MacondoBits

Mewdoku

Fri, 02 Oct 2026 00:00:00 +0000

A cat-themed logic puzzle — place every mew where it belongs.

APIkulture

Fri, 02 Oct 2026 00:00:00 +0000

A native desktop REST API client — requests, collections, environments, OpenAPI.

EPUB Translator

Fri, 02 Oct 2026 00:00:00 +0000

Translate whole EPUB books while keeping structure, chapters, and formatting intact.

ScreenScrobbler

Fri, 02 Oct 2026 00:00:00 +0000

Self-hosted media tracking — scrobble from Kodi and Netflix, keep your own watch history.

Linux Directory

Fri, 02 Oct 2026 00:00:00 +0000

A calm home for Linux identity and host policy — users, HBAC, sudo, SSO, and fleet care under one roof.

How to install Ollama on Linux with models on external storage using Lindir

Sat, 07 Nov 2026 00:00:00 +0000

Install Ollama through Lindir fleet, put model files on an external disk, bind OLLAMA_HOST=0.0.0.0 for Tailnet clients, and start a user service only when you need inference.

How to install Linux Directory (Lindir)

Fri, 06 Nov 2026 00:00:00 +0000

A calm walkthrough from empty machine to first enrolled host — database, server, day-one identity, and the client that keeps accounts in sync.

Admin CLI (`lindir-admin`)

Mon, 01 Jan 0001 00:00:00 +0000

Admin CLI (`lindir-admin`)

Thin Bearer-API client for day-to-day IdM and fleet tasks without hand-written curl.

For the browser UI (Vue 3 at /admin/), see Admin Web UI.

Build

COMPILER="${COMPILER:-ldc2}"   # ldc2 | dmd | gdc
cd cli && dub build --compiler="$COMPILER"
# → cli/lindir-admin

Auth

export LINDIR_URL=https://id.example.com
export LINDIR_TOKEN=…   # break-glass bootstrap or API token (ldt_…)
# or: --url … --token …
# lab TLS: --insecure   custom CA: --ca-file /path/ca.pem

Day-to-day Admin UI login uses a directory username/password (or passkey) plus an Admin ACL binding (admin_ro / admin_rw). Bearer tokens remain emergency break-glass and always have full write.

Admin Web UI

Mon, 01 Jan 0001 00:00:00 +0000

Admin Web UI

Vue 3 + Vite SPA served by the existing HTTP server at /admin/ (same origin as the JSON API).

Build

Requires Node.js ≥18.19 (Vite 6). Ubuntu 24.04’s default nodejs (18.19.x) works.

cd admin
rm -rf node_modules   # optional; avoids stale installs after new deps (e.g. xterm)
npm ci                # installs from package-lock.json (required on every build host)
npm run build
# → admin/dist/

npm run build refuses to start if the Node version is too old or package.json dependencies are missing from node_modules (see scripts/check-deps.mjs). Packaging/makepkg always runs a clean npm ci first.

Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Architecture

┌─────────────────────────────────────────────────────────┐
│  lindir server (D)                                      │
│  ┌─────────┐ ┌──────────┐ ┌────────┐ ┌───────────────┐  │
│  │ identity│ │ policy   │ │ auth   │ │ vpn plugins   │  │
│  │ users   │ │ HBAC     │ │ tokens │ │ Tailscale…    │  │
│  │ groups  │ │ sudo     │ │ enroll │ │ (optional)    │  │
│  │ hosts   │ │ SSH keys │ │ PBKDF2 │ │               │  │
│  └────┬────┘ └────┬─────┘ └───┬────┘ └───────┬───────┘  │
│  ┌────┴───────────┴───────────┴──────────────┴───────┐  │
│  │ fleet: inventory · labels · packages · energy ·   │  │
│  │        queries/scripts · ops attention            │  │
│  │ oidc · webauthn · ldap gateway · audit            │  │
│  └───────────────────────┬───────────────────────────┘  │
│              repo layer (parameterized SQL)             │
│                         │                               │
│              Database interface (?, tx)                 │
│         memory://  |  postgres   |  mysql                 │
└─────────────────────────────────────────────────────────┘
          │
          ▼
┌─────────────────────────────────────────────────────────┐
│  lindir-client (D)                                      │
│  enroll · sync · pam-auth · authorized-keys             │
│  → extrausers · sudoers.d · package jobs · energy       │
│  → inventory · query/script runs                        │
└─────────────────────────────────────────────────────────┘

