Publish job using matrix

Change publish job with matrix, don't fail if another job fail.
cargo: depend on the published version of lldap_auth
2023-05-12 20:41:35 +07:00 · 2023-05-12 15:37:39 +02:00 · 2023-05-12 15:25:59 +02:00 · 2023-05-12 15:25:59 +02:00 · 2023-05-12 18:06:06 +07:00 · 2023-05-12 16:21:09 +09:00
59 changed files with 2393 additions and 337 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -2,6 +2,7 @@
 .git/*
 .github/*
 .gitignore
+.gitattributes

 # Don't track cargo generated files
 target/*
@@ -17,6 +18,7 @@ Dockerfile
 *.md
 LICENSE
 CHANGELOG.md
+README.md
 docs/*
 example_configs/*

@@ -32,12 +34,20 @@ package.json
 .vscode
 .devcontainer

+# Created databases
+*.db
+*.db-shm
+*.db-wal
+
+# These are backup files generated by rustfmt
+**/*.rs.bk
+
 # Various config files that shouldn't be tracked
 .env
 lldap_config.toml
 server_key
-users.db*
 screenshot.png
 recipe.json
+lldap_config.toml
 cert.pem
 key.pem
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1,10 @@
+example-configs/** linguist-documentation
+docs/** linguist-documentation
+*.md linguist-documentation
+lldap_config.docker_template.toml linguist-documentation
+
+schema.graphql linguist-generated
+
+.github/**  -linguist-detectable
+.devcontainer/**  -linguist-detectable
+.config/**  -linguist-detectable
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @nitnelave
--- a/.github/codecov.yml
+++ b/.github/codecov.yml
@@ -10,3 +10,5 @@ ignore:
  - "docs"
  - "example_configs"
  - "migration-tool"
+  - "scripts"
+  - "set-password"
--- a/.github/workflows/Dockerfile.ci.alpine
+++ b/.github/workflows/Dockerfile.ci.alpine
@@ -11,10 +11,10 @@ RUN mkdir -p /lldap/app

 RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then \
    mv bin/x86_64-unknown-linux-musl-lldap-bin/lldap target/lldap && \
-    mv bin/x86_64-unknown-linux-musl-migration-tool-bin/migration-tool target/migration-tool && \
+    mv bin/x86_64-unknown-linux-musl-lldap_migration_tool-bin/lldap_migration_tool target/lldap_migration_tool && \
    mv bin/x86_64-unknown-linux-musl-lldap_set_password-bin/lldap_set_password target/lldap_set_password && \
    chmod +x target/lldap && \
-    chmod +x target/migration-tool && \
+    chmod +x target/lldap_migration_tool && \
    chmod +x target/lldap_set_password && \
    ls -la target/ . && \
    pwd \
@@ -22,10 +22,10 @@ RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then \

 RUN if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \
    mv bin/aarch64-unknown-linux-musl-lldap-bin/lldap target/lldap && \
-    mv bin/aarch64-unknown-linux-musl-migration-tool-bin/migration-tool target/migration-tool && \
+    mv bin/aarch64-unknown-linux-musl-lldap_migration_tool-bin/lldap_migration_tool target/lldap_migration_tool && \
    mv bin/aarch64-unknown-linux-musl-lldap_set_password-bin/lldap_set_password target/lldap_set_password && \
    chmod +x target/lldap && \
-    chmod +x target/migration-tool && \
+    chmod +x target/lldap_migration_tool && \
    chmod +x target/lldap_set_password && \
    ls -la target/ . && \
    pwd \
@@ -33,10 +33,10 @@ RUN if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \

 RUN if [ "${TARGETPLATFORM}" = "linux/arm/v7" ]; then \
    mv bin/armv7-unknown-linux-gnueabihf-lldap-bin/lldap target/lldap && \
-    mv bin/armv7-unknown-linux-gnueabihf-migration-tool-bin/migration-tool target/migration-tool && \
+    mv bin/armv7-unknown-linux-gnueabihf-lldap_migration_tool-bin/lldap_migration_tool target/lldap_migration_tool && \
    mv bin/armv7-unknown-linux-gnueabihf-lldap_set_password-bin/lldap_set_password target/lldap_set_password && \
    chmod +x target/lldap && \
-    chmod +x target/migration-tool && \
+    chmod +x target/lldap_migration_tool && \
    chmod +x target/lldap_set_password && \
    ls -la target/ . && \
    pwd \
@@ -47,7 +47,7 @@ COPY docker-entrypoint.sh /docker-entrypoint.sh
 COPY lldap_config.docker_template.toml /lldap/
 COPY web/index_local.html web/index.html
 RUN cp target/lldap /lldap/ && \
-    cp target/migration-tool /lldap/ && \
+    cp target/lldap_migration_tool /lldap/ && \
    cp target/lldap_set_password /lldap/ && \
    cp -R web/index.html \
          web/pkg \
--- a/.github/workflows/Dockerfile.ci.debian
+++ b/.github/workflows/Dockerfile.ci.debian
@@ -11,10 +11,10 @@ RUN mkdir -p /lldap/app

 RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then \
    mv bin/x86_64-unknown-linux-musl-lldap-bin/lldap target/lldap && \
-    mv bin/x86_64-unknown-linux-musl-migration-tool-bin/migration-tool target/migration-tool && \
+    mv bin/x86_64-unknown-linux-musl-lldap_migration_tool-bin/lldap_migration_tool target/lldap_migration_tool && \
    mv bin/x86_64-unknown-linux-musl-lldap_set_password-bin/lldap_set_password target/lldap_set_password && \
    chmod +x target/lldap && \
-    chmod +x target/migration-tool && \
+    chmod +x target/lldap_migration_tool && \
    chmod +x target/lldap_set_password && \
    ls -la target/ . && \
    pwd \
@@ -22,10 +22,10 @@ RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then \

 RUN if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \
    mv bin/aarch64-unknown-linux-musl-lldap-bin/lldap target/lldap && \
-    mv bin/aarch64-unknown-linux-musl-migration-tool-bin/migration-tool target/migration-tool && \
+    mv bin/aarch64-unknown-linux-musl-lldap_migration_tool-bin/lldap_migration_tool target/lldap_migration_tool && \
    mv bin/aarch64-unknown-linux-musl-lldap_set_password-bin/lldap_set_password target/lldap_set_password && \
    chmod +x target/lldap && \
-    chmod +x target/migration-tool && \
+    chmod +x target/lldap_migration_tool && \
    chmod +x target/lldap_set_password && \
    ls -la target/ . && \
    pwd \
@@ -33,10 +33,10 @@ RUN if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \

 RUN if [ "${TARGETPLATFORM}" = "linux/arm/v7" ]; then \
    mv bin/armv7-unknown-linux-gnueabihf-lldap-bin/lldap target/lldap && \
-    mv bin/armv7-unknown-linux-gnueabihf-migration-tool-bin/migration-tool target/migration-tool && \
+    mv bin/armv7-unknown-linux-gnueabihf-lldap_migration_tool-bin/lldap_migration_tool target/lldap_migration_tool && \
    mv bin/armv7-unknown-linux-gnueabihf-lldap_set_password-bin/lldap_set_password target/lldap_set_password && \
    chmod +x target/lldap && \
-    chmod +x target/migration-tool && \
+    chmod +x target/lldap_migration_tool && \
    chmod +x target/lldap_set_password && \
    ls -la target/ . && \
    pwd \
@@ -47,7 +47,7 @@ COPY docker-entrypoint.sh /docker-entrypoint.sh
 COPY lldap_config.docker_template.toml /lldap/
 COPY web/index_local.html web/index.html
 RUN cp target/lldap /lldap/ && \
-    cp target/migration-tool /lldap/ && \
+    cp target/lldap_migration_tool /lldap/ && \
    cp target/lldap_set_password /lldap/ && \
    cp -R web/index.html \
          web/pkg \
--- a/.github/workflows/docker-build-static.yml
+++ b/.github/workflows/docker-build-static.yml
@@ -4,12 +4,18 @@ on:
  push:
    branches:
      - 'main'
+    paths-ignore:
+      - 'docs/**'
+      - 'example_configs/**'
  release:
    types:
      - 'published'
  pull_request:
    branches:
      - 'main'
+    paths-ignore:
+      - 'docs/**'
+      - 'example_configs/**'
  workflow_dispatch:
    inputs:
      msg:
@@ -60,13 +66,30 @@ env:
 # cache based on Cargo.lock per cargo target

 jobs:
+  pre_job:
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@master
+        with:
+          concurrent_skipping: 'outdated_runs'
+          skip_after_successful_duplicate: ${{ github.ref != 'refs/heads/main' }}
+          paths_ignore: '["**/*.md", "**/docs/**", "example_configs/**", "*.sh", ".gitignore", "lldap_config.docker_template.toml"]'
+          do_not_skip: '["workflow_dispatch", "schedule"]'
+          cancel_others: true
+
  build-ui:
    runs-on: ubuntu-latest
+    needs: pre_job
+    if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.event_name == 'release' }}
    container:
      image: nitnelave/rust-dev:latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2
      - uses: actions/cache@v3
        with:
          path: |
@@ -99,6 +122,8 @@ jobs:

  build-bin:
    runs-on: ubuntu-latest
+    needs: pre_job
+    if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.event_name == 'release' }}
    strategy:
      matrix:
        target: [armv7-unknown-linux-gnueabihf, aarch64-unknown-linux-musl, x86_64-unknown-linux-musl]
@@ -113,7 +138,7 @@ jobs:
        CARGO_HOME: ${GITHUB_WORKSPACE}/.cargo
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2
      - uses: actions/cache@v3
        with:
          path: |
@@ -126,7 +151,7 @@ jobs:
          restore-keys: |
            lldap-bin-${{ matrix.target }}-
      - name: Compile ${{ matrix.target }} lldap and tools
-        run: cargo build --target=${{ matrix.target }} --release -p lldap -p migration-tool -p lldap_set_password
+        run: cargo build --target=${{ matrix.target }} --release -p lldap -p lldap_migration_tool -p lldap_set_password
      - name: Check path
        run: ls -al target/release
      - name: Upload ${{ matrix.target}} lldap artifacts
@@ -137,17 +162,17 @@ jobs:
      - name: Upload ${{ matrix.target }} migration tool artifacts
        uses: actions/upload-artifact@v3
        with:
-          name: ${{ matrix.target }}-migration-tool-bin
-          path: target/${{ matrix.target }}/release/migration-tool
+          name: ${{ matrix.target }}-lldap_migration_tool-bin
+          path: target/${{ matrix.target }}/release/lldap_migration_tool
      - name: Upload ${{ matrix.target }} password tool artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ${{ matrix.target }}-lldap_set_password-bin
          path: target/${{ matrix.target }}/release/lldap_set_password

-  lldap-database-integration-test:
+  lldap-database-init-test:
    needs: [build-ui,build-bin]
-    name: LLDAP test
+    name: LLDAP database init test
    runs-on: ubuntu-latest
    services:
        mariadb:
@@ -155,10 +180,13 @@ jobs:
          ports:
            - 3306:3306
          env:
-            MYSQL_USER: lldapuser
-            MYSQL_PASSWORD: lldappass
-            MYSQL_DATABASE: lldap
-            MYSQL_ROOT_PASSWORD: rootpass
+            MARIADB_USER: lldapuser
+            MARIADB_PASSWORD: lldappass
+            MARIADB_DATABASE: lldap
+            MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: 1
+          options: >-
+            --name mariadb
+            --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3

        postgresql:
           image: postgres:latest
@@ -168,6 +196,12 @@ jobs:
             POSTGRES_USER: lldapuser
             POSTGRES_PASSWORD: lldappass
             POSTGRES_DB: lldap
+           options: >-
+             --health-cmd pg_isready
+             --health-interval 10s
+             --health-timeout 5s
+             --health-retries 5
+             --name postgresql

    steps:
       - name: Download artifacts
@@ -175,8 +209,7 @@ jobs:
         with:
           name: x86_64-unknown-linux-musl-lldap-bin
           path: bin/
-       - name: Where is the bin?
-         run: ls -alR bin
+
       - name: Set executables to LLDAP
         run: chmod +x bin/lldap

@@ -212,17 +245,239 @@ jobs:
           LLDAP_ldap_port: 3892
           LLDAP_http_port: 17172

