Skip to content

weft 0.1.0

Choose a tag to compare

View all tags
@isnogudus isnogudus released this 07 Jun 10:00
v0.1.0
a1fe27d

weft is a small, opinionated, single-binary web UI to administer users and
groups in an existing external LDAP server — primarily OpenBSD ldapd(8) — via
passthrough bind. No embedded directory, no service account.

Highlights

  • Single static binary: Go backend with an embedded Svelte 5 SPA + JSON API.
  • Passthrough-bind auth; admin = the ldapd rootdn (configurable bind DN, logged at startup).
  • Opinionated layout: ou=people (RDN uid), ou=groups (posixGroup only), shared default primary group.
  • Users with optional POSIX and Mail profiles; collision-safe uid/gid allocation; bcrypt {CRYPT} passwords.
  • Group management with effective-group view (primary via gidNumber + supplementary via memberUid).
  • uid rename via add → memberUid fix-up → delete (ldapd has no ModifyDN).
  • Idempotent setup wizard that provisions the base entry, OUs and default group on an empty directory.
  • Self-service (own profile/groups, own password) and a read-only user detail view.
  • Bilingual UI (German/English) with a runtime toggle.
  • Security: server-side sessions, HttpOnly/Secure/SameSite=Strict cookies, CSRF token, login rate limit, enforced TLS to LDAP (optional -insecure), request logging.
  • OpenBSD operational examples: ldapd.conf (schema + ACLs), rc.d, relayd.

Install (OpenBSD)

Download the attached static binary, or build it yourself with make build-openbsd.

doas install -o root -g bin -m 0555 weft.openbsd-amd64 /usr/local/bin/weft

See the README for ldapd.conf ACLs, the setup wizard, and running behind relayd.

Full notes: see CHANGELOG.md.

Assets 4
Loading