Modules

Path	Role
`source/lindir/api.d`	HTTP JSON API + static `/admin` SPA + OpenAPI serving
`admin/`	Vue 3 admin UI (Vite → `admin/dist`)
`source/lindir/auth.d`	Bootstrap / API tokens, host enrollment auth, one-shot enroll tokens, account-policy login checks
`source/lindir/crypto/password.d`	PBKDF2-HMAC-SHA256
`source/lindir/identity.d` / `policy.d`	Domain services + audit
`source/lindir/repo/*`	SQL repositories (users, hosts, fleet, account_policy, enroll_tokens, audit, …)
`source/lindir/oidc/*`	OpenID Connect IdP (RS256/JWKS, refresh, public/PKCE)
`source/lindir/webauthn/*`	Passkeys / WebAuthn (ES256, register + assert)
`source/lindir/ldap/*`	Read-only LDAP gateway (BER + bind/search)
`source/lindir/storage/*`	DB interface, memory, PostgreSQL, MySQL, migrations
`source/lindir/vpn/*`	Pluggable VPN (Tailscale, Headscale, WireGuard)
`source/lindir/fleet/*`	Native fleet (packages, labels, queries/scripts, energy)
`source/lindir/net/*`	Shared HTTPS JSON client (libcurl)
`cli/`	`lindir-admin` Bearer API CLI
`client/`	`lindir-client` (sync applies IdM + fleet packages + energy)
`sql/migrations/`	Versioned schema (`001` … `012_fleet_energy`, …)

Sync = cache refresh. Each successful lindir-client sync writes NSS files (/var/lib/extrausers/), policy (cache.json), and password hashes (cache-auth.json), and renews the offline login window for offlineMaxAgeSeconds (default 72 hours from the sync timestamp).

Distro compatibility (laptop fleets)

Mon, 01 Jan 0001 00:00:00 +0000

Distro compatibility (laptop fleets)

Lindir targets remote administration of laptops and similar hosts. Ubuntu LTS and CachyOS are first-class for server and client. Debian, Fedora / RHEL-like, and openSUSE / SLES are first-class for the client.

Support matrix

Component	Ubuntu / Debian	CachyOS (Arch)	Fedora / RHEL-like	openSUSE / SLES
`lindir-server`	`.deb` / install script	`PKGBUILD` / pacman	`.rpm`	`.rpm` (openSUSE)
`lindir-client`	`.deb` + sync timer	`PKGBUILD` + sync timer	`.rpm` + sync timer	`.rpm` + sync timer
Config `/etc/lindir/`	Yes	Yes	Yes	Yes
NSS (`libnss-extrausers`)	apt (required)	AUR required (`paru`/`yay`)	Distro package when available; else build from Debian source	Distro package when available; else build from Debian source
Default login shell (sync)	Directory value (usually `/bin/bash`)	`/usr/bin/fish` when installed	Directory value	Directory value
systemd / PAM / SSH	Client	Same	Same	Same
VPN plugins	Optional (`--skip-vpn` OK)	Same	Same	Same
Fleet packages	apt-get	pacman	dnf	zypper
Energy (logind/DPMS/dconf)	Yes	Yes	Yes	Yes
`osFamily`	`debian`	`arch`	`rhel`	`suse`

Pacman-based hosts (CachyOS, Arch, derivatives): official repos do not ship libnss-extrausers. Installing the client for password/SSH login requires the AUR package first: paru -S libnss-extrausers (or yay -S libnss-extrausers). See Client.

Linux client

Mon, 01 Jan 0001 00:00:00 +0000

Linux client

lindir-client joins a host to the domain, syncs POSIX accounts/policy, applies fleet package and energy jobs, and hooks into PAM/SSH/sudo.

Build

Needs dub and one of three first-class D compilers — LDC (ldc2), DMD (dmd), or GDC (gdc):

COMPILER="${COMPILER:-ldc2}"   # ldc2 | dmd | gdc

# server → ./lindir-server
dub build --compiler="$COMPILER"

# client → ./lindir-client
cd client && dub build --compiler="$COMPILER"

Requirements

Directory accounts are projected into /var/lib/extrausers/ and must be visible to glibc via NSS extrausers. Install the module before enroll/sync (or password login will not see users).