+       - name: Check DB container logs
+         run: |
+              docker logs -n 20 mariadb
+              docker logs -n 20 postgresql
+
+  lldap-database-migration-test:
+    needs: [build-ui,build-bin]
+    name: LLDAP database migration test
+    runs-on: ubuntu-latest
+    services:
+        postgresql:
+           image: postgres:latest
+           ports:
+             - 5432:5432
+           env:
+             POSTGRES_USER: lldapuser
+             POSTGRES_PASSWORD: lldappass
+             POSTGRES_DB: lldap
+           options: >-
+             --health-cmd pg_isready
+             --health-interval 10s
+             --health-timeout 5s
+             --health-retries 5
+             --name postgresql
+
+        mariadb:
+          image: mariadb:latest
+          ports:
+            - 3306:3306
+          env:
+            MARIADB_USER: lldapuser
+            MARIADB_PASSWORD: lldappass
+            MARIADB_DATABASE: lldap
+            MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: 1
+          options: >-
+            --name mariadb
+            --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3
+
+
+        mysql:
+          image: mysql:latest
+          ports:
+            - 3307:3306
+          env:
+            MYSQL_USER: lldapuser
+            MYSQL_PASSWORD: lldappass
+            MYSQL_DATABASE: lldap
+            MYSQL_ALLOW_EMPTY_PASSWORD: 1
+          options: >-
+            --name mysql
+            --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3
+
+
+    steps:
+       - name: Download LLDAP artifacts
+         uses: actions/download-artifact@v3
+         with:
+           name: x86_64-unknown-linux-musl-lldap-bin
+           path: bin/
+
+       - name: Download LLDAP set password
+         uses: actions/download-artifact@v3
+         with:
+           name: x86_64-unknown-linux-musl-lldap_set_password-bin
+           path: bin/
+
+       - name: Set executables to LLDAP and LLDAP set password
+         run: |
+              chmod +x bin/lldap
+              chmod +x bin/lldap_set_password
+
+       - name: Install sqlite3 and ldap-utils for exporting and searching dummy user
+         run: sudo apt update && sudo apt install -y sqlite3 ldap-utils
+
+       - name: Run lldap with sqlite DB and healthcheck
+         run: |
+              bin/lldap run &
+              sleep 10s
+              bin/lldap healthcheck
+         env:
+           LLDAP_database_url: sqlite://users.db?mode=rwc
+           LLDAP_ldap_port: 3890
+           LLDAP_http_port: 17170
+           LLDAP_LDAP_USER_PASS: ldappass
+           LLDAP_JWT_SECRET: somejwtsecret
+
+       - name: Create dummy user
+         run: |
+              TOKEN=$(curl -X POST -H "Content-Type: application/json" -d '{"username": "admin", "password": "ldappass"}' http://localhost:17170/auth/simple/login | jq -r .token)
+              echo "$TOKEN"
+              curl 'http://localhost:17170/api/graphql' -H 'Content-Type: application/json' -H "Authorization: Bearer ${TOKEN//[$'\t\r\n ']}" --data-binary '{"query":"mutation{\n  createUser(user:\n    {\n      id: \"dummyuser\",\n      email: \"dummyuser@example.com\"\n    }\n  )\n  {\n    id\n    email\n  }\n}\n\n\n"}' --compressed
+              bin/lldap_set_password --base-url http://localhost:17170 --admin-username admin --admin-password ldappass --token $TOKEN --username dummyuser --password dummypassword
+
+       - name: Test Dummy User, This will be checked again after importing
+         run: |
+              ldapsearch -H ldap://localhost:3890 -LLL -D "uid=dummyuser,ou=people,dc=example,dc=com" -w 'dummypassword' -s "One" -b "ou=people,dc=example,dc=com"
+
+       - name: Stop LLDAP sqlite
+         run: pkill lldap
+
+       - name: Export and Converting to Postgress
+         run: |
+              curl -L https://raw.githubusercontent.com/lldap/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
+              chmod +x ./helper.sh
+              ./helper.sh | sqlite3 ./users.db > ./dump.sql
+              sed -i -r -e "s/X'([[:xdigit:]]+'[^'])/'\\\x\\1/g" -e '1s/^/BEGIN;\n/' -e '$aCOMMIT;' ./dump.sql
+
+       - name: Create schema on postgres
+         run: |
+              bin/lldap create_schema -d postgres://lldapuser:lldappass@localhost:5432/lldap
+
+       - name: Copy converted db to postgress and import
+         run: |
+              docker ps -a
+              docker cp ./dump.sql postgresql:/tmp/dump.sql
+              docker exec postgresql bash -c "psql -U lldapuser -d lldap < /tmp/dump.sql"
+              rm ./dump.sql
+
+       - name: Export and Converting to mariadb
+         run: |
+              curl -L https://raw.githubusercontent.com/lldap/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
+              chmod +x ./helper.sh
+              ./helper.sh | sqlite3 ./users.db > ./dump.sql
+              cp ./dump.sql ./dump-no-sed.sql
+              sed -i -r -e "s/([^']'[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{9})\+00:00'([^'])/\1'\2/g" \-e 's/^INSERT INTO "?([a-zA-Z0-9_]+)"?/INSERT INTO `\1`/' -e '1s/^/START TRANSACTION;\n/' -e '$aCOMMIT;' ./dump.sql
+              sed  -i '1 i\SET FOREIGN_KEY_CHECKS = 0;' ./dump.sql
+
+       - name: Create schema on mariadb
+         run: bin/lldap create_schema -d mysql://lldapuser:lldappass@localhost:3306/lldap
+
+       - name: Copy converted db to mariadb and import
+         run: |
+              docker ps -a
+              docker cp ./dump.sql mariadb:/tmp/dump.sql
+              docker exec mariadb bash -c "mariadb -ulldapuser -plldappass -f lldap < /tmp/dump.sql"
+              rm ./dump.sql
+
+       - name: Export and Converting to mysql
+         run: |
+              curl -L https://raw.githubusercontent.com/lldap/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
+              chmod +x ./helper.sh
+              ./helper.sh | sqlite3 ./users.db > ./dump.sql
+              sed -i -r -e 's/^INSERT INTO "?([a-zA-Z0-9_]+)"?/INSERT INTO `\1`/' -e '1s/^/START TRANSACTION;\n/' -e '$aCOMMIT;' ./dump.sql
+              sed  -i '1 i\SET FOREIGN_KEY_CHECKS = 0;' ./dump.sql
+
+       - name: Create schema on mysql
+         run: bin/lldap create_schema -d mysql://lldapuser:lldappass@localhost:3307/lldap
+
+       - name: Copy converted db to mysql and import
+         run: |
+              docker ps -a
+              docker cp ./dump.sql mysql:/tmp/dump.sql
+              docker exec mysql bash -c "mysql -ulldapuser -plldappass -f lldap < /tmp/dump.sql"
+              rm ./dump.sql
+
+       - name: Run lldap with postgres DB and healthcheck again
+         run: |
+              bin/lldap run &
+              sleep 10s
+              bin/lldap healthcheck
+         env:
+           LLDAP_database_url: postgres://lldapuser:lldappass@localhost:5432/lldap
+           LLDAP_ldap_port: 3891
+           LLDAP_http_port: 17171
+           LLDAP_LDAP_USER_PASS: ldappass
+           LLDAP_JWT_SECRET: somejwtsecret
+
+       - name: Run lldap with mariaDB and healthcheck again
+         run: |
+              bin/lldap run &
+              sleep 10s
+              bin/lldap healthcheck
+         env:
+           LLDAP_database_url: mysql://lldapuser:lldappass@localhost:3306/lldap
+           LLDAP_ldap_port: 3892
+           LLDAP_http_port: 17172
+           LLDAP_JWT_SECRET: somejwtsecret
+
+       - name: Run lldap with mysql and healthcheck again
+         run: |
+              bin/lldap run &
+              sleep 10s
+              bin/lldap healthcheck
+         env:
+           LLDAP_database_url: mysql://lldapuser:lldappass@localhost:3307/lldap
+           LLDAP_ldap_port: 3893
+           LLDAP_http_port: 17173
+           LLDAP_JWT_SECRET: somejwtsecret
+
+       - name: Test Dummy User
+         run: |
+              ldapsearch -H ldap://localhost:3891 -LLL -D "uid=dummyuser,ou=people,dc=example,dc=com" -w 'dummypassword' -s "One" -b "ou=people,dc=example,dc=com"
+              ldapsearch -H ldap://localhost:3892 -LLL -D "uid=dummyuser,ou=people,dc=example,dc=com" -w 'dummypassword' -s "One" -b "ou=people,dc=example,dc=com"
+              ldapsearch -H ldap://localhost:3893 -LLL -D "uid=dummyuser,ou=people,dc=example,dc=com" -w 'dummypassword' -s "One" -b "ou=people,dc=example,dc=com"

  build-docker-image:
    needs: [build-ui, build-bin]
    name: Build Docker image
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        container: ["debian","alpine"]
+        include:
+          - container: alpine
+            platforms: linux/amd64,linux/arm64
+            tags: |
+                  type=ref,event=pr
+                  type=semver,pattern=v{{version}}
+                  type=semver,pattern=v{{major}}
+                  type=semver,pattern=v{{major}}.{{minor}}
+                  type=semver,pattern=v{{version}},suffix=
+                  type=semver,pattern=v{{major}},suffix=
+                  type=semver,pattern=v{{major}}.{{minor}},suffix=
+                  type=raw,value=latest,enable={{ is_default_branch }}
+                  type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+                  type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }},suffix=
+                  type=raw,value=latest,enable={{ is_default_branch }},suffix=
+          - container: debian
+            platforms: linux/amd64,linux/arm64,linux/arm/v7
+            tags: |
+                  type=ref,event=pr
+                  type=semver,pattern=v{{version}}
+                  type=semver,pattern=v{{major}}
+                  type=semver,pattern=v{{major}}.{{minor}}
+                  type=raw,value=latest,enable={{ is_default_branch }}
+                  type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2
      - name: Download all artifacts
        uses: actions/download-artifact@v3
        with:
@@ -238,86 +493,66 @@ jobs:
        uses: docker/setup-qemu-action@v2
      - uses: docker/setup-buildx-action@v2

-      - name: Docker meta
+      - name: Docker ${{ matrix.container }} meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          # list of Docker images to use as base name for tags
          images: |
            nitnelave/lldap
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=sha
+            lldap/lldap
+            ghcr.io/lldap/lldap
+          # Wanted Docker tags
+          # vX-alpine
+          # vX.Y-alpine
+          # vX.Y.Z-alpine
+          # latest
+          # latest-alpine
+          # stable
+          # stable-alpine
+          #################
+          # vX-debian
+          # vX.Y-debian
+          # vX.Y.Z-debian
+          # latest-debian
+          # stable-debian
+          #################
+          # Check matrix for tag list definition
+          flavor: |
+            latest=false
+            suffix=-${{ matrix.container }}
+          tags: ${{ matrix.tags }}

-      - name: parse tag
-        uses: gacts/github-slug@v1
-        id: slug
-
-      - name: Login to Docker Hub
+      # Docker login to nitnelave/lldap and lldap/lldap
+      - name: Login to Nitnelave/LLDAP Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: nitnelave
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+
 ########################################
-#### docker image :latest tag build ####
+####       docker image build       ####
 ########################################
-      - name: Build and push latest alpine
-        if: github.event_name != 'release'
+      - name: Build ${{ matrix.container }} Docker Image
        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
-          platforms: linux/amd64,linux/arm64
-          file: ./.github/workflows/Dockerfile.ci.alpine
-          tags: nitnelave/lldap:latest, nitnelave/lldap:latest-alpine
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
-
-      - name: Build and push latest debian
-        if: github.event_name != 'release'
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./.github/workflows/Dockerfile.ci.debian
-          tags: nitnelave/lldap:latest-debian
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
-
-########################################
-#### docker image :semver tag build ####
-########################################
-      - name: Build and push release alpine
-        if: github.event_name == 'release'
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          # Tag as latest, stable, semver, major, major.minor and major.minor.patch.
-          file: ./.github/workflows/Dockerfile.ci.alpine
-          tags: nitnelave/lldap:stable, nitnelave/lldap:stable-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-semantic }}, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}.${{ steps.slug.outputs.version-patch }}, nitnelave/lldap:v${{ steps.slug.outputs.version-semantic }}-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}-alpine.${{ steps.slug.outputs.version-minor }}-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}.${{ steps.slug.outputs.version-patch }}-alpine
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
-
-      - name: Build and push release debian
-        if: github.event_name == 'release'
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          push: true
-          # Tag as latest, stable, semver, major, major.minor and major.minor.patch.
-          file: ./.github/workflows/Dockerfile.ci.debian
-          tags: nitnelave/lldap:stable-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-semantic }}-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}.${{ steps.slug.outputs.version-patch }}-debian
+          platforms: ${{ matrix.platforms  }}
+          file: ./.github/workflows/Dockerfile.ci.${{ matrix.container  }}
+          tags: |
+                ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,mode=max
          cache-to: type=gha,mode=max

@@ -329,6 +564,14 @@ jobs:
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          repository: nitnelave/lldap

+      - name: Update lldap repo description
+        if: github.event_name != 'pull_request'
+        uses: peter-evans/dockerhub-description@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: lldap/lldap
+
 ###############################################################
 ### Download artifacts, clean up ui, upload to release page ###
 ###############################################################
@@ -337,6 +580,8 @@ jobs:
     name: Create release artifacts
     if: github.event_name == 'release'
     runs-on: ubuntu-latest
+     permissions:
+       contents: write
     steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v3
@@ -349,14 +594,14 @@ jobs:
             mv bin/aarch64-unknown-linux-musl-lldap-bin/lldap bin/aarch64-lldap
             mv bin/x86_64-unknown-linux-musl-lldap-bin/lldap bin/amd64-lldap
             mv bin/armv7-unknown-linux-gnueabihf-lldap-bin/lldap bin/armhf-lldap
-             mv bin/aarch64-unknown-linux-musl-migration-tool-bin/migration-tool bin/aarch64-migration-tool
-             mv bin/x86_64-unknown-linux-musl-migration-tool-bin/migration-tool bin/amd64-migration-tool
-             mv bin/armv7-unknown-linux-gnueabihf-migration-tool-bin/migration-tool bin/armhf-migration-tool
+             mv bin/aarch64-unknown-linux-musl-lldap_migration_tool-bin/lldap_migration_tool bin/aarch64-lldap_migration_tool
+             mv bin/x86_64-unknown-linux-musl-lldap_migration_tool-bin/lldap_migration_tool bin/amd64-lldap_migration_tool
+             mv bin/armv7-unknown-linux-gnueabihf-lldap_migration_tool-bin/lldap_migration_tool bin/armhf-lldap_migration_tool
             mv bin/aarch64-unknown-linux-musl-lldap_set_password-bin/lldap_set_password bin/aarch64-lldap_set_password
             mv bin/x86_64-unknown-linux-musl-lldap_set_password-bin/lldap_set_password bin/amd64-lldap_set_password
             mv bin/armv7-unknown-linux-gnueabihf-lldap_set_password-bin/lldap_set_password bin/armhf-lldap_set_password
             chmod +x bin/*-lldap
-             chmod +x bin/*-migration-tool
+             chmod +x bin/*-lldap_migration_tool
             chmod +x bin/*-lldap_set_password

