prompt() {
    local var="$1" prompt="$2" default="$3"
    if [ -n "$default" ]; then
        read -rp "$prompt [$default]: " value
        echo "${value:-$default}"
    else
        read -rp "$prompt: " value
        [ -n "$value" ] || die "$var cannot be empty"
        echo "$value"
    fi
}

prompt_password() {
    local pw pw2
    while true; do
        read -rsp "Admin/Directory Manager password (min 8 chars): " pw; echo
        read -rsp "Confirm password: " pw2; echo
        [ "$pw" = "$pw2" ] || { echo "Passwords do not match."; continue; }
        [ "${#pw}" -ge 8 ] || { echo "Password too short."; continue; }
        echo "$pw"
        return
    done
}

###############################################################################
# Collect configuration
###############################################################################

echo
echo "=== FreeIPA Docker Setup ==="
echo

HOSTNAME=$(prompt HOSTNAME "IPA server hostname (FQDN)" "ipa.example.test")
DOMAIN=$(echo "$HOSTNAME" | cut -d. -f2-)
REALM=$(echo "$DOMAIN" | tr '[:lower:]' '[:upper:]')
IP=$(prompt IP "Container IP address (must be in subnet 172.20.0.0/24)" "172.20.0.2")
SUBNET=$(prompt SUBNET "Docker network subnet" "172.20.0.0/24")
IMAGE=$(prompt IMAGE "Docker image" "quay.io/freeipa/freeipa-server:almalinux-9")
PASSWORD=$(prompt_password)

echo
echo "Summary:"
echo "  Hostname : $HOSTNAME"
echo "  Domain   : $DOMAIN"
echo "  Realm    : $REALM"
echo "  IP       : $IP"
echo "  Subnet   : $SUBNET"
echo "  Image    : $IMAGE"
echo

read -rp "Generate configuration? [Y/n]: " confirm
[[ "${confirm:-Y}" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }

###############################################################################
# Write .env
###############################################################################

cat > "$SCRIPT_DIR/.env" <<EOF
PASSWORD=${PASSWORD}
EOF
chmod 600 "$SCRIPT_DIR/.env"

###############################################################################
# Write docker-compose.yml
###############################################################################

cat > "$SCRIPT_DIR/docker-compose.yml" <<EOF
services:
  freeipa:
    image: ${IMAGE}
    container_name: freeipa-server
    hostname: ${HOSTNAME}
    environment:
      - IPA_SERVER_HOSTNAME=${HOSTNAME}
      - PASSWORD=\${PASSWORD}
      - IPA_SERVER_INSTALL_OPTS=--unattended --realm=${REALM} --domain=${DOMAIN} --admin-password=\${PASSWORD} --ds-password=\${PASSWORD} --ip-address=${IP} --no-ntp --skip-mem-check
    networks:
      ipa_net:
        ipv4_address: ${IP}
    volumes:
      - ./data:/data:Z
      - ./scripts/fix-permissions.sh:/usr/local/bin/fix-permissions.sh:ro
      - ./scripts/ipa-server-configure-first.wrapper:/usr/sbin/ipa-server-configure-first:ro
      - ./scripts/ipa-server-configure-first.orig:/usr/sbin/ipa-server-configure-first.orig:ro
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    cgroup: host
    tmpfs:
      - /run
      - /tmp
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
    ports:
      - "80:80"
      - "443:443"
      - "389:389"
      - "636:636"
      - "88:88"
      - "464:464"
      - "88:88/udp"
      - "464:464/udp"
    restart: unless-stopped

networks:
  ipa_net:
    ipam:
      config:
        - subnet: ${SUBNET}
EOF

###############################################################################
# Create data directory
###############################################################################

mkdir -p "$SCRIPT_DIR/data"

echo
echo "Done. Files written:"
echo "  $SCRIPT_DIR/.env             (chmod 600)"
echo "  $SCRIPT_DIR/docker-compose.yml"
echo
echo "Next steps:"
echo "  make start    — first run installs IPA (~5 min)"
echo "  make logs     — follow installation progress"
echo "  make status   — check service health"