Linux Directory — shape of the present system

Mon, 01 Jan 0001 00:00:00 +0000

Linux Directory — shape of the present system

What it is

Linux Directory (lindir) gathers identity, host policy, optional VPN plugins, and native fleet care — inventory, labels, packages across apt/pacman/dnf/zypper, energy policies, TLS certificates (ACME), cron/systemd automation, remote queries and scripts — together with day-to-day operations: an attention dashboard, account policy, enroll tokens, and searchable audit. See Fleet, Certificates, and Operator handbook §13.

Capabilities

Area	What you have
Users, groups, hosts	Full directory objects in SQL
Host enrollment	Admin enroll, client enroll, and one-shot `len_…` tokens
Account policy	Length, expiry, must-change, disable; Admin login IP throttle
HBAC	Group↔host login rules (empty rule set allows all — tighten before production)
Central sudo	Rules distributed on sync
SSH key distribution	Public keys for users, applied on sync
OIDC / app SSO	RS256, refresh tokens, public/PKCE clients
Passkeys / WebAuthn	ES256 registration and OIDC sign-in
Offline / cached login	Hardened client cache against 401/403
Read-only LDAP gateway	Bind and search projection from SQL
Tailscale / Headscale / WireGuard / Pangolin	Optional pluggable mesh providers
Admin API	HTTP JSON (`openapi.json`)
Admin CLI	`lindir-admin`
Admin Web UI	Vue 3 at `/admin`
Ops attention	`/v1/ops/attention`
Audit	Filters, CSV export, expandable package-job logs
Fleet inventory & labels	Distro-aware package and host metadata
Fleet packages	Install, remove, upgrade, refresh, reboot, update-client; apt sources / PPA ops; label targeting
Fleet cron & systemd automation	User/`cron.d` crontabs; `lindir-*` timers, oneshots, services; system unit catalog operate
Fleet vulnerability findings	Ubuntu Security, Arch AVG, OSV (Debian/RHEL/SUSE); findings for operators
Fleet energy policies	Idle sleep, screen blank/off, lid via logind/DPMS/dconf
Fleet TLS certificates	ACME policies (DNS-01 / HTTP-01), many per host; discovery of existing PEMs — Certificates
MDM compliance	Distro/encryption/password/VPN posture (seeded `fleet-vpn`); lock and retire; OIDC device gate — MDM & Compliance
Fleet queries & scripts	Define and queue; results under Runs
Storage	PostgreSQL or MySQL/MariaDB (plus in-memory for labs)
Platforms	Ubuntu LTS and CachyOS (server + client); Debian, Fedora/RHEL-like, openSUSE clients
Packaging	`.deb`, `PKGBUILD`, RPM, install scripts

Design commitments

Server backend: D (dub; first-class compilers LDC, DMD, GDC).
Storage: PostgreSQL or MySQL/MariaDB — SQL is the system of record.
Platforms: CachyOS and Ubuntu first-class for server and client; Debian, Fedora/RHEL-like, and openSUSE first-class for the client.
VPN is optional; LAN-only fleets need no mesh provider.
The product is built for Linux fleets — laptops and servers under one directory — without a Windows domain-protocol layer.
Emphasis: remote care of hosts (packages, energy, compliance, optional VPN).

Natural boundaries

Kerberos realms, Dogtag CA, and integrated DNS remain external companions when you want them.
Compliance actions are lock and retire; there is no factory-reset wipe path.
Device posture can gate OIDC clients that require a compliant device.
Mail, calendar, and groupware live in companions such as Nextcloud via OIDC (Operator handbook §8.6).
LDAP is a read-only projection of SQL, not the primary store (LDAP).
Agent updates through packaged repos, or the fleet update-client job (Fleet).

MDM (device compliance)

Mon, 01 Jan 0001 00:00:00 +0000

MDM (device compliance)

lindir’s MDM layer provides compliance policies, custom discovery scripts, retire and lock remote actions, and OIDC Conditional Access via device assertions — a calm way to know a host’s posture before it opens an application.