      - name: Download llap ui artifacts
@@ -382,9 +627,9 @@ jobs:
             mv bin/aarch64-lldap aarch64-lldap/lldap
             mv bin/amd64-lldap amd64-lldap/lldap
             mv bin/armhf-lldap armhf-lldap/lldap
-             mv bin/aarch64-migration-tool aarch64-lldap/migration-tool
-             mv bin/amd64-migration-tool amd64-lldap/migration-tool
-             mv bin/armhf-migration-tool armhf-lldap/migration-tool
+             mv bin/aarch64-lldap_migration_tool aarch64-lldap/lldap_migration_tool
+             mv bin/amd64-lldap_migration_tool amd64-lldap/lldap_migration_tool
+             mv bin/armhf-lldap_migration_tool armhf-lldap/lldap_migration_tool
             mv bin/aarch64-lldap_set_password aarch64-lldap/lldap_set_password
             mv bin/amd64-lldap_set_password amd64-lldap/lldap_set_password
             mv bin/armhf-lldap_set_password armhf-lldap/lldap_set_password
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -13,7 +13,6 @@ jobs:
  pre_job:
    continue-on-error: true
    runs-on: ubuntu-latest
-    # Map a step output to a job output
    outputs:
      should_skip: ${{ steps.skip_check.outputs.should_skip }}
    steps:
@@ -22,7 +21,7 @@ jobs:
        with:
          concurrent_skipping: 'outdated_runs'
          skip_after_successful_duplicate: 'true'
-          paths_ignore: '["**/*.md", "**/docs/**", "example_configs/**", "*.sh"]'
+          paths_ignore: '["**/*.md", "**/docs/**", "example_configs/**", "*.sh", ".dockerignore", ".gitignore", "lldap_config.docker_template.toml", "Dockerfile"]'
          do_not_skip: '["workflow_dispatch", "schedule"]'
          cancel_others: true

@@ -34,7 +33,7 @@ jobs:

    steps:
      - name: Checkout sources
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2
      - uses: Swatinem/rust-cache@v2
      - name: Build
        run: cargo build --verbose --workspace
@@ -53,7 +52,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2

      - uses: Swatinem/rust-cache@v2

@@ -70,7 +69,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2

      - uses: Swatinem/rust-cache@v2

@@ -87,7 +86,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3.5.2

      - name: Install Rust
        run: rustup toolchain install nightly --component llvm-tools-preview && rustup component add llvm-tools-preview --toolchain stable-x86_64-unknown-linux-gnu
@@ -102,7 +101,39 @@ jobs:
        run: cargo llvm-cov --no-run --lcov --output-path lcov.info
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
+        if: github.ref != 'refs/heads/main' || github.event_name != 'push'
+        with:
+          files: lcov.info
+          fail_ci_if_error: true
+      - name: Upload coverage to Codecov (main)
+        uses: codecov/codecov-action@v3
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          files: lcov.info
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}
+
+  publish-crates:
+    name: Publish on crates.io
+    if: ${{ needs.pre_job.outputs.should_skip != 'true' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'release' }}
+    needs: pre_job
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [lldap_auth, lldap, lldap_app, lldap_set_password, lldap_migration_tool]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3.5.2
+      - uses: actions-rs/toolchain@v1
+        with:
+            toolchain: stable
+            override: true
+      - name: Publish ${{ matrix.target }} crate
+        uses: katyo/publish-crates@v2
+        with:
+            args: -p ${{ matrix.target }}
+            dry-run: ${{ github.event_name != 'release' }}
+            check-repo: ${{ github.event_name != 'pull_request' }}
+            registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+            ignore-unpublished-changes: ${{ github.event_name != 'release' }}
+            
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,35 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [0.4.3] 2023-04-11
+
+The repository has changed from `nitnelave/lldap` to `lldap/lldap`, both on GitHub
+and on DockerHub (although we will keep publishing the images to 
+`nitnelave/lldap` for the foreseeable future). All data on GitHub has been
+migrated, and the new docker images are available both on DockerHub and on the
+GHCR under `lldap/lldap`.
+
+### Added
+
+ - EC private keys are not supported for LDAPS.
+
+### Changed
+
+ - SMTP user no longer has a default value (and instead defaults to unauthenticated).
+
+### Fixed
+
+ - WASM payload is now delivered uncompressed to Safari due to a Safari bug.
+ - Password reset no longer redirects to login page.
+ - NextCloud config should add the "mail" attribute.
+ - GraphQL parameters are now urldecoded, to support special characters in usernames.
+ - Healthcheck correctly checks the server certificate.
+
+### New services
+
+ - Home Assistant
+ - Shaarli
+
 ## [0.4.2] - 2023-03-27

 ### Added
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -118,7 +118,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "465a6172cf69b960917811022d8f29bc0b7fa1398bc4f78b3c466673db1213b6"
 dependencies = [
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -189,7 +189,7 @@ dependencies = [
 "pin-project-lite",
 "tokio-rustls",
 "tokio-util",
- "webpki-roots",
+ "webpki-roots 0.22.6",
 ]

 [[package]]
@@ -252,7 +252,7 @@ dependencies = [
 "actix-router",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -278,7 +278,7 @@ checksum = "6d44b8fee1ced9671ba043476deddef739dd0959bf77030b26b738cc591737a7"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -400,7 +400,7 @@ checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "synstructure",
 ]

@@ -412,7 +412,21 @@ checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "assert_cmd"
+version = "2.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9834fcc22e0874394a010230586367d4a3e9f11b560f469262678547e1d2575e"
+dependencies = [
+ "bstr",
+ "doc-comment",
+ "predicates",
+ "predicates-core",
+ "predicates-tree",
+ "wait-timeout",
 ]

 [[package]]
@@ -434,7 +448,7 @@ checksum = "e4655ae1a7b0cdf149156f780c5bf3f1352bc53cbd9e0a361a7ef7b22947e965"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -445,7 +459,7 @@ checksum = "1cd7fce9ba8c3c042128ce72d8b2ddbf3a05747efb67ea0313c635e10bda47a2"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -497,7 +511,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -606,6 +620,18 @@ dependencies = [
 "uuid 0.8.2",
 ]

+[[package]]
+name = "bstr"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d4260bcc2e8fc9df1eac4919a720effeb63a3f0952f5bf4944adfa18897f09"
+dependencies = [
+ "memchr",
+ "once_cell",
+ "regex-automata",
+ "serde",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.12.0"
@@ -695,7 +721,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -958,7 +984,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "scratch",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -975,7 +1001,7 @@ checksum = "086c685979a698443656e5cf7856c95c642295a38599f12fb1ff76fb28d19892"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -999,7 +1025,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "strsim",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1010,7 +1036,20 @@ checksum = "b36230598a2d5de7ec1c6f51f72d8a99a9208daff41de2084d06e3fd3ea56685"
 dependencies = [
 "darling_core",
 "quote",
- "syn",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "907076dfda823b0b36d2a1bb5f90c96660a5bbcd7729e10727f07858f22c4edc"
+dependencies = [
+ "cfg-if",
+ "hashbrown 0.12.3",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core 0.9.7",
 ]

 [[package]]
@@ -1062,7 +1101,7 @@ dependencies = [
 "darling",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1072,7 +1111,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebcda35c7a396850a55ffeac740804b40ffec779b98fffbb1738f4033f0ee79e"
 dependencies = [
 "derive_builder_core",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1085,7 +1124,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "rustc_version",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1096,7 +1135,7 @@ checksum = "532b4c15dccee12c7044f1fcad956e98410860b22231e44a3b827464797ca7bf"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1153,7 +1192,7 @@ checksum = "adc2ab4d5a16117f9029e9a6b5e4e79f4c67f6519bc134210d4d4a04ba31f41b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1164,9 +1203,15 @@ checksum = "3bf95dc3f046b9da4f2d51833c0d3547d8564ef6910f5c1ed130306a75b92886"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
 [[package]]
 name = "dotenvy"
 version = "0.15.6"
@@ -1255,7 +1300,7 @@ checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "synstructure",
 ]

@@ -1349,6 +1394,16 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c2141d6d6c8512188a7891b4b01590a45f6dac67afb4f255c4124dbb86d4eaa"

+[[package]]
+name = "fslock"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04412b8935272e3a9bae6f48c7bfff74c2911f60525404edfdd28e49884c3bfb"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.26"
@@ -1388,7 +1443,7 @@ checksum = "3422d14de7903a52e9dbc10ae05a7e14445ec61890100e098754e120b2bd7b1e"
 dependencies = [
 "derive_utils",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1427,7 +1482,7 @@ checksum = "95a73af87da33b5acf53acfebdc339fe592ecf5357ac7c0a7734ab9d8c876a70"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1718,7 +1773,7 @@ dependencies = [
 "quote",
 "serde",
 "serde_json",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1735,7 +1790,7 @@ dependencies = [
 "quote",
 "serde",
 "serde_json",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1746,7 +1801,7 @@ checksum = "e56b093bfda71de1da99758b036f4cc811fd2511c8a76f75680e9ffbd2bb4251"
 dependencies = [
 "graphql_client_codegen 0.10.0",
 "proc-macro2",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -1757,7 +1812,7 @@ checksum = "a755cc59cda2641ea3037b4f9f7ef40471c329f55c1fa2db6fa0bb7ae6c1f7ce"
 dependencies = [
 "graphql_client_codegen 0.11.0",
 "proc-macro2",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -2162,7 +2217,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -2268,7 +2323,7 @@ dependencies = [
 "peg",
 "tokio-util",
 "tracing",
- "uuid 1.3.0",
+ "uuid 1.3.1",
 ]

 [[package]]
@@ -2296,7 +2351,7 @@ dependencies = [
 "socket2",
 "tokio",
 "tokio-rustls",
- "webpki-roots",
+ "webpki-roots 0.22.6",
 ]

 [[package]]
@@ -2345,7 +2400,7 @@ checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"

 [[package]]
 name = "lldap"
-version = "0.4.2-alpha"
+version = "0.5.0-alpha"
 dependencies = [
 "actix",
 "actix-files",
@@ -2357,6 +2412,7 @@ dependencies = [
 "actix-web",
 "actix-web-httpauth",
 "anyhow",
+ "assert_cmd",
 "async-trait",
 "base64 0.21.0",
 "bincode",
@@ -2368,6 +2424,7 @@ dependencies = [
 "figment_file_provider_adapter",
 "futures",
 "futures-util",
+ "graphql_client 0.11.0",
 "hmac 0.12.1",
 "http",
 "image",
@@ -2375,14 +2432,17 @@ dependencies = [
 "juniper",
 "jwt 0.16.0",
 "lber 0.4.1",
+ "ldap3",
 "ldap3_proto",
 "lettre",
- "lldap_auth",
+ "lldap_auth 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
 "log",
 "mockall",
+ "nix",
 "opaque-ke",
 "orion",
 "rand 0.8.5",
+ "rand_chacha 0.3.1",
 "reqwest",
 "rustls",
 "rustls-pemfile",
@@ -2391,6 +2451,7 @@ dependencies = [
 "serde",
 "serde_bytes",
 "serde_json",
+ "serial_test",
 "sha2 0.10.6",
 "thiserror",
 "time 0.3.19",
@@ -2404,13 +2465,14 @@ dependencies = [
 "tracing-forest",
 "tracing-log",
 "tracing-subscriber",
- "uuid 0.8.2",
- "webpki-roots",
+ "urlencoding",
+ "uuid 1.3.1",
+ "webpki-roots 0.23.0",
 ]

 [[package]]
 name = "lldap_app"
-version = "0.4.2-alpha"
+version = "0.5.0-alpha"
 dependencies = [
 "anyhow",
 "base64 0.13.1",
@@ -2423,13 +2485,13 @@ dependencies = [
 "image",
 "indexmap",
 "jwt 0.13.0",
- "lldap_auth",
+ "lldap_auth 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
 "rand 0.8.5",
 "serde",
 "serde_json",
 "url-escape",
 "validator",
- "validator_derive",
+ "validator_derive 0.16.0",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
@@ -2441,7 +2503,7 @@ dependencies = [

 [[package]]
 name = "lldap_auth"
-version = "0.3.0-alpha.1"
+version = "0.3.0"
 dependencies = [
 "chrono",
 "curve25519-dalek",
@@ -2456,13 +2518,49 @@ dependencies = [
 "thiserror",
 ]

+[[package]]
+name = "lldap_auth"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17867a28e09989643401bb7849a494b328416634a335ddf7d3dabc9806ba563"
+dependencies = [
+ "chrono",
+ "curve25519-dalek",
+ "digest 0.9.0",
+ "generic-array",
+ "getrandom 0.2.8",
+ "opaque-ke",
+ "rand 0.8.5",
+ "rust-argon2",
+ "serde",
+ "sha2 0.9.9",
+ "thiserror",
+]
+
+[[package]]
+name = "lldap_migration_tool"
+version = "0.4.2"
+dependencies = [
+ "anyhow",
+ "base64 0.13.1",
+ "graphql_client 0.11.0",
+ "ldap3",
+ "lldap_auth 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.8.5",
+ "requestty",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "smallvec",
+]
+
 [[package]]
 name = "lldap_set_password"
 version = "0.1.0"
 dependencies = [
 "anyhow",
 "clap",
- "lldap_auth",
+ "lldap_auth 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
 "rand 0.8.5",
 "reqwest",
 "serde",
@@ -2530,12 +2628,6 @@ dependencies = [
 "digest 0.10.6",
 ]

-[[package]]
-name = "md5"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
-
 [[package]]
 name = "memchr"
 version = "2.5.0"
@@ -2543,20 +2635,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"

