mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
Paul GottschlingandAlex Fornuto
da0e53ecdb
* Reorganize the config reference Closes #11253 This change breaks up the config reference by moving each Teleport service's configuration settings into a separate YAML snippet, and organizing each YAML snippet into a `TabItem` within a `Tabs` with `dropdownView` enabled. When Teleport Enterprise Cloud doesn't support a service, this change adds a `Notice` with a message about Teleport Enterprise Cloud in the relevant `TabItem`. I thought this approach would be cleaner than alternatives: - **Including an H2 for each service:** With this approach, the configuration reference would be even longer than it is now. With the approach I'm proposing, readers would navigate to "Reference configurations", then choose a service from a dropdown menu: much less scrolling for slightly more clicking. - **Including another set of `TabItem`s for Teleport editions:** I thought about adding a `Tabs` with a dropdown option for each Teleport edition and a horizontal `TabItem` for each service, but this would require horizontal scrolling and doesn't scale very well. - **Including horizontal tabs for each Teleport edition**, with an inner dropdown menu for each Teleport service: There is currently no way to do this without multiple `Tabs` components, which gets messy quickly. **Note** that this change does not attempt to copy-edit comments/example values within the configuration snippets. The scope of this change is limited only to reorganization. * Respond to PR feedback * Update docs/pages/includes/config-reference/instance-wide.yaml Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com> * Respond to PR feedback Use headings instead of `TabItem`s to split up sections of the config reference. --------- Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
107 lines
4.9 KiB
YAML
107 lines
4.9 KiB
YAML
windows_desktop_service:
|
|
enabled: yes
|
|
# This is the address that windows_desktop_service will listen on.
|
|
listen_addr: "localhost:3028"
|
|
# (optional) This is the address that windows_desktop_service will advertise
|
|
# to the rest of Teleport for incoming connections. Only proxy_service should
|
|
# connect to windows_desktop_service, users connect to the proxy's web UI
|
|
# instead.
|
|
public_addr: "desktop-access.example.com:3028"
|
|
# (optional) Determines whether desktop sessions will show a user-selected wallpaper
|
|
# vs a system-default, single-color wallpaper. For improved visual performance,
|
|
# set this to false (its default value).
|
|
show_desktop_wallpaper: false
|
|
# (optional) ldap contains configuration keys used when connecting Teleport
|
|
# to an Active Directory domain. This enables the discovery service for
|
|
# Windows desktops belonging to an Active Directory domain configured for
|
|
# Teleport access.
|
|
ldap:
|
|
# Address of the LDAP server for secure LDAP connections.
|
|
# Usually, this address will use port 636, like: ldap.example.com:636.
|
|
# For best results, this address should point to a highly-available
|
|
# endpoint (a load balancer, VIP, or round-robin DNS) rather than
|
|
# a single domain controller.
|
|
addr: '$LDAP_SERVER_ADDRESS'
|
|
# Active Directory domain name you are connecting to.
|
|
domain: '$LDAP_DOMAIN_NAME'
|
|
# LDAP username for authentication. This username must include the domain
|
|
# NetBIOS name. The use of single quotes here is intentional in order to
|
|
# avoid the need to escape the backslash (\) character.
|
|
#
|
|
# For example, if your domain is "example.com", the NetBIOS name for it is
|
|
# likely "EXAMPLE". When connecting as the "svc-teleport" user, you should
|
|
# use the format: "EXAMPLE\svc-teleport".
|
|
username: '$LDAP_USERNAME'
|
|
# The security identifier of the service account specified by the username
|
|
# field above. This looks like a string starting with "S-".
|
|
#
|
|
# Any AD user with permission to read user objects can obtain this value
|
|
# by opening a PowerShell and running
|
|
# ```
|
|
# Get-AdUser -Identity $LDAP_USERNAME | Select SID
|
|
# ```
|
|
#
|
|
# The value can be obtained over LDAP by constructing a query with the
|
|
# filter = (&(objectCategory=person)(objectClass=user)(sAMAccountName=$LDAP_USERNAME))
|
|
# and requesting the attribute = objectSid
|
|
sid: '$LDAP_USER_SID'
|
|
# You can skip LDAPS certificate verification by setting
|
|
# this to true. It is recommended that this be set to false
|
|
# and the certificate added your system's trusted repository,
|
|
# or provided as a PEM encoded certificate using ldap_ca_cert variable.
|
|
# You can provide a filepath with der_ca_file, but this behavior is deprecated.
|
|
insecure_skip_verify: false
|
|
# PEM encoded LDAP CA certificate.
|
|
ldap_ca_cert: |
|
|
-----BEGIN CERTIFICATE-----
|
|
*certificate data*
|
|
-----END CERTIFICATE-----
|
|
# DER encoded LDAP CA certificate.
|
|
# deprecated: prefer ldap_ca_cert instead
|
|
der_ca_file: /path/to/cert
|
|
|
|
# (optional) hosts is a list of hostnames to register as WindowsDesktop
|
|
# objects in Teleport. These hosts must be part of the Active Directory
|
|
# domain configured to grant Teleport access.
|
|
hosts:
|
|
- win1.example.com
|
|
- win2.example.com
|
|
- ...
|
|
# (optional) non_ad_hosts is a list of hostnames that are not part of an
|
|
# Active Diretory domain to register as WindowsDesktop objects in Teleport.
|
|
# These hosts require the Teleport CA certificate and service, as described in
|
|
# https://goteleport.com/docs/desktop-access/getting-started/
|
|
non_ad_hosts:
|
|
- win3.example.com
|
|
- win4.example.com
|
|
# (optional) settings for enabling automatic desktop discovery via LDAP
|
|
discovery:
|
|
# The wildcard '*' character tells Teleport to discover all the hosts in
|
|
# the Active Directory Domain. To refine the search, specify a custom DN.
|
|
# To disable automatic discovery, leave this field blank.
|
|
base_dn: '*'
|
|
# (optional) LDAP filters for further customizing the LDAP search.
|
|
# See https://ldap.com/ldap-filters for details on LDAP filter syntax.
|
|
filters:
|
|
- '(location=Oakland)'
|
|
- '(!(primaryGroupID=516))' # exclude domain controllers
|
|
# (optional) LDAP attributes to convert into Teleport labels.
|
|
# The key of the label will be "ldap/" + the value of the attribute.
|
|
label_attributes:
|
|
- location
|
|
# Rules for applying labels to Windows hosts based on regular expressions
|
|
# matched against the host name. If multiple rules match, the desktop will
|
|
# get the union of all matching labels.
|
|
host_labels:
|
|
- match: '^.*\.dev\.example\.com$'
|
|
labels:
|
|
environment: dev
|
|
- match: '^.*\.prod\.example\.com$'
|
|
labels:
|
|
environment: prod
|
|
|
|
# Labels to attach to the Windows Desktop Service. This is used internally, so
|
|
# any custom labels added won't affect the Windows hosts.
|
|
labels:
|
|
teleport.internal/resource-id: "resource-id"
|