What you get

Capability	Behavior
Allowed distro/version	Policy `allowedDistros[{family,minVersion,maxVersion}]`
Disk encryption	`requireEncryption` — dm-crypt/LUKS on root (mapper/`dm-`)
VPN posture	`requireVpn` — host reports mesh/VPN up (see seeded fleet-vpn below)
Local password mins	Compare `/etc/security/pwquality.conf` (and PAM hints) to policy mins
Custom scripts	Admin POSIX scripts → JSON stdout; `customAssert` on policy
Lock	Queue `loginctl lock-sessions` on next sync
Retire	Clear enrollment secret, mark host retired, agent clears local secret + energy drop-ins; VPN `removeHost` when a provider is configured
Conditional Access	OIDC clients with `requireCompliantDevice` need a short-lived device assertion

Remote actions today: lock sessions and retire enrollment. Compliance can gate OIDC clients that require a compliant device.

Native fleet

Mon, 01 Jan 0001 00:00:00 +0000

Native fleet

lindir includes a built-in fleet layer: host inventory, labels, package management, energy policies, cron / systemd automation (timers, oneshots, services, unit catalog), blocklists (/etc/hosts), remote queries, and scripts. Device management lives in the same SQL control plane as IdM.

Package management

First-class install / remove / upgrade / refresh for supported platforms:

Distro	Manager	Client backends
Ubuntu (and Debian)	`apt-get`	noninteractive, confold, `update` before install/upgrade
CachyOS (and Arch)	`pacman`	`--noconfirm`, `-Sy` / `-Syu` / `-R` as appropriate
Fedora / RHEL / Rocky / Alma	`dnf`	`-y install/remove/upgrade`; `check-update` for refresh (`yum` shim OK)
openSUSE / SLES	`zypper`	`--non-interactive` install/remove/update; `refresh` for indexes

Actions

Action	Packages	Behavior
`install`	required	Install named packages
`remove`	required	Remove named packages (`apt-get remove --purge` / `pacman -R` / `dnf remove` / `zypper remove`)
`upgrade`	optional	Specific packages, or empty list = full system upgrade (`apt-get upgrade` / `pacman -Syu` / `dnf upgrade` / `zypper update`) if `allowFullSystemUpgrade`
`refresh`	none	Update indexes only (`apt-get update` / `pacman -Sy` / `dnf check-update` / `zypper refresh`)
`reboot`	none	Schedule host reboot a few seconds after the agent reports the job (next sync)
`update-client`	none	Upgrade/install the `lindir-client` package via apt/pacman/dnf/zypper (must be in host repos)
`add-ppa`	required	Ubuntu/apt only: Launchpad `ppa:owner/name` via `add-apt-repository -y` then `apt-get update` (needs `software-properties-common`)
`enable-ppa`	required	apt only: re-enable inventoriable source id (`.list.disabled` → `.list`, or deb822 `Enabled: yes`) then `apt-get update` — no package changes
`disable-ppa`	required	apt only: disable inventoriable source id (`.list` → `.list.disabled`, or deb822 `Enabled: no`) then `apt-get update` — packages stay installed
`remove-ppa`	required	apt only: disable inventoriable `/etc/apt/sources.list.d/{id}` and revert packages from that origin to remaining archive versions. `packages[]` = source basenames (`.list` / `.sources`)

Package names are strictly validated on the server (no shell metacharacters). PPA specs and apt source ids use dedicated validators. The agent never builds shell strings from operator input — it passes argv arrays to apt-get / pacman / dnf / zypper / add-apt-repository.

OpenID Connect (OIDC)

Mon, 01 Jan 0001 00:00:00 +0000

OpenID Connect (OIDC)

What OIDC is

OpenID Connect is an identity layer on top of OAuth 2.0. An application (relying party) sends the user to an identity provider (IdP). After the user signs in, the IdP returns:

an ID token (JWT) asserting who the user is (sub, name, email, …)
usually an access token for calling APIs (e.g. UserInfo)
optionally a refresh token to obtain new tokens without re-login

That is how apps like Grafana, Nextcloud, or internal portals do SSO against a central directory — without each app storing passwords.

OWASP Top 10:2025 compliance

Mon, 01 Jan 0001 00:00:00 +0000

OWASP Top 10:2025 compliance

lindir treats the OWASP Top 10:2025 as a standing requirement. This document maps each risk to controls, residual risks, and ops guidance.

