Linux Directory — shape of the present system
What it is
Linux Directory (lindir) gathers identity, host policy, optional VPN plugins, and native fleet care — inventory, labels, packages across apt/pacman/dnf/zypper, energy policies, remote queries and scripts — together with day-to-day operations: an attention dashboard, account policy, enroll tokens, and searchable audit. See Fleet and Handbook §12.
Capabilities
| Area | What you have |
|---|---|
| Users, groups, hosts | Full directory objects in SQL |
| Host enrollment | Admin enroll, client enroll, and one-shot len_… tokens |
| Account policy | Length, expiry, lockout, must-change, disable |
| HBAC | Group↔host login rules (empty rule set allows all — tighten before production) |
| Central sudo | Rules distributed on sync |
| SSH key distribution | Public keys for users, applied on sync |
| OIDC / app SSO | RS256, refresh tokens, public/PKCE clients |
| Passkeys / WebAuthn | ES256 registration and OIDC sign-in |
| Offline / cached login | Hardened client cache against 401/403 |
| Read-only LDAP gateway | Bind and search projection from SQL |
| Tailscale / Headscale / WireGuard | Optional pluggable mesh providers |
| Admin API | HTTP JSON (openapi.json) |
| Admin CLI | lindir-admin |
| Admin Web UI | Vue 3 at /admin |
| Ops attention | /v1/ops/attention |
| Audit | Filters, CSV export, expandable package-job logs |
| Fleet inventory & labels | Distro-aware package and host metadata |
| Fleet packages | Install, remove, upgrade, refresh, reboot, update-client; label targeting |
| Fleet vulnerability findings | Ubuntu Security, Arch AVG, OSV (Debian/RHEL/SUSE); findings for operators |
| Fleet energy policies | Idle sleep, screen blank/off, lid via logind/DPMS/dconf |
| MDM compliance | Distro/encryption/password/custom scripts; lock and retire; OIDC device gate |
| Fleet queries & scripts | Define and queue; results under Runs |
| Storage | PostgreSQL or MySQL/MariaDB (plus in-memory for labs) |
| Platforms | Ubuntu LTS and CachyOS (server + client); Debian, Fedora/RHEL-like, openSUSE clients |
| Packaging | .deb, PKGBUILD, RPM, install scripts |
Design commitments
- Server backend: D (
dub; LDC preferred for release builds). - Storage: PostgreSQL or MySQL/MariaDB — SQL is the system of record.
- Platforms: CachyOS and Ubuntu first-class for server and client; Debian, Fedora/RHEL-like, and openSUSE first-class for the client.
- VPN is optional; LAN-only fleets need no mesh provider.
- The product is built for Linux fleets — laptops and servers under one directory — without a Windows domain-protocol layer.
- Emphasis: remote care of hosts (packages, energy, compliance, optional VPN).
Natural boundaries
- Kerberos realms, Dogtag CA, and integrated DNS remain external companions when you want them.
- Compliance actions are lock and retire; there is no factory-reset wipe path.
- Device posture can gate OIDC clients that require a compliant device.
- Mail, calendar, and groupware live in companions such as Nextcloud via OIDC (Handbook §8.6).
- LDAP is a read-only projection of SQL, not the primary store (LDAP Gateway).
- Agent updates through packaged repos, or the fleet
update-clientjob (Fleet).