From c6f562c300baade7df885613d6fdb7ae8449cd02 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 15 May 2026 08:49:03 -0700 Subject: [PATCH] freeipa quadlet --- freeipa.container | 39 +++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-) diff --git a/freeipa.container b/freeipa.container index c29a796..d081d0a 100644 --- a/freeipa.container +++ b/freeipa.container @@ -1,24 +1,39 @@ [Unit] -Description=FreeIPA Server +Description=FreeIPA Server with Integrated DNS After=network-online.target [Container] -Image=gitea.iot.cudanet.org/administrator/quadlets/freeipa-server:almalinux-9-4.12.2 -ContainerName=freeipa-server -Network=podman-bridge0:ip=10.0.0.141 +Image=gitea.iot.cudanet.org/administrator/quadlets/freeipa-server:fedora-rawhide-4.13.1 +ContainerName=freeipa +HostName=ipa.iot.cudanet.org -# Remove all IPA_DM_PASSWORD, IPA_ADMIN_PASSWORD, and Exec lines. -# We want the container to see the volume and say "Ah, I'm already done." -PodmanArgs=--systemd=always --hostname=ipa.iot.cudanet.org --cgroupns=host --security-opt label=disable --add-host ipa.iot.cudanet.org:10.0.0.141 +# Network Configuration +Network=podman-bridge0 +IP=10.0.0.141 +PublishPort=53/udp +PublishPort=53/tcp +PublishPort=80/tcp +PublishPort=443/tcp +PublishPort=389/tcp +PublishPort=636/tcp +PublishPort=88/tcp +PublishPort=88/udp +PublishPort=464/tcp +PublishPort=464/udp +PublishPort=123/udp +# Security and Resources +ReadOnly=true +Sysctl=net.ipv4.ip_unprivileged_port_start=53 +Memory=4096m Volume=/var/podman/freeipa/data:/data:Z -AddCapability=CAP_SYS_ADMIN -AddCapability=CAP_NET_ADMIN + +# Arguments +# Added --setup-dns and --forwarder (using common public DNS as examples) +Exec=-U -n iot.cudanet.org -r IOT.CUDANET.ORG --hostname=ipa.iot.cudanet.org --setup-dns --forwarder=8.8.8.8 --forwarder=1.1.1.1 --no-host-dns --no-ntp -p e9532a79-417c-4689-b89e-fa9b61b40d4a -a e9532a79-417c-4689-b89e-fa9b61b40d4a --ip-address=10.0.0.141 [Service] -Notify=false Restart=always -RestartSec=30 [Install] -WantedBy=multi-user.target +WantedBy=multi-user.target default.target