ID	Risk	Status	Controls in lindir	Residual risks
A01	Broken Access Control	Partial	Separate Bearer (admin) vs Host (enrolled machine) vs enroll (`len_…` one-shot, limited to `POST /v1/hosts/enroll`); HBAC on client login when rules exist; host routes reject missing/invalid enrollment secret; console WS uses short-lived single-use `wsTicket` (not the admin Bearer in the URL)	Empty HBAC rule set allows all logins. API tokens are effectively all-admin. Fleet scripts/packages/console are intentional root RCE for any Bearer admin. Admin SPA stores token in `sessionStorage` (XSS → full control).
A02	Security Misconfiguration	Partial	Bind default `127.0.0.1`; refuse weak `bootstrapToken` unless `allowInsecureBootstrap`; security response headers (`nosniff`, `X-Frame-Options`, `Referrer-Policy`); TLS via reverse proxy + `requireForwardedHttps` / `trustedProxies`	No Content-Security-Policy. HTTP cleartext by design. LDAP `allowAnonymous` defaults true. Listening on `0.0.0.0` warns but does not refuse.
A03	Software Supply Chain Failures	Partial	Pin Dub deps via `dub.selections.json`; pin admin UI via `package-lock.json`; first-class LDC/DMD/GDC builds; `update-client` uses distro packages	Client updates trust the distro package repositories you configure.
A04	Cryptographic Failures	Partial	PBKDF2-HMAC-SHA256 (~210k iter) for passwords; hashed API/enroll tokens; enrollment secrets random; client config/cache mode `600`	TLS not terminated in-process. Host bundle includes password hashes for offline PAM (host secret compromise → hash dump). Enrollment secrets compared as plaintext strings.
A05	Injection	Strong	Parameterized SQL (`?`); package name allowlist; typed JSON fields; `maxBodyBytes`; energy drop-ins from allowlisted enums/ints	Fleet queries/scripts and MDM custom compliance scripts execute shell on hosts by design (admin-trusted).
A06	Insecure Design	Partial	Optional VPN (default null); least privilege host vs admin APIs; password hashes only on Host-auth channel; offline PAM refuses fallback on 401/403	HBAC empty-set allow is easy to leave open. No approval workflow for fleet RCE / energy / logind changes.
A07	Authentication Failures	Strong	Bootstrap vs API tokens + revoke; global + Admin-login per-IP rate limiting; account policy (min length, expiry, must-change); disable user for account denial; WebAuthn for OIDC; generic client auth errors; enroll tokens (TTL / maxUses / hostname hint)	Admin API is long-lived Bearer without MFA/step-up. Compromised admin token = full domain.
A08	Software or Data Integrity Failures	Partial	Versioned SQL migrations (`001`–`027`…); audit log of admin mutations; sudoers written with restrictive mode	Client bundle / inventory / energy payloads are auth-protected but not signed. MITM without TLS can rewrite host policy.
A09	Security Logging and Alerting Failures	Partial	`audit_events` for auth ok/deny (`login.auth_denied` with channel actor; no password lockout counter), tokens, fleet (incl. package results with hostname), enroll, account policy, VPN, MDM; searchable Admin Audit (newest-first sort, expandable package-job stdout/stderr) + CLI filters/CSV export; Dashboard denial strip	Alerts (webhooks, SIEM, paging) for denial spikes, enroll abuse, or failed package jobs are left to your surrounding stack. Source IP is not stored in audit (use reverse-proxy access logs).
A10	Mishandling of Exceptional Conditions	Partial	Generic `internal` when `exposeErrorDetails` is false; rate limit → 429; offline PAM fail-closed on 401/403	Empty HBAC fails open. Some `Exception` catches ignore (e.g. early `account_policy` ensure). Energy/logind restart failure only warns.

Config knobs (server)

Security-relevant keys (full server config reference: Operator handbook §4.3):

Packaging

Mon, 01 Jan 0001 00:00:00 +0000

Packaging

Build binaries first, then package.

Prerequisites

dub + one of three first-class D compilers: LDC (ldc2), DMD (dmd), GDC (gdc)
Set COMPILER=ldc2|dmd|gdc to choose; install.sh / PKGBUILDs / migrate-db.sh auto-pick the first available if unset
Ubuntu .deb: dpkg-deb (dpkg-dev)
CachyOS/Arch: makepkg (base-devel)
Fedora/RHEL .rpm: podman (rpmbuild runs inside a Fedora container)
openSUSE .rpm: podman (rpmbuild runs inside an openSUSE container)

Local install (no package)

