The concern is that it would be nice if the UNIX users and LDAP is automatically in sync and managed from a version controlled source. I guess the answer is just build up a static LDAP database from my existing configs. It would be nice to have one authoritative system on the server but I guess as long as they are both built from one source of truth it shouldn't be an issue.
Yes, LDAP is a general tool. But many applications that I am interested in using it for user information. That is what I want to use it for. I'm not really interested in storing other data.
I think you are sort of missing the goal of the question. I have a bunch of self-hosted services like Jellyfin, qBittorrent, PhotoPrism, Metabase ... I want to avoid having to configure users in each one individually. I am considering LDAP because it is supported by many of these services. I'm not concerned about synchronizing UNIX users, I already have that solved. (If I need to move those to LDAP as well that can be considered, but isn't a goal).
I do use a reverse proxy but for various reasons you can't just block off some apps. For example if you want to play Jellyfin on a Chromecast or similar, or PhotoPrism if you want to use sharing links. Unfortunately these systems are designed around the built-in auth and you can't just slap a proxy in front.
I do use nginx with basic with in front of services where I can. I trust nginx much more than 10 different services with varying quality levels. But unfortunately not all services play well.
Even then how you you know? I don't think anyone can reliably look at a vegetable and tell you how nutritious it is. I don't think it is reasonable to have the general population being experts in evaluating vegetables.
I think what could work here is mandated labeling. This is required for most foods but generally not produce. I think there are some reasonable reasons for this, but for farms producing huge volumes it seems that occasional testing that gets reported at the store would make sense.
How are you configuring this? I checked for Jellyfin and their are third-party plugins which don't look too mature, but none of them seem to work with apps. qBittorrent doesn't support much (actually I may be able to put reverse-proxy auth in front... I'll look into that) and Metabase locks SSO behind a premium subscription.
IDK why but it does seem that LDAP is much more widely supported. Or am I missing some method to make it work
But it does boil down to business pressures. The business prefers more and bigger produce to more nutritional produce.
Is that a bad thing? Maybe not. Maybe you can just eat more to get your nutrition since higher yield should reduce cost.
But the point still stands that there is very little business pressure to make a nutritious product.
But the problem is that most self-hosted apps don't integrate well with these. For example qBittorrent, Jellyfin, Metabase and many other common self-hosted apps.
NixOS makes it very easy to declaratively configure servers. For example the users config to manage UNIX users: https://nixos.org/manual/nixos/stable/options#opt-users.users
Yet another service to maintain. If the server is crashing you can't log in, so you need backup UNIX users anyways.
I mean it is always better to have more open source. But the point of the multi-hop system is that you don't need to trust the server. Even if the server was open source:
- You wouldn't know that we are running an unmodified version.
- If you need to trust the server then someone could compel us to tap it or monitor it.
The open source client is enough to verify this and the security of the whole scheme.
I use NixOS.
Are you doing auth in the reverse proxy for Jellyfin? Do you use Chromecast or any non-web interface? If so I'm very interested how you got it to work.