 [[package]]
-name = "migration-tool"
-version = "0.4.2-alpha"
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
 dependencies = [
- "anyhow",
- "base64 0.13.1",
- "graphql_client 0.11.0",
- "ldap3",
- "lldap_auth",
- "rand 0.8.5",
- "requestty",
- "reqwest",
- "serde",
- "serde_json",
- "smallvec",
+ "autocfg",
 ]

 [[package]]
@@ -2626,7 +2710,21 @@ dependencies = [
 "cfg-if",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "nix"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "libc",
+ "memoffset",
+ "pin-utils",
+ "static_assertions",
 ]

 [[package]]
@@ -2836,7 +2934,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -2919,7 +3017,7 @@ dependencies = [
 "proc-macro2",
 "proc-macro2-diagnostics",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -2981,7 +3079,7 @@ checksum = "069bdb1e05adc7a8990dce9cc75370895fbe4e3d58b9b73bf1aee56359344a55"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -3069,7 +3167,7 @@ dependencies = [
 "proc-macro-error-attr",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "version_check",
 ]

@@ -3086,9 +3184,9 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.51"
+version = "1.0.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
+checksum = "e472a104799c74b514a57226160104aa483546de37e839ec50e3c2e41dd87534"
 dependencies = [
 "unicode-ident",
 ]
@@ -3101,16 +3199,16 @@ checksum = "4bf29726d67464d49fa6224a1d07936a8c08bb3fba727c7493f6cf1616fdaada"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "version_check",
 "yansi",
 ]

 [[package]]
 name = "quote"
-version = "1.0.23"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
+checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
 dependencies = [
 "proc-macro2",
 ]
@@ -3306,7 +3404,7 @@ dependencies = [
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
- "webpki-roots",
+ "webpki-roots 0.22.6",
 "winreg",
 ]

@@ -3434,6 +3532,16 @@ dependencies = [
 "base64 0.21.0",
 ]

+[[package]]
+name = "rustls-webpki"
+version = "0.100.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6207cd5ed3d8dca7816f8f3725513a34609c0c765bf652b8c3cb4cfd87db46b"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.11"
@@ -3504,7 +3612,7 @@ dependencies = [
 "thiserror",
 "tracing",
 "url",
- "uuid 1.3.0",
+ "uuid 1.3.1",
 ]

 [[package]]
@@ -3517,7 +3625,7 @@ dependencies = [
 "heck 0.3.3",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -3528,7 +3636,7 @@ checksum = "d2fbe015dbdaa7d8829d71c1e14fb6289e928ac256b93dfda543c85cd89d6f03"
 dependencies = [
 "chrono",
 "sea-query-derive",
- "uuid 1.3.0",
+ "uuid 1.3.1",
 ]

 [[package]]
@@ -3540,7 +3648,7 @@ dependencies = [
 "chrono",
 "sea-query",
 "sqlx",
- "uuid 1.3.0",
+ "uuid 1.3.1",
 ]

 [[package]]
@@ -3552,7 +3660,7 @@ dependencies = [
 "heck 0.4.1",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "thiserror",
 ]

@@ -3575,7 +3683,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "rustversion",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -3655,7 +3763,7 @@ checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -3682,6 +3790,30 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "serial_test"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e56dd856803e253c8f298af3f4d7eb0ae5e23a737252cd90bb4f3b435033b2d"
+dependencies = [
+ "dashmap",
+ "fslock",
+ "lazy_static",
+ "parking_lot 0.12.1",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91d129178576168c589c9ec973feedf7d3126c01ac2bf08795109aa35b69fb8f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.12",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.5"
@@ -3900,8 +4032,8 @@ dependencies = [
 "thiserror",
 "tokio-stream",
 "url",
- "uuid 1.3.0",
- "webpki-roots",
+ "uuid 1.3.1",
+ "webpki-roots 0.22.6",
 "whoami",
 ]

@@ -3919,7 +4051,7 @@ dependencies = [
 "quote",
 "sqlx-core",
 "sqlx-rt",
- "syn",
+ "syn 1.0.109",
 "url",
 ]

@@ -3973,6 +4105,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syn"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79d9531f94112cfc3e4c8f5f02cb2b58f72c97b7efd85f70203cc6d8efda5927"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.12.6"
@@ -3981,7 +4124,7 @@ checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "unicode-xid",
 ]

@@ -4042,7 +4185,7 @@ checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -4136,7 +4279,7 @@ checksum = "d266c00fde287f55d3f1c3e96c500c362a2b8c695076ec180f27918820bc6df8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -4212,7 +4355,7 @@ dependencies = [
 "actix-web",
 "pin-project",
 "tracing",
- "uuid 1.3.0",
+ "uuid 1.3.1",
 ]

 [[package]]
@@ -4223,7 +4366,7 @@ checksum = "4017f8f45139870ca7e672686113917c71c7a6e02d4924eda67186083c03081a"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -4399,22 +4542,26 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "urlencoding"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8db7427f936968176eaa7cdf81b7f98b980b18495ec28f1b5791ac3bfe3eea9"
+
 [[package]]
 name = "uuid"
 version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
-dependencies = [
- "md5",
-]

 [[package]]
 name = "uuid"
-version = "1.3.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1674845326ee10d37ca60470760d4288a6f80f304007d92e5c53bab78c9cfd79"
+checksum = "5b55a3fef2a1e3b3a00ce878640918820d3c51081576ac657d23af9fc7928fdb"
 dependencies = [
 "getrandom 0.2.8",
+ "md-5",
 ]

 [[package]]
@@ -4430,7 +4577,7 @@ dependencies = [
 "serde_derive",
 "serde_json",
 "url",
- "validator_types",
+ "validator_types 0.14.0",
 ]

 [[package]]
@@ -4445,8 +4592,24 @@ dependencies = [
 "proc-macro2",
 "quote",
 "regex",
- "syn",
- "validator_types",
+ "syn 1.0.109",
+ "validator_types 0.14.0",
+]
+
+[[package]]
+name = "validator_derive"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc44ca3088bb3ba384d9aecf40c6a23a676ce23e09bdaca2073d99c207f864af"
+dependencies = [
+ "if_chain",
+ "lazy_static",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "syn 1.0.109",
+ "validator_types 0.16.0",
 ]

 [[package]]
@@ -4456,7 +4619,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ded9d97e1d42327632f5f3bae6403c04886e2de3036261ef42deebd931a6a291"
 dependencies = [
 "proc-macro2",
- "syn",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "validator_types"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "111abfe30072511849c5910134e8baf8dc05de4c0e5903d681cbd5c9c4d611e3"
+dependencies = [
+ "proc-macro2",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -4483,6 +4656,15 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"

+[[package]]
+name = "wait-timeout"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "want"
 version = "0.3.0"
@@ -4532,7 +4714,7 @@ dependencies = [
 "once_cell",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "wasm-bindgen-shared",
 ]

@@ -4566,7 +4748,7 @@ checksum = "2aff81306fcac3c7515ad4e177f521b5c9a15f2b08f4e32d823066102f35a5f6"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]
@@ -4606,6 +4788,15 @@ dependencies = [
 "webpki",
 ]

+[[package]]
+name = "webpki-roots"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa54963694b65584e170cf5dc46aeb4dcaa5584e652ff5f3952e56d66aff0125"
+dependencies = [
+ "rustls-webpki",
+]
+
 [[package]]
 name = "whoami"
 version = "1.3.0"
@@ -4791,7 +4982,7 @@ dependencies = [
 "proc-macro-error",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -4822,7 +5013,7 @@ checksum = "39049d193b52eaad4ffc80916bf08806d142c90b5edcebd527644de438a7e19a"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 ]

 [[package]]
@@ -4832,7 +5023,7 @@ source = "git+https://github.com/jfbilodeau/yew_form?rev=4b9fabffb63393ec7626a44
 dependencies = [
 "gloo-console",
 "validator",
- "validator_derive",
+ "validator_derive 0.14.0",
 "wasm-bindgen",
 "web-sys",
 "yew",
@@ -4845,7 +5036,7 @@ source = "git+https://github.com/jfbilodeau/yew_form?rev=4b9fabffb63393ec7626a44
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "yew_form",
 ]

@@ -4866,7 +5057,7 @@ checksum = "44bf07cb3e50ea2003396695d58bf46bc9887a1f362260446fad6bc4e79bd36c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 1.0.109",
 "synstructure",
 ]

--- a/6
+++ b/6
@@ -31,12 +31,12 @@ FROM chef AS builder
 COPY --from=planner /tmp/recipe.json recipe.json
 RUN cargo chef cook --release -p lldap_app --target wasm32-unknown-unknown \
    && cargo chef cook --release -p lldap \
-    && cargo chef cook --release -p migration-tool \
+    && cargo chef cook --release -p lldap_migration_tool \
    && cargo chef cook --release -p lldap_set_password

 # Copy the source and build the app and server.
 COPY --chown=app:app . .
-RUN cargo build --release -p lldap -p migration-tool -p lldap_set_password \
+RUN cargo build --release -p lldap -p lldap_migration_tool -p lldap_set_password \
    # Build the frontend.
    && ./app/build.sh

@@ -78,7 +78,7 @@ WORKDIR /app
 COPY --from=builder /app/app/index_local.html app/index.html
 COPY --from=builder /app/app/static app/static
 COPY --from=builder /app/app/pkg app/pkg
-COPY --from=builder /app/target/release/lldap /app/target/release/migration-tool /app/target/release/lldap_set_password ./
+COPY --from=builder /app/target/release/lldap /app/target/release/lldap_migration_tool /app/target/release/lldap_set_password ./
 COPY docker-entrypoint.sh lldap_config.docker_template.toml ./

 RUN set -x \
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@
  <a href="https://discord.gg/h5PEdRMNyP">
    <img alt="Discord" src="https://img.shields.io/discord/898492935446876200?label=discord&logo=discord" />
  </a>
+
  <a href="https://twitter.com/nitnelave1?ref_src=twsrc%5Etfw">
    <img
      src="https://img.shields.io/twitter/follow/nitnelave1?style=social"
@@ -23,8 +24,12 @@
      src="https://img.shields.io/badge/unsafe-forbidden-success.svg"
      alt="Unsafe forbidden"/>
  </a>
-  <a href="https://app.codecov.io/gh/nitnelave/lldap">
-    <img alt="Codecov" src="https://img.shields.io/codecov/c/github/nitnelave/lldap" />
+  <a href="https://app.codecov.io/gh/lldap/lldap">
+    <img alt="Codecov" src="https://img.shields.io/codecov/c/github/lldap/lldap" />
+  </a>
+  <br/>
+  <a href="https://www.buymeacoffee.com/nitnelave" target="_blank">
+    <img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;" >
  </a>
 </p>

@@ -77,6 +82,9 @@ For more features (OAuth/OpenID support, reverse proxy, ...) you can install
 other components (KeyCloak, Authelia, ...) using this server as the source of
 truth for users, via LDAP.

+By default, the data is stored in SQLite, but you can swap the backend with
+MySQL/MariaDB or PostgreSQL.
+
 ## Installation

 ### With Docker
@@ -155,7 +163,7 @@ To compile the project, you'll need:
 Then you can compile the server (and the migration tool if you want):

 ```shell
-cargo build --release -p lldap -p migration-tool
+cargo build --release -p lldap -p lldap_migration_tool
 ```

 The resulting binaries will be in `./target/release/`. Alternatively, you can
@@ -254,6 +262,7 @@ folder for help with:
 - [Dex](example_configs/dex_config.yml)
 - [Dokuwiki](example_configs/dokuwiki.md)
 - [Dolibarr](example_configs/dolibarr.md)
+- [Ejabberd](example_configs/ejabberd.md)
 - [Emby](example_configs/emby.md)
 - [Gitea](example_configs/gitea.md)
 - [Grafana](example_configs/grafana_ldap_config.toml)
@@ -268,6 +277,7 @@ folder for help with:
 - [Portainer](example_configs/portainer.md)
 - [Rancher](example_configs/rancher.md)
 - [Seafile](example_configs/seafile.md)
+- [Shaarli](example_configs/shaarli.md)
 - [Syncthing](example_configs/syncthing.md)
 - [Vaultwarden](example_configs/vaultwarden.md)
 - [WeKan](example_configs/wekan.md)
@@ -276,6 +286,12 @@ folder for help with:
 - [XBackBone](example_configs/xbackbone_config.php)
 - [Zendto](example_configs/zendto.md)

+## Migrating from SQLite
+
+If you started with an SQLite database and would like to migrate to
+MySQL/MariaDB or PostgreSQL, check out the [DB
+migration docs](/docs/database_migration.md).
+
 ## Comparisons with other services

 ### vs OpenLDAP
--- a/app/Cargo.toml
+++ b/app/Cargo.toml
@@ -1,8 +1,12 @@
 [package]
-name = "lldap_app"
-version = "0.4.2"
 authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
+description = "Frontend for LLDAP"
 edition = "2021"
+homepage = "https://github.com/lldap/lldap"
+license = "GPL-3.0-only"
+name = "lldap_app"
+repository = "https://github.com/lldap/lldap"
+version = "0.5.0-alpha"
 include = ["src/**/*", "queries/**/*", "Cargo.toml", "../schema.graphql"]

 [dependencies]
@@ -10,7 +14,7 @@ anyhow = "1"
 base64 = "0.13"
 gloo-console = "0.2.3"
 gloo-file = "0.2.3"
-gloo-net = "*"
+gloo-net = "0.2"
 graphql_client = "0.10"
 http = "0.2"
 jwt = "0.13"
@@ -19,9 +23,9 @@ serde = "1"
 serde_json = "1"
 url-escape = "0.1.1"
 validator = "=0.14"
-validator_derive = "*"
+validator_derive = "0.16"
 wasm-bindgen = "0.2"
-wasm-bindgen-futures = "*"
+wasm-bindgen-futures = "0.4"
 yew = "0.19.3"
 yew-router = "0.16"