COMPILER="${COMPILER:-ldc2}"   # ldc2 | dmd | gdc
dub build --compiler="$COMPILER"
(cd cli && dub build --compiler="$COMPILER")
(cd admin && rm -rf node_modules && npm ci && npm run build)   # Vue admin → admin/dist
sudo ./packaging/install-server.sh

# client install.sh rebuilds with $COMPILER (default ldc2)
COMPILER="$COMPILER" sudo -E ./client/packaging/install.sh

Ubuntu `.deb`

COMPILER="${COMPILER:-ldc2}"
dub build --compiler="$COMPILER" --build=release
(cd cli && dub build --compiler="$COMPILER" --build=release)
(cd admin && rm -rf node_modules && npm ci && npm run build)
./scripts/packaging/build-deb-server.sh

(cd client && dub build --compiler="$COMPILER" --build=release)
./scripts/packaging/build-deb-client.sh
# → dist/lindir-server_*.deb  dist/lindir-client_*.deb
sudo dpkg -i dist/lindir-server_*.deb

CachyOS / Arch

Fast path (from source tree) — preferred while developing:

Passkeys / WebAuthn

Mon, 01 Jan 0001 00:00:00 +0000

Passkeys / WebAuthn

lindir is a WebAuthn relying party. Users register platform or roaming passkeys and can sign in on the OIDC login page without a password.

What is supported

Piece	Detail
Algorithms	ES256 (P-256) — covers platform passkeys
Attestation	`none` (packed authData still accepted if present)
Registration	Admin Bearer API (`/v1/webauthn/register/*`)
Authentication	Public API (`/v1/webauthn/authenticate/*`)
OIDC	Login page Sign in with passkey → short-lived `loginToken` → auth code
Resident keys	Preferred; discoverable login (empty username) supported

Config

{
  "issuerUrl": "https://id.example.com",
  "webauthnRpId": "id.example.com",
  "webauthnRpName": "lindir",
  "webauthnOrigins": ["https://id.example.com"]
}

Defaults: webauthnRpId = hostname of issuerUrl (or listen host); webauthnOrigins = [issuerUrl].
WebAuthn requires a secure context (HTTPS or localhost). Use requireForwardedHttps behind a TLS terminator.

Pluggable VPN architecture

Mon, 01 Jan 0001 00:00:00 +0000

Pluggable VPN architecture

VPN/mesh management is optional. LAN-only deployments use vpn.provider: "null".

Interface

D interface VpnProvider (source/lindir/vpn/provider.d):

Method	Purpose
`enrollHost(hostname, tags)`	Create a mesh auth / preauth key or WireGuard peer; return status
`syncGroupAcls(group → members)`	Merge IdM groups into control-plane ACL / policy / sidecar map
`removeHost(hostname)`	Delete matching device/node/peer from the mesh

Backends

Provider config	Implementation	Status
`null` / `none`	`NullVpnProvider`	Done — no-op
`tailscale`	`TailscaleVpnProvider`	Live API when `apiKey` + `tailnet` set; otherwise dry-run
`headscale`	`HeadscaleVpnProvider`	Live API when `apiBase` + `apiKey` + `tailnet` (user) set; otherwise dry-run
`wireguard`	`WireGuardVpnProvider`	Local peer registry + config files; optional `wg set`
`pangolin`	`PangolinVpnProvider`	Live API when `apiKey` + `pangolin.orgId` set; otherwise dry-run

Config — Tailscale

"vpn": {
  "provider": "tailscale",
  "apiBase": "https://api.tailscale.com",
  "apiKey": "tskey-api-…",
  "tailnet": "example.ts.net"
}

Create an API access token in the Tailscale admin console with scopes to manage auth keys, devices, and the policy file (ACL). Tags used at enroll (default tag:lindir) must be defined in the ACL tagOwners and allowed for that token / OAuth client.

Read-only LDAP gateway

Mon, 01 Jan 0001 00:00:00 +0000

Read-only LDAP gateway

lindir can project SQL users and groups as a read-only LDAP directory for apps that only speak LDAP (Grafana LDAP auth, some NAS/NAS-like tools, legacy clients). SQL remains the system of record; NSS on hosts still uses the Linux client / extrausers path.

Enable

"ldap": {
  "enabled": true,
  "listenHost": "127.0.0.1",
  "listenPort": 1389,
  "baseDn": "dc=lindir,dc=local",
  "allowAnonymous": false
}

Default port 1389 (non-root). Set enabled: true to start a background LDAP listener beside the HTTP API. In production, set allowAnonymous: false (OWASP Controls A02).

Reference labs

Mon, 01 Jan 0001 00:00:00 +0000

Reference labs

Two kinds of lab work sit beside the product docs: orientation against other IdM systems, and regression of Linux Directory itself across real guest images.

Linux Directory isolated e2e lab

The in-tree stack under scripts/integration/e2e-lab/ brings up IdP + Postgres, Headscale, Nextcloud, and six fleet guests (Ubuntu, Debian, Arch-as-CachyOS-stand-in, Fedora, openSUSE Leap, Rocky). It is the place that encoded day-one IdM, enroll/sync, Headscale mesh, Nextcloud SSO, console, and retire — see README.md and CHECKLIST.md there.

Storage

Mon, 01 Jan 0001 00:00:00 +0000

SQL storage

Persistent state for lindir lives in PostgreSQL or MySQL/MariaDB. Development can use memory://.

Choice at deploy time

Config	Value
`dbEngine`	`postgres` (default) or `mysql` / `mariadb`
`dbDsn`	Connection URL, or `memory://` for local/dev without a DB

Full sample files in the Lindir tree (identical keys; only engine/DSN and bootstrap hardening differ): config.example.json (memory://), config.postgres.example.json, config.mysql.example.json. Field-by-field reference: Operator handbook §4.3.

memory:// (also bare memory or empty DSN) always uses the in-process store; dbEngine is ignored for that DSN.

The landscape of Linux identity systems

Mon, 01 Jan 0001 00:00:00 +0000

The landscape of Linux identity systems

A quiet survey of how communities have gathered users, hosts, and policy under one roof — and where Linux Directory (lindir) sits among them: a greenfield IdM with a D server backend, PostgreSQL or MySQL storage, first-class CachyOS and Ubuntu support, and optional pluggable Tailscale/VPN.

Scope

Linux Directory centers on identity and host enrollment/policy (users, groups, hosts, auth, sudo/HBAC, SSH keys) and optional mesh VPN management, with native fleet care: apt/pacman/dnf/zypper packages, energy policies, vulnerability findings, inventory, and remote queries/scripts. Groupware and mail live in companions such as Nextcloud via OIDC.

TLS certificates for fleet hosts

Mon, 01 Jan 0001 00:00:00 +0000

TLS certificates for fleet hosts

Public names on the open network are a kind of address in space: browsers, APIs, and reverse proxies ask whether the machine answering that name is the one they meant to reach. TLS certificates are how we answer that question with cryptography instead of hope. Linux Directory helps you issue and renew those certificates on enrolled hosts through a native ACME client inside lindir-client — no certbot dependency, no separate certificate daemon required for the common case.

MacondoBits

Mewdoku

APIkulture

EPUB Translator

ScreenScrobbler

Linux Directory

How to install Ollama on Linux with models on external storage using Lindir

How to install Linux Directory (Lindir)

Admin CLI (`lindir-admin`)

Admin CLI (lindir-admin)

Build

Auth

Admin Web UI

Admin Web UI

Build

Architecture

Architecture

Modules

Host login

Distro compatibility (laptop fleets)

Distro compatibility (laptop fleets)

Support matrix

Linux client

Linux client

Build

Requirements

Linux Directory — shape of the present system

Linux Directory — shape of the present system

What it is

Capabilities

Design commitments

Natural boundaries

MDM (device compliance)

MDM (device compliance)

What you get

Native fleet

Native fleet

Package management

Actions

OpenID Connect (OIDC)

OpenID Connect (OIDC)

What OIDC is

OWASP Top 10:2025 compliance

OWASP Top 10:2025 compliance

Config knobs (server)

Packaging

Packaging

Prerequisites

Local install (no package)

Ubuntu .deb

CachyOS / Arch

Passkeys / WebAuthn

Passkeys / WebAuthn

What is supported

Config

Pluggable VPN architecture

Pluggable VPN architecture

Interface

Backends

Config — Tailscale

Read-only LDAP gateway

Read-only LDAP gateway

Enable

Reference labs

Reference labs

Linux Directory isolated e2e lab

Storage

SQL storage

Choice at deploy time

The landscape of Linux identity systems

The landscape of Linux identity systems

Scope

TLS certificates for fleet hosts

TLS certificates for fleet hosts

Admin CLI (`lindir-admin`)

Ubuntu `.deb`