@@ -43,13 +47,13 @@ features = [
 ]

 [dependencies.chrono]
-version = "*"
+version = "0.4"
 features = [
  "wasmbind"
 ]

 [dependencies.lldap_auth]
-path = "../auth"
+version = "0.3"
 features = [ "opaque_client" ]

 [dependencies.image]
--- a/app/build.sh
+++ b/app/build.sh
@@ -14,4 +14,4 @@ fi

 wasm-pack build --target web --release

-gzip -9 -f pkg/lldap_app_bg.wasm
+gzip -9 -k -f pkg/lldap_app_bg.wasm
--- a/app/src/components/app.rs
+++ b/app/src/components/app.rs
@@ -177,7 +177,13 @@ impl App {
                Some(AppRoute::StartResetPassword | AppRoute::FinishResetPassword { token: _ }),
                _,
                _,
-            ) if self.password_reset_enabled == Some(false) => Some(AppRoute::Login),
+            ) => {
+                if self.password_reset_enabled == Some(false) {
+                    Some(AppRoute::Login)
+                } else {
+                    None
+                }
+            }
            (None, _, _) | (_, None, _) => Some(AppRoute::Login),
            // User is logged in, a URL was given, don't redirect.
            (_, Some(_), Some(_)) => None,
--- a/app/static/main.js
+++ b/app/static/main.js
@@ -1,6 +1,10 @@
 import init, { run_app } from '/pkg/lldap_app.js';
 async function main() {
-   await init('/pkg/lldap_app_bg.wasm');
-   run_app();
+  if(navigator.userAgent.indexOf('AppleWebKit') != -1) {
+    await init('/pkg/lldap_app_bg.wasm');
+  } else {
+    await init('/pkg/lldap_app_bg.wasm.gz');
+  }
+  run_app();
 }
 main()
--- a/auth/Cargo.toml
+++ b/auth/Cargo.toml
@@ -1,8 +1,12 @@
 [package]
-name = "lldap_auth"
-version = "0.3.0"
 authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
+description = "Authentication protocol for LLDAP"
 edition = "2021"
+homepage = "https://github.com/lldap/lldap"
+license = "GPL-3.0-only"
+name = "lldap_auth"
+repository = "https://github.com/lldap/lldap"
+version = "0.3.0"

 [features]
 default = ["opaque_server", "opaque_client"]
@@ -14,17 +18,17 @@ js = []
 rust-argon2 = "0.8"
 curve25519-dalek = "3"
 digest = "0.9"
-generic-array = "*"
+generic-array = "0.14"
 rand = "0.8"
-serde = "*"
+serde = "1"
 sha2 = "0.9"
-thiserror = "*"
+thiserror = "1"

 [dependencies.opaque-ke]
 version = "0.6"

 [dependencies.chrono]
-version = "*"
+version = "0.4"
 features = [ "serde" ]

 # For WASM targets, use the JS getrandom.
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -26,9 +26,9 @@ Frontend:

 Data storage:
 * The data (users, groups, memberships, active JWTs, ...) is stored in SQL.
-* Currently only SQLite is supported (see
-  https://github.com/launchbadge/sqlx/issues/1225 for what blocks us from
-  supporting more SQL backends).
+* The main SQL DBs are supported: SQLite by default, MySQL, MariaDB, PostgreSQL
+  (see [DB Migration](/database_migration.md) for how to migrate off of
+  SQLite).

 ### Code organization

--- a/docs/database_migration.md
+++ b/docs/database_migration.md
@@ -65,7 +65,8 @@ a transaction:
 ```
 sed -i -r -e 's/^INSERT INTO "?([a-zA-Z0-9_]+)"?/INSERT INTO `\1`/' \
 -e '1s/^/START TRANSACTION;\n/' \
-e '$aCOMMIT;' /path/to/dump.sql
+-e '$aCOMMIT;' \
+-e '1 i\SET FOREIGN_KEY_CHECKS = 0;' /path/to/dump.sql
 ```

 ### To MariaDB
@@ -77,7 +78,8 @@ strings. Use the following command to remove those and perform the additional My
 sed -i -r -e "s/([^']'[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{9})\+00:00'([^'])/\1'\2/g" \
 -e 's/^INSERT INTO "?([a-zA-Z0-9_]+)"?/INSERT INTO `\1`/' \
 -e '1s/^/START TRANSACTION;\n/' \
-e '$aCOMMIT;' /path/to/dump.sql
+-e '$aCOMMIT;' \
+-e '1 i\SET FOREIGN_KEY_CHECKS = 0;' /path/to/dump.sql
 ```

 ## Insert data
@@ -102,4 +104,6 @@ or

 Modify your `database_url` in `lldap_config.toml` (or `LLDAP_DATABASE_URL` in the env)
 to point to your new database (the same value used when generating schema). Restart
-LLDAP and check the logs to ensure there were no errors.
+LLDAP and check the logs to ensure there were no errors.
+
+#### More details/examples can be seen in the CI process [here](https://raw.githubusercontent.com/nitnelave/lldap/main/.github/workflows/docker-build-static.yml), look for the job `lldap-database-migration-test`
--- a/docs/migration_guides/v0.5.md
+++ b/docs/migration_guides/v0.5.md
@@ -0,0 +1,58 @@
+# Migration from 0.4 to 0.5
+
+Welcome! If you're here, it's probably that the migration from 0.4.x to 0.5
+didn't go smoothly for you. Don't worry, we can fix that.
+
+## Multiple users with the same email
+
+This is the most common case. You can see in the LLDAP logs that there are
+several users with the same email, and they are listed.
+
+This is not allowed anymore in v0.5, to prevent a user from setting their email
+to someone else's email and gaining access to systems that identify by email.
+
+The problem is that you currently have several users with the same email, so the
+constraint cannot be enforced.
+
+### Step 1: Take a note of the users with duplicate emails
+
+In the LLDAP logs when you tried to start v0.5+, you'll see some warnings with
+the list of users with the same emails. Take note of them.
+
+### Step 2: Downgrade to v0.4.3
+
+If using docker, switch to the `lldap/lldap:v0.4.3` image. Alternatively, grab
+the binaries at https://github.com/lldap/lldap/releases/tag/v0.4.3.
+
+This downgrade is safe and supported.
+
+### Step 3: Remove duplicate emails
+
+Restart LLDAP with the v0.4.3 version, and using your notes from step 1, change
+the email of users with duplicate emails to make sure that each email is unique.
+
+### Step 4: Upgrade again
+
+You can now revert to the initial version.
+
+## Multiple users/groups with the same UUID
+
+This should be extremely rare. In this case, you'll need to find which users
+have the same UUID, revert to v0.4.3 to be able to apply the changes, and delete
+one of the duplicates.
+
+## FAQ
+
+### What if I want several users to be controlled by the same email?
+
+You can use plus codes to set "the same" email to several users, while ensuring
+that they can't identify as each other. For instance:
+
+ - Admin: `admin@example.com`
+ - Read-only admin: `admin+readonly@example.com`
+ - Jellyfin admin: `admin+jellyfin@example.com`
+
+### I'm upgrading to a higher version than v0.5.
+
+This guide is still relevant: you can use whatever later version in place of
+v0.5. You'll still need to revert to v0.4.3 to apply the changes.
--- a/example_configs/ejabberd.md
+++ b/example_configs/ejabberd.md
@@ -0,0 +1,30 @@
+# Basic LDAP auth for a Ejabberd XMPP server
+
+[Main documentation here.](https://docs.ejabberd.im/admin/configuration/ldap/)
+
+For simple user auth add this to main ejabberd.yml:
+
+```
+host_config:
+  xmpp.example.org:
+    auth_method: [ldap]
+    ldap_servers:
+      - 127.0.0.1 #IP or hostname of LLDAP server
+    ldap_port: 3890
+    ldap_uids:
+      - uid
+    ldap_rootdn: "uid=lldap_readonly,ou=people,dc=example,dc=org"
+    ldap_password: "secret"
+    ldap_base: "ou=people,dc=example,dc=org"
+```
+
+## vCard from LDAP
+Theoretically possible, [see the documentation.](https://docs.ejabberd.im/admin/configuration/ldap/#vcard-in-ldap)
+
+TODO
+
+## Shared roster groups from LDAP
+
+Theoretically possible, [see the documentation.](https://docs.ejabberd.im/admin/configuration/ldap/#shared-roster-in-ldap)
+
+TODO
--- a/example_configs/grafana_ldap_config.toml
+++ b/example_configs/grafana_ldap_config.toml
@@ -44,6 +44,6 @@ username = "uid"
 # If you want to map your ldap groups to grafana's groups, see: https://grafana.com/docs/grafana/latest/auth/ldap/#group-mappings
 # As a quick example, here is how you would map lldap's admin group to grafana's admin
 # [[servers.group_mappings]]
-# group_dn = "uid=lldap_admin,ou=groups,dc=example,dc=org"
+# group_dn = "cn=lldap_admin,ou=groups,dc=example,dc=org"
 # org_role = "Admin"
 # grafana_admin = true
--- a/example_configs/home-assistant.md
+++ b/example_configs/home-assistant.md
@@ -0,0 +1,24 @@
+# Home Assistant Configuration
+
+Home Assistant configures ldap auth via the [Command Line Auth Provider](https://www.home-assistant.io/docs/authentication/providers/#command-line). The wiki mentions a script that can be used for LDAP authentication, but it doesn't work in the container version (it is lacking both `ldapsearch` and `curl` ldap protocol support). Thankfully LLDAP has a graphql API to save the day!
+
+## Graphql-based Auth Script
+
+The [auth script](lldap-ha-auth.sh) attempts to authenticate a user against an LLDAP server, using credentials provided via `username` and `password` environment variables. The first argument must be the URL of your LLDAP server, accessible from Home Assistant. You can provide an additional optional argument to confine allowed logins to a single group. The script will output the user's display name as the `name` variable, if not empty.
+
+1. Copy the [auth script](lldap-ha-auth.sh) to your home assistant instance. In this example, we use `/config/lldap-auth.sh`.
+      - Set the script as executable by running `chmod +x /config/lldap-auth-sh`
+2. Add the following to your configuration.yaml in Home assistant:
+```yaml
+homeassistant:
+  auth_providers:
+    # Ensure you have the homeassistant provider enabled if you want to continue using your existing accounts
+    - type: homeassistant
+    - type: command_line
+      command: /config/lldap-auth.sh
+      # Only allow users in the 'homeassistant_user' group to login.
+      # Change to ["https://lldap.example.com"] to allow all users
+      args: ["https://lldap.example.com", "homeassistant_user"]
+      meta: true
+```
+3. Reload your config or restart Home Assistant
--- a/example_configs/lldap-ha-auth.sh
+++ b/example_configs/lldap-ha-auth.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# Usernames should be validated using a regular expression to be of
+# a known format. Special characters will be escaped anyway, but it is
+# generally not recommended to allow more than necessary.
+# This pattern is set by default. In your config file, you can either
+# overwrite it with a different one or use "unset USERNAME_PATTERN" to
+# disable validation completely.
+USERNAME_PATTERN='^[a-z|A-Z|0-9|_|-|.]+$'
+
+# When the timeout (in seconds) is exceeded (e.g. due to slow networking),
+# authentication fails.
+TIMEOUT=3
+
+# Log messages to stderr.
+log() {
+	echo "$1" >&2
+}
+
+# Get server address
+if [ -z "$1" ]; then
+	log "Usage: lldap-auth.sh <LLDAP server address> <Optional group to filter>"
+	exit 2
+fi
+SERVER_URL="${1%/}"
+
+# Check username and password are present and not malformed.
+if [ -z "$username" ] || [ -z "$password" ]; then
+	log "Need username and password environment variables."
+	exit 2
+elif [ ! -z "$USERNAME_PATTERN" ]; then
+	username_match=$(echo "$username" | sed -r "s/$USERNAME_PATTERN/x/")
+	if [ "$username_match" != "x" ]; then
+		log "Username '$username' has an invalid format."
+		exit 2
+	fi
+fi
+
+RESPONSE=$(curl -f -s -X POST -m "$TIMEOUT" -H "Content-type: application/json" -d '{"username":"'"$username"'","password":"'"$password"'"}' "$SERVER_URL/auth/simple/login")
+if [[ $? -ne 0 ]]; then
+    log "Auth failed"
+    exit 1
+fi
+TOKEN=$(jq -e -r .token <<< $RESPONSE)
+if [[ $? -ne 0 ]]; then
+    log "Failed to parse token"
+    exit 1
+fi
+
+RESPONSE=$(curl -f -s -m "$TIMEOUT" -H "Content-type: application/json" -H "Authorization: Bearer ${TOKEN}" -d '{"variables":{"id":"'"$username"'"},"query":"query($id:String!){user(userId:$id){displayName groups{displayName}}}"}' "$SERVER_URL/api/graphql")
+if [[ $? -ne 0 ]]; then
+    log "Failed to get user"
+    exit 1
+fi
+
+USER_JSON=$(jq -e .data.user <<< $RESPONSE)
+if [[ $? -ne 0 ]]; then
+    log "Failed to parse user json"
+    exit 1
+fi
+
+if [[ ! -z "$2" ]] && ! jq -e '.groups|map(.displayName)|index("'"$2"'")' <<< $USER_JSON > /dev/null 2>&1; then
+	log "User is not in group '$2'"
+	exit 1
+fi
+
+DISPLAY_NAME=$(jq -r .displayName <<< $USER_JSON)
+
+[[ ! -z "$DISPLAY_NAME" ]] && echo "name = $DISPLAY_NAME"
+
--- a/example_configs/nextcloud.md
+++ b/example_configs/nextcloud.md
@@ -62,6 +62,7 @@ occ ldap:set-config s01 ldapGroupFilterMode 0
 occ ldap:set-config s01 ldapGroupDisplayName cn
 occ ldap:set-config s01 ldapGroupFilterObjectclass groupOfUniqueNames
 occ ldap:set-config s01 ldapGroupMemberAssocAttr uniqueMember
+occ ldap:set-config s01 ldapEmailAttribute "mail" 
 occ ldap:set-config s01 ldapLoginFilterEmail 0
 occ ldap:set-config s01 ldapLoginFilterUsername 1
 occ ldap:set-config s01 ldapMatchingRuleInChainState unknown
--- a/example_configs/opnsense.md
+++ b/example_configs/opnsense.md
@@ -0,0 +1,113 @@
+# Configuration for OPNsense
+
+## Create a LDAP Server
+
+- Login to OPNsense
+- Navigate to: `System > Access > Servers`
+- Create a new server by clicking on the `+` icon
+
+## Server Config
+
+- Descriptive Name: `A Descriptive Name`
+- Type: `LDAP`
+- Hostname or IP address: `Hostname or IP for your LLDAP host`
+- Port value: `Your LLDAP port`
+  - Default: `3890`
+- Transport: `TCP - Standard`
+- Protocol version: `3`
+
+Make sure the host running LLDAP is accessible to OPNsense and that you mapped the LLDAP port to the LLDAP host.
+
+## LDAP Config
+
+### Bind credentials
+
+#### User DN
+
+```
+uid=admin,ou=people,dc=example,dc=com
+```
+
+It is recommended that you create a separate user account (e.g, `bind_user`) instead of `admin` for sharing Bind credentials with other services. The `bind_user` should be a member of the `lldap_strict_readonly` group to limit access to your LDAP configuration in LLDAP.
+
+#### Password
+
+```
+xxx
+```
+
+Enter the password that you set for the user specified in the User DN field.
+
+### Search Scope
+
+```
+One Level
+```
+
+### Base DN
+
+```
+dc=example,dc=com
+```
+
+This is the same LDAP Base DN that you set via the *LLDAP_LDAP_BASE_DN* environment variable or in `lldap_config.toml`.
+
+### Authentication containers
+
+```
+ou=people,dc=example,dc=com
+```
+
+Note: The `Select` box may not work for selecting containers. You can just enter the `Authentication containers` directly into the text field.
+
+### Extended Query
+
+```
+&(objectClass=person)(memberof=cn=lldap_admin,ou=groups,dc=example,dc=com)
+```
+
+It is recommended that you create a unique LDAP group (e.g., `lldap_opnsense`) in LLDAP and use that group in this query instead of `lldap_admin`. This will limit OPNsense access to  users in the `lldap_opnsense` group and make it easier to synchronize LLDAP groups with OPNsense groups for managing OPNsense access.
+
+### Initial Template
+
+```
+OpenLDAP
+```
+
+### User naming attribute
+
+```
+uid
+```
+
+## Optional Configuration
+
+The above configuration will connect OPNsense to LLDAP. This optional configuration will synchronize groups between LLDAP and OPNsense and automate user creation when an authorized LLDAP user logs into OPNsense.
+
+### Remaining Server Configuration
+
+Enable the following options on the OPNsense configuration page for your LLDAP server (the same page where you entered the prior configuration):
+
+- Read Properties: `Checked`
+- Synchronize groups: `Checked`
+- Automatic user creation: `Checked`
+
+### Create OPNsense Group
+
+Go to `System > Access > Groups` and create a new group with the **same** name as the LLDAP group used to authenticate users for OPNsense.
+
+By default, you would name your OPNsense group `lldap_admin` unless you followed the recommended advice in this guide and created a separate `lldap_opnsense` group for managing OPNsense users.
+
+If you want your LLDAP users to have full administrator access in OPNsense, then you need to edit the `Assigned Privileges` for the group and add the `GUI - All pages` system privilege.
+
+### Enable LLDAP as an Authentication Option
+
+Go to `System > Settings > Administration` page and scroll down to the `Authentication` section. Add your LLDAP server configuration to the `Server` field.
+
+## Testing LLDAP
+
+OPNsense includes a built-in feature for testing user authentication at `System > Access > Tester`. Select your LLDAP server configuration in the `Authentication Server` to test logins for your LLDAP users.
+
+## More Information
+
+Please read the [OPNsense docs](https://docs.opnsense.org/manual/how-tos/user-ldap.html) for more information on LDAP configuration and managing access to OPNsense.
--- a/example_configs/pfsense.md
+++ b/example_configs/pfsense.md
@@ -0,0 +1,117 @@
+# Configuration for pfSense
+
+## Create a LDAP Server
+
+- Login to pfSense
+- Navigate to: `System > User Manager > Authentication Servers`
+- Create a new server by clicking on the `+ Add` button
+
+## LDAP Server Settings
+
+- Descriptive Name: `A Descriptive Name`
+- Type: `LDAP`
+- Hostname or IP address: `Hostname or IP for your LLDAP host`
+- Port value: `Your LLDAP port`
+- Transport: `TCP - Standard`
+- Protocol version: `3`
+- Server Timeout: `25`
+
+(Make sure the host running LLDAP is accessible to pfSense and that you mapped the LLDAP port to the LLDAP host)
+### Search Scope
+```
+Entire Subtree
+```
+### Base DN
+
+```
+dc=example,dc=com
+```
+
+This is the same LDAP Base DN that you set via the *LLDAP_LDAP_BASE_DN* environment variable or in `lldap_config.toml`.
+### Authentication containers
+
+```
+ou=people
+```
+
+Note: The `Select a container` box may not work for selecting containers. You can just enter the `Authentication containers` directly into the text field.
+
+### Extended Query
+
+Enable extended query: `Checked`
+
+### Query:
+
+```
+&(objectClass=person)(|(memberof=cn=pfsense_admin,ou=groups,dc=example,dc=com)(memberof=cn=pfsense_guest,ou=groups,dc=example,dc=com))
+```
+
+This example gives you two groups in LLDAP, one for pfSense admin access (`pfsense_admin`) and one for guest access (`pfsense_guest`). You **must** create these exact same groups in both LLDAP and pfSense, then give them the correct permissions in pfSense.
+
+### Bind Anonymous
+`Unchecked`
+
+### Bind credentials
+
+#### User DN
+
+```
+uid=yourbinduser,ou=people,dc=example,dc=com
+```
+
+It is recommended that you create a separate read-only user account (e.g, `readonly`) instead of `admin` for sharing Bind credentials with other services. The `readonly` should be a member of the `lldap_strict_readonly` group to limit access to your LDAP configuration in LLDAP.
+
+#### Password
+
+```
+LLDAPPasswordForBindUser
+```
+
+### User naming attribute
+```
+uid
+```
+### Group naming attribute
+```
+cn
+```
+### Group member attribute
+```
+memberof
+```
+### RFC 2307 Groups
+`Unchecked`
+
+### Group Object Class
+`groupOfUniqueNames`
+
+### Shell Authentication Group DN
+`cn=pfsense_admin,ou=groups,dc=example,dc=com`
+
+(This is only if you want to give a group shell access through LDAP. Leave blank and only the pfSense admin user will have shell access.
+
+### Remaining Server Configuration
+
+Enable the following options on the pfSense configuration page for your LLDAP server (the same page where you entered the prior configuration):
+
+- UTF8 Encodes: `Checked`
+- Username Alterations: `Unchecked`
+- Allow unauthenticated bind: `Unchecked`
+
+### Create pfSense Groups
+
+Go to `System > User Manager > Groups` and create a new group(s) with the **same exact** name as the LLDAP group(s) used to authenticate users for pfSense (`pfsense_admin` and `pfsense_guest` in this example).
+
+If you want your LLDAP users to have full administrator access in pfSense, then you need to edit the `Assigned Privileges` for the group and add the `WebCfg - All pages` system privilege. If you do not give any permissions to a group, you will be able to log in but only see an empty webUI.
+
+### Enable LLDAP as an Authentication Option
+
+Go to `System > User Manager > Settings` page. Add your LLDAP server configuration to the `Authentication Server` field. **The "Save & Test" Button will fail the test results at step 3. No clue why.**
+
+## Testing LLDAP
+
+pfSense includes a built-in feature for testing user authentication at `Diagnostics > Authentication`. Select your LLDAP server configuration in the `Authentication Server` to test logins for your LLDAP users. The groups (only the ones you added to pfSense) should show up when tested.
+
+## More Information
+
+Please read the [pfSense docs](https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html) for more information on LDAP configuration and managing access to pfSense.
--- a/example_configs/shaarli.md
+++ b/example_configs/shaarli.md
@@ -0,0 +1,11 @@
+# Configuration for shaarli
+
+LDAP configuration is in ```/data/config.json.php```
+
+Just add the following lines:
+```
+    "ldap": {
+        "host": "ldap://lldap_server:3890",
+        "dn": "uid=%s,ou=people,dc=example,dc=com"
+    }
+```
--- a/example_configs/zendto.md
+++ b/example_configs/zendto.md
@@ -13,6 +13,6 @@ You setup https://zend.to/ for using LDAP by editing `/opt/zendto/config/prefere
  'authLDAPUsernameAttr'  => 'uid',
  'authLDAPEmailAttr'     => 'mail',
  'authLDAPMemberKey'     => 'memberOf',
-  'authLDAPMemberRole'    => 'uid=zendto,ou=groups,dc=example,dc=com',
+  'authLDAPMemberRole'    => 'cn=zendto,ou=groups,dc=example,dc=com',
 ```
 Every user of the group `zendto` is allowed to login.
--- a/lldap_config.docker_template.toml
+++ b/lldap_config.docker_template.toml
@@ -93,8 +93,17 @@ database_url = "sqlite:///data/users.db?mode=rwc"
 ## would still have to perform an (expensive) brute force attack to find
 ## each password.
 ## Randomly generated on first run if it doesn't exist.
+## Alternatively, you can use key_seed to override this instead of relying on
+## a file.
+## Env variable: LLDAP_KEY_FILE
 key_file = "/data/private_key"

+## Seed to generate the server private key, see key_file above.
+## This can be any random string, the recommendation is that it's at least 12
+## characters long.
+## Env variable: LLDAP_KEY_SEED
+#key_seed = "RanD0m STR1ng"
+
 ## Ignored attributes.
 ## Some services will request attributes that are not present in LLDAP. When it
 ## is the case, LLDAP will warn about the attribute being unknown. If you want
@@ -106,7 +115,7 @@ key_file = "/data/private_key"
 ## Options to configure SMTP parameters, to send password reset emails.
 ## To set these options from environment variables, use the following format
 ## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
-#[smtp_options]
+[smtp_options]
 ## Whether to enabled password reset via email, from LLDAP.
 #enable_password_reset=true
 ## The SMTP server.
@@ -128,7 +137,7 @@ key_file = "/data/private_key"
 ## Options to configure LDAPS.
 ## To set these options from environment variables, use the following format
 ## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
-#[ldaps_options]
+[ldaps_options]
 ## Whether to enable LDAPS.
 #enabled=true
 ## Port on which to listen.
--- a/migration-tool/Cargo.toml
+++ b/migration-tool/Cargo.toml
@@ -1,20 +1,24 @@
 [package]
-name = "migration-tool"
-version = "0.4.2"
-edition = "2021"
 authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
+description = "CLI migration tool to go from OpenLDAP to LLDAP"
+edition = "2021"
+homepage = "https://github.com/lldap/lldap"
+license = "GPL-3.0-only"
+name = "lldap_migration_tool"
+repository = "https://github.com/lldap/lldap"
+version = "0.4.2"

 [dependencies]
-anyhow = "*"
+anyhow = "1"
 base64 = "0.13"
 rand = "0.8"
 requestty = "0.4.1"
 serde = "1"
 serde_json = "1"
-smallvec = "*"
+smallvec = "1"

 [dependencies.lldap_auth]
-path = "../auth"
+version = "0.3"
 features = ["opaque_client"]

 [dependencies.graphql_client]
@@ -23,11 +27,11 @@ default-features = false
 version = "0.11"

 [dependencies.reqwest]
-version = "*"
+version = "0.11"
 default-features = false
 features = ["json", "blocking", "rustls-tls"]

 [dependencies.ldap3]
-version = "*"
+version = "0.11"
 default-features = false
 features = ["sync", "tls-rustls"]
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -1,8 +1,14 @@
 [package]
 authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
+categories = ["authentication", "command-line-utilities"]
+description = "Super-simple and lightweight LDAP server"
 edition = "2021"
+homepage = "https://github.com/lldap/lldap"
+keywords = ["cli", "ldap", "graphql", "server", "authentication"]
+license = "GPL-3.0-only"
 name = "lldap"
-version = "0.4.2"
+repository = "https://github.com/lldap/lldap"
+version = "0.5.0-alpha"

 [dependencies]
 actix = "0.13"
@@ -13,44 +19,45 @@ actix-server = "2"
 actix-service = "2"
 actix-web = "4.3"
 actix-web-httpauth = "0.8"
-anyhow = "*"
+anyhow = "1"
 async-trait = "0.1"
 base64 = "0.21"
 bincode = "1.3"
-cron = "*"
+cron = "0.12"
 derive_builder = "0.12"
 figment_file_provider_adapter = "0.1"
-futures = "*"
-futures-util = "*"
+futures = "0.3"
+futures-util = "0.3"
 hmac = "0.12"
-http = "*"
+http = "0.2"
 itertools = "0.10"
 juniper = "0.15"
 jwt = "0.16"
 lber = "0.4.1"
 ldap3_proto = ">=0.3.1"
-log = "*"
+log = "0.4"
 orion = "0.17"
-rustls = "0.20"
-serde = "*"
+rand_chacha = "0.3"
+rustls-pemfile = "1"
+serde = "1"
+serde_bytes = "0.11"
 serde_json = "1"
 sha2 = "0.10"
-thiserror = "*"
+thiserror = "1"
 time = "0.3"
 tokio-rustls = "0.23"
-tokio-stream = "*"
+tokio-stream = "0.1"
 tokio-util = "0.7"
-tracing = "*"
+tracing = "0.1"
 tracing-actix-web = "0.7"
 tracing-attributes = "^0.1.21"
-tracing-log = "*"
-rustls-pemfile = "1"
-serde_bytes = "0.11"
-webpki-roots = "*"
+tracing-log = "0.1"
+urlencoding = "2"
+webpki-roots = "0.23"

 [dependencies.chrono]
 features = ["serde"]
-version = "*"
+version = "0.4"

 [dependencies.clap]
 features = ["std", "color", "suggestions", "derive", "env"]
@@ -58,7 +65,7 @@ version = "4"

 [dependencies.figment]
 features = ["env", "toml"]
-version = "*"
+version = "0.10"

 [dependencies.tracing-subscriber]
 version = "0.3"
@@ -70,7 +77,7 @@ default-features = false
 version = "0.10.1"

 [dependencies.lldap_auth]
-path = "../auth"
+version = "0.3"

 [dependencies.opaque-ke]
 version = "0.6"
@@ -81,7 +88,7 @@ version = "0.8"

 [dependencies.secstr]
 features = ["serde"]
-version = "*"
+version = "0.5"

 [dependencies.tokio]
 features = ["full"]
@@ -89,7 +96,7 @@ version = "1.25"

 [dependencies.uuid]
 features = ["v3"]
-version = "*"
+version = "1"

 [dependencies.tracing-forest]
 features = ["smallvec", "chrono", "tokio"]
@@ -114,5 +121,35 @@ version = "0.11"
 default-features = false
 features = ["rustls-tls-webpki-roots"]

+[dependencies.rustls]
+version = "0.20"
+features = ["dangerous_configuration"]
+
 [dev-dependencies]
+assert_cmd = "2.0"
 mockall = "0.11"
+nix = "0.26.2"
+
+[dev-dependencies.graphql_client]
+features = ["graphql_query_derive", "reqwest-rustls"]
+default-features = false
+version = "0.11"
+
+[dev-dependencies.ldap3]
+version = "0.11"
+default-features = false
+features = ["sync", "tls-rustls"]
+
+[dev-dependencies.reqwest]
+version = "0.11"
+default-features = false
+features = ["json", "blocking", "rustls-tls"]
+
+[dev-dependencies.serial_test]
+version = "2.0.0"
+default-features = false
+features = ["file_locks"]
+
+[dev-dependencies.uuid]
+version = "1"
+features = ["v4"]
--- a/server/src/domain/sql_backend_handler.rs
+++ b/server/src/domain/sql_backend_handler.rs
@@ -86,7 +86,7 @@ pub mod tests {
        handler
            .create_user(CreateUserRequest {
                user_id: UserId::new(name),
-                email: "bob@bob.bob".to_string(),
+                email: format!("{}@bob.bob", name),
                display_name: Some("display ".to_string() + name),
                first_name: Some("first ".to_string() + name),
                last_name: Some("last ".to_string() + name),
--- a/server/src/domain/sql_migrations.rs
+++ b/server/src/domain/sql_migrations.rs
@@ -2,15 +2,17 @@ use crate::domain::{
    sql_tables::{DbConnection, SchemaVersion},
    types::{GroupId, UserId, Uuid},
 };
+use anyhow::Context;
+use itertools::Itertools;
 use sea_orm::{
-    sea_query::{self, ColumnDef, Expr, ForeignKey, ForeignKeyAction, Query, Table, Value},
-    ConnectionTrait, FromQueryResult, Iden, Statement, TransactionTrait,
+    sea_query::{
+        self, all, ColumnDef, Expr, ForeignKey, ForeignKeyAction, Func, Index, Query, Table, Value,
+    },
+    ConnectionTrait, FromQueryResult, Iden, Order, Statement, TransactionTrait,
 };
 use serde::{Deserialize, Serialize};
 use tracing::{info, instrument, warn};

-use super::sql_tables::LAST_SCHEMA_VERSION;
-
 #[derive(Iden, PartialEq, Eq, Debug, Serialize, Deserialize, Clone, Copy)]
 pub enum Users {
    Table,
@@ -460,30 +462,136 @@ async fn migrate_to_v3(pool: &DbConnection) -> anyhow::Result<()> {
    Ok(())
 }

+async fn migrate_to_v4(pool: &DbConnection) -> anyhow::Result<()> {
+    let builder = pool.get_database_backend();
+    // Make emails and UUIDs unique.
+    if let Err(e) = pool
+        .execute(
+            builder.build(
+                Index::create()
+                    .if_not_exists()
+                    .name("unique-user-email")
+                    .table(Users::Table)
+                    .col(Users::Email)
+                    .unique(),
+            ),
+        )
+        .await
+        .context(
+            r#"while enforcing unicity on emails (2 users have the same email).
+
+See https://github.com/lldap/lldap/blob/main/docs/migration_guides/v0.5.md for details.
+
+"#,
+        )
+    {
+        warn!("Found several users with the same email:");
+        for (email, users) in &pool
+            .query_all(
+                builder.build(
+                    Query::select()
+                        .from(Users::Table)
+                        .columns([Users::Email, Users::UserId])
+                        .order_by_columns([(Users::Email, Order::Asc), (Users::UserId, Order::Asc)])
+                        .and_where(
+                            Expr::col(Users::Email).in_subquery(
+                                Query::select()
+                                    .from(Users::Table)
+                                    .column(Users::Email)
+                                    .group_by_col(Users::Email)
+                                    .cond_having(all![Expr::gt(
+                                        Expr::expr(Func::count(Expr::col(Users::Email))),
+                                        1
+                                    )])
+                                    .take(),
+                            ),
+                        ),
+                ),
+            )
+            .await
+            .expect("Could not check duplicate users")
+            .into_iter()
+            .map(|row| {
+                (
+                    row.try_get::<UserId>("", &Users::UserId.to_string())
+                        .unwrap(),
+                    row.try_get::<String>("", &Users::Email.to_string())
+                        .unwrap(),
+                )
+            })
+            .group_by(|(_user, email)| email.to_owned())
+        {
+            warn!("Email: {email}");
+            for (user, _email) in users {
+                warn!("    User: {}", user.as_str());
+            }
+        }
+        return Err(e);
+    }
+    pool.execute(
+        builder.build(
+            Index::create()
+                .if_not_exists()
+                .name("unique-user-uuid")
+                .table(Users::Table)
+                .col(Users::Uuid)
+                .unique(),
+        ),
+    )
+    .await
+    .context("while enforcing unicity on user UUIDs (2 users have the same UUID)")?;
+    pool.execute(
+        builder.build(
+            Index::create()
+                .if_not_exists()
+                .name("unique-group-uuid")
+                .table(Groups::Table)
+                .col(Groups::Uuid)
+                .unique(),
+        ),
+    )
+    .await
+    .context("while enforcing unicity on group UUIDs (2 groups have the same UUID)")?;
+    Ok(())
+}
+
+// This is needed to make an array of async functions.
+macro_rules! to_sync {
+    ($l:ident) => {
+        |pool| -> std::pin::Pin<Box<dyn std::future::Future<Output = anyhow::Result<()>>>> {
+            Box::pin($l(pool))
+        }
+    };
+}
+
 pub async fn migrate_from_version(
    pool: &DbConnection,
    version: SchemaVersion,
+    last_version: SchemaVersion,
 ) -> anyhow::Result<()> {
-    match version.cmp(&LAST_SCHEMA_VERSION) {
-        std::cmp::Ordering::Less => info!(
-            "Upgrading DB schema from {} to {}",
-            version.0, LAST_SCHEMA_VERSION.0
-        ),
+    match version.cmp(&last_version) {
+        std::cmp::Ordering::Less => (),
        std::cmp::Ordering::Equal => return Ok(()),
        std::cmp::Ordering::Greater => anyhow::bail!("DB version downgrading is not supported"),
    }
-    if version < SchemaVersion(2) {
-        migrate_to_v2(pool).await?;
-    }
-    if version < SchemaVersion(3) {
-        migrate_to_v3(pool).await?;
+    info!("Upgrading DB schema from version {}", version.0);
+    let migrations = [
+        to_sync!(migrate_to_v2),
+        to_sync!(migrate_to_v3),
+        to_sync!(migrate_to_v4),
+    ];
+    for migration in 2..=4 {
+        if version < SchemaVersion(migration) && SchemaVersion(migration) <= last_version {
+            info!("Upgrading DB schema to version {}", migration);
+            migrations[(migration - 2) as usize](pool).await?;
+        }
    }
    let builder = pool.get_database_backend();
    pool.execute(
        builder.build(
            Query::update()
                .table(Metadata::Table)
-                .value(Metadata::Version, Value::from(LAST_SCHEMA_VERSION)),
+                .value(Metadata::Version, Value::from(last_version)),
        ),
    )
    .await?;
--- a/server/src/domain/sql_tables.rs
+++ b/server/src/domain/sql_tables.rs
@@ -21,7 +21,7 @@ impl From<SchemaVersion> for Value {
    }
 }

-pub const LAST_SCHEMA_VERSION: SchemaVersion = SchemaVersion(3);
+const LAST_SCHEMA_VERSION: SchemaVersion = SchemaVersion(4);

 pub async fn init_table(pool: &DbConnection) -> anyhow::Result<()> {
    let version = {
@@ -32,7 +32,7 @@ pub async fn init_table(pool: &DbConnection) -> anyhow::Result<()> {
            SchemaVersion(1)
        }
    };
-    migrate_from_version(pool, version).await?;
+    migrate_from_version(pool, version, LAST_SCHEMA_VERSION).await?;
    Ok(())
 }

@@ -46,6 +46,7 @@ mod tests {
    use super::*;
    use chrono::prelude::*;
    use sea_orm::{ConnectionTrait, Database, DbBackend, FromQueryResult};
+    use tracing::error;

    async fn get_in_memory_db() -> DbConnection {
        let mut sql_opt = sea_orm::ConnectOptions::new("sqlite::memory:".to_owned());
@@ -100,21 +101,21 @@ mod tests {
        let sql_pool = get_in_memory_db().await;
        sql_pool
            .execute(raw_statement(
-                r#"CREATE TABLE users ( user_id TEXT, display_name TEXT, first_name TEXT NOT NULL, last_name TEXT, avatar BLOB, creation_date TEXT);"#,
+                r#"CREATE TABLE users ( user_id TEXT, display_name TEXT, first_name TEXT NOT NULL, last_name TEXT, avatar BLOB, creation_date TEXT, email TEXT);"#,
            ))
            .await
            .unwrap();
        sql_pool
            .execute(raw_statement(
-                r#"INSERT INTO users (user_id, display_name, first_name, creation_date)
-                       VALUES ("bôb", "", "", "1970-01-01 00:00:00")"#,
+                r#"INSERT INTO users (user_id, display_name, first_name, creation_date, email)
+                       VALUES ("bôb", "", "", "1970-01-01 00:00:00", "bob@bob.com")"#,
            ))
            .await
            .unwrap();
        sql_pool
            .execute(raw_statement(
-                r#"INSERT INTO users (user_id, display_name, first_name, creation_date)
-                       VALUES ("john", "John Doe", "John", "1971-01-01 00:00:00")"#,
+                r#"INSERT INTO users (user_id, display_name, first_name, creation_date, email)
+                       VALUES ("john", "John Doe", "John", "1971-01-01 00:00:00", "bob2@bob.com")"#,
            ))
            .await
            .unwrap();
@@ -206,6 +207,69 @@ mod tests {
        );
    }

+    #[tokio::test]
+    async fn test_migration_to_v4() {
+        crate::infra::logging::init_for_tests();
+        let sql_pool = get_in_memory_db().await;
+        upgrade_to_v1(&sql_pool).await.unwrap();
+        migrate_from_version(&sql_pool, SchemaVersion(1), SchemaVersion(3))
+            .await
+            .unwrap();
+        sql_pool
+            .execute(raw_statement(
+                r#"INSERT INTO users (user_id, email, display_name, first_name, creation_date, uuid)
+                       VALUES ("bob", "bob@bob.com", "", "", "1970-01-01 00:00:00", "a02eaf13-48a7-30f6-a3d4-040ff7c52b04")"#,
+            ))
+            .await
+            .unwrap();
+        sql_pool
+            .execute(raw_statement(
+                r#"INSERT INTO users (user_id, email, display_name, first_name, creation_date, uuid)
+                       VALUES ("bob2", "bob@bob.com", "", "", "1970-01-01 00:00:00", "986765a5-3f03-389e-b47b-536b2d6e1bec")"#,
+            ))
+            .await
+            .unwrap();
+        error!(
+            "{}",
+            migrate_from_version(&sql_pool, SchemaVersion(3), SchemaVersion(4))
+                .await
+                .expect_err("migration should fail")
+        );
+        assert_eq!(
+            sql_migrations::JustSchemaVersion::find_by_statement(raw_statement(
+                r#"SELECT version FROM metadata"#
+            ))
+            .one(&sql_pool)
+            .await
+            .unwrap()
+            .unwrap(),
+            sql_migrations::JustSchemaVersion {
+                version: SchemaVersion(3)
+            }
+        );
+        sql_pool
+            .execute(raw_statement(
+                r#"UPDATE users SET email = "new@bob.com" WHERE user_id = "bob2""#,
+            ))
+            .await
+            .unwrap();
+        migrate_from_version(&sql_pool, SchemaVersion(3), SchemaVersion(4))
+            .await
+            .unwrap();
+        assert_eq!(
+            sql_migrations::JustSchemaVersion::find_by_statement(raw_statement(
+                r#"SELECT version FROM metadata"#
+            ))
+            .one(&sql_pool)
+            .await
+            .unwrap()
+            .unwrap(),
+            sql_migrations::JustSchemaVersion {
+                version: SchemaVersion(4)
+            }
+        );
+    }
+
    #[tokio::test]
    async fn test_too_high_version() {
        let sql_pool = get_in_memory_db().await;
--- a/server/src/infra/auth_service.rs
+++ b/server/src/infra/auth_service.rs
@@ -18,7 +18,7 @@ use hmac::Hmac;
 use jwt::{SignWithKey, VerifyWithKey};
 use sha2::Sha512;
 use time::ext::NumericalDuration;
-use tracing::{debug, instrument, warn};
+use tracing::{debug, info, instrument, warn};

 use lldap_auth::{login, password_reset, registration, JWTClaims};

@@ -183,6 +183,7 @@ where
    .await
    {
        warn!("Error sending email: {:#?}", e);
+        info!("Reset token: {}", token);
        return Err(TcpError::InternalServerError(format!(
            "Could not send email: {}",
            e
--- a/server/src/infra/cli.rs
+++ b/server/src/infra/cli.rs
@@ -54,9 +54,16 @@ pub struct RunOpts {

    /// Path to the file that contains the private server key.
    /// It will be created if it doesn't exist.
+    /// Alternatively, you can set `server_key_seed`. If `server_key_seed` is given,
+    /// `server_key_file` will be ignored.
    #[clap(long, env = "LLDAP_SERVER_KEY_FILE")]
    pub server_key_file: Option<String>,

+    /// Seed used to generate the private server key.
+    /// Takes precedence over `server_key_file`.
+    #[clap(long, env = "LLDAP_SERVER_KEY_SEED")]
+    pub server_key_seed: Option<String>,
+
    /// Change ldap host. Default: "0.0.0.0"
    #[clap(long, env = "LLDAP_LDAP_HOST")]
    pub ldap_host: Option<String>,
@@ -132,6 +139,10 @@ pub enum SmtpEncryption {
 #[derive(Debug, Parser, Clone)]
 #[clap(next_help_heading = Some("SMTP"))]
 pub struct SmtpOpts {
+    /// Enable password reset.
+    #[clap(long, env = "LLDAP_SMTP_OPTIONS__ENABLE_PASSWORD_RESET")]
+    pub smtp_enable_password_reset: Option<bool>,
+
    /// Sender email address.
    #[clap(long, env = "LLDAP_SMTP_OPTIONS__FROM")]
    pub smtp_from: Option<Mailbox>,
--- a/server/src/infra/configuration.rs
+++ b/server/src/infra/configuration.rs
@@ -17,7 +17,7 @@ use serde::{Deserialize, Serialize};
 pub struct MailOptions {
    #[builder(default = "false")]
    pub enable_password_reset: bool,
-    #[builder(default = "None")]
+    #[builder(default)]
    pub from: Option<Mailbox>,
    #[builder(default = "None")]
    pub reply_to: Option<Mailbox>,
@@ -25,7 +25,7 @@ pub struct MailOptions {
    pub server: String,
    #[builder(default = "587")]
    pub port: u16,
-    #[builder(default = r#""admin".to_string()"#)]
+    #[builder(default)]
    pub user: String,
    #[builder(default = r#"SecUtf8::from("")"#)]
    pub password: SecUtf8,
@@ -78,7 +78,7 @@ pub struct Configuration {
    pub ldap_base_dn: String,
    #[builder(default = r#"UserId::new("admin")"#)]
    pub ldap_user_dn: UserId,
-    #[builder(default = r#"String::default()"#)]
+    #[builder(default)]
    pub ldap_user_email: String,
    #[builder(default = r#"SecUtf8::from("password")"#)]
    pub ldap_user_pass: SecUtf8,
@@ -92,6 +92,10 @@ pub struct Configuration {
    pub verbose: bool,
    #[builder(default = r#"String::from("server_key")"#)]
    pub key_file: String,
+    // We want an Option to see whether there is a value or not, since the value is printed as
+    // "***SECRET***".
+    #[builder(default)]
+    pub key_seed: Option<SecUtf8>,
    #[builder(default)]
    pub smtp_options: MailOptions,
    #[builder(default)]
@@ -111,7 +115,14 @@ impl std::default::Default for Configuration {

 impl ConfigurationBuilder {
    pub fn build(self) -> Result<Configuration> {
-        let server_setup = get_server_setup(self.key_file.as_deref().unwrap_or("server_key"))?;
+        let server_setup = get_server_setup(
+            self.key_file.as_deref().unwrap_or("server_key"),
+            self.key_seed
+                .as_ref()
+                .and_then(|o| o.as_ref())
+                .map(SecUtf8::unsecure)
+                .unwrap_or_default(),
+        )?;
        Ok(self.server_setup(Some(server_setup)).private_build()?)
    }

@@ -154,10 +165,25 @@ fn write_to_readonly_file(path: &std::path::Path, buffer: &[u8]) -> Result<()> {
    Ok(file.write_all(buffer)?)
 }

-fn get_server_setup(file_path: &str) -> Result<ServerSetup> {
+fn get_server_setup(file_path: &str, key_seed: &str) -> Result<ServerSetup> {
    use std::fs::read;
    let path = std::path::Path::new(file_path);
-    if path.exists() {
+    if !key_seed.is_empty() {
+        if file_path != "server_key" || path.exists() {
+            eprintln!("WARNING: A key_seed was given, we will ignore the server_key and generate one from the seed!");
+        } else {
+            println!("Got a key_seed, ignoring key_file");
+        }
+        let hash = |val: &[u8]| -> [u8; 32] {
+            use sha2::{Digest, Sha256};
+            let mut seed_hasher = Sha256::new();
+            seed_hasher.update(val);
+            seed_hasher.finalize().into()
+        };
+        use rand::SeedableRng;
+        let mut rng = rand_chacha::ChaCha20Rng::from_seed(hash(key_seed.as_bytes()));
+        Ok(ServerSetup::new(&mut rng))
+    } else if path.exists() {
        let bytes = read(file_path).context(format!("Could not read key file `{}`", file_path))?;
        Ok(ServerSetup::deserialize(&bytes)?)
    } else {
@@ -198,6 +224,10 @@ impl ConfigOverrider for RunOpts {
            config.key_file = path.to_string();
        }

+        if let Some(seed) = self.server_key_seed.as_ref() {
+            config.key_seed = Some(SecUtf8::from(seed));
+        }
+
        if let Some(port) = self.ldap_port {
            config.ldap_port = port;
        }
@@ -276,6 +306,9 @@ impl ConfigOverrider for SmtpOpts {
        if let Some(tls_required) = self.smtp_tls_required {
            config.smtp_options.tls_required = Some(tls_required);
        }
+        if let Some(enable_password_reset) = self.smtp_enable_password_reset {
+            config.smtp_options.enable_password_reset = enable_password_reset;
+        }
    }
 }

@@ -303,7 +336,14 @@ where
    if config.verbose {
        println!("Configuration: {:#?}", &config);
    }
-    config.server_setup = Some(get_server_setup(&config.key_file)?);
+    config.server_setup = Some(get_server_setup(
+        &config.key_file,
+        config
+            .key_seed
+            .as_ref()
+            .map(SecUtf8::unsecure)
+            .unwrap_or_default(),
+    )?);
    if config.jwt_secret == SecUtf8::from("secretjwtsecret") {
        println!("WARNING: Default JWT secret used! This is highly unsafe and can allow attackers to log in as admin.");
    }
@@ -315,3 +355,29 @@ where
    }
    Ok(config)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_generated_server_key() {
+        assert_eq!(
+            bincode::serialize(&get_server_setup("/doesnt/exist", "key seed").unwrap()).unwrap(),
+            [
+                255, 206, 202, 50, 247, 13, 59, 191, 69, 244, 148, 187, 150, 227, 12, 250, 20, 207,
+                211, 151, 147, 33, 107, 132, 2, 252, 121, 94, 97, 6, 97, 232, 163, 168, 86, 246,
+                249, 186, 31, 204, 59, 75, 65, 134, 108, 159, 15, 70, 246, 250, 150, 195, 54, 197,
+                195, 176, 150, 200, 157, 119, 13, 173, 119, 8, 32, 0, 0, 0, 0, 0, 0, 0, 248, 123,
+                35, 91, 194, 51, 52, 57, 191, 210, 68, 227, 107, 166, 232, 37, 195, 244, 100, 84,
+                88, 212, 190, 12, 195, 57, 83, 72, 127, 189, 179, 16, 32, 0, 0, 0, 0, 0, 0, 0, 128,
+                112, 60, 207, 205, 69, 67, 73, 24, 175, 187, 62, 16, 45, 59, 136, 78, 40, 187, 54,
+                159, 94, 116, 33, 133, 119, 231, 43, 199, 164, 141, 7, 32, 0, 0, 0, 0, 0, 0, 0,
+                212, 134, 53, 203, 131, 24, 138, 211, 162, 28, 23, 233, 251, 82, 34, 66, 98, 12,
+                249, 205, 35, 208, 241, 50, 128, 131, 46, 189, 211, 51, 56, 109, 32, 0, 0, 0, 0, 0,
+                0, 0, 84, 20, 147, 25, 50, 5, 243, 203, 216, 180, 175, 121, 159, 96, 123, 183, 146,
+                251, 22, 44, 98, 168, 67, 224, 255, 139, 159, 25, 24, 254, 88, 3
+            ]
+        );
+    }
+}
--- a/server/src/infra/graphql/query.rs
+++ b/server/src/infra/graphql/query.rs
@@ -124,10 +124,12 @@ impl<Handler: BackendHandler> Query<Handler> {
    }

    pub async fn user(context: &Context<Handler>, user_id: String) -> FieldResult<User<Handler>> {
+        use anyhow::Context;
        let span = debug_span!("[GraphQL query] user");
        span.in_scope(|| {
            debug!(?user_id);
        });
+        let user_id = urlencoding::decode(&user_id).context("Invalid user parameter")?;
        let user_id = UserId::new(&user_id);
        let handler = context
            .get_readable_handler(&user_id)
--- a/server/src/infra/healthcheck.rs
+++ b/server/src/infra/healthcheck.rs
@@ -1,4 +1,4 @@
-use crate::infra::configuration::LdapsOptions;
+use crate::infra::{configuration::LdapsOptions, ldap_server::read_certificates};
 use anyhow::{anyhow, bail, ensure, Context, Result};
 use futures_util::SinkExt;
 use ldap3_proto::{
@@ -65,6 +65,7 @@ where
        invalid_answer
    );
    info!("Success");
+    resp.close().await?;
    Ok(())
 }

@@ -85,15 +86,44 @@ fn get_root_certificates() -> rustls::RootCertStore {
    root_store
 }

-fn get_tls_connector() -> Result<RustlsTlsConnector> {
-    use rustls::ClientConfig;
-    let client_config = std::sync::Arc::new(
-        ClientConfig::builder()
-            .with_safe_defaults()
-            .with_root_certificates(get_root_certificates())
-            .with_no_client_auth(),
-    );
-    Ok(client_config.into())
+fn get_tls_connector(ldaps_options: &LdapsOptions) -> Result<RustlsTlsConnector> {
+    let mut client_config = rustls::ClientConfig::builder()
+        .with_safe_defaults()
+        .with_root_certificates(get_root_certificates())
+        .with_no_client_auth();
+    let (certs, _private_key) = read_certificates(ldaps_options)?;
+    // Check that the server cert is the one in the config file.
+    struct CertificateVerifier {
+        certificate: rustls::Certificate,
+        certificate_path: String,
+    }
+    impl rustls::client::ServerCertVerifier for CertificateVerifier {
+        fn verify_server_cert(
+            &self,
+            end_entity: &rustls::Certificate,
+            _intermediates: &[rustls::Certificate],
+            _server_name: &rustls::ServerName,
+            _scts: &mut dyn Iterator<Item = &[u8]>,
+            _ocsp_response: &[u8],
+            _now: std::time::SystemTime,
+        ) -> std::result::Result<rustls::client::ServerCertVerified, rustls::Error> {
+            if end_entity != &self.certificate {
+                return Err(rustls::Error::InvalidCertificateData(format!(
+                    "Server certificate doesn't match the one in the config file {}",
+                    &self.certificate_path
+                )));
+            }
+            Ok(rustls::client::ServerCertVerified::assertion())
+        }
+    }
+    let mut dangerous_config = rustls::client::DangerousClientConfig {
+        cfg: &mut client_config,
+    };
+    dangerous_config.set_certificate_verifier(std::sync::Arc::new(CertificateVerifier {
+        certificate: certs.first().expect("empty certificate chain").clone(),
+        certificate_path: ldaps_options.cert_file.clone(),
+    }));
+    Ok(std::sync::Arc::new(client_config).into())
 }

 #[instrument(skip_all, level = "info", err)]
@@ -102,15 +132,20 @@ pub async fn check_ldaps(ldaps_options: &LdapsOptions) -> Result<()> {
        info!("LDAPS not enabled");
        return Ok(());
    };
-    let tls_connector = get_tls_connector()?;
+    let tls_connector =
+        get_tls_connector(ldaps_options).context("while preparing the tls connection")?;
    let url = format!("localhost:{}", ldaps_options.port);
    check_ldap_endpoint(
        tls_connector
            .connect(
-                rustls::ServerName::try_from(url.as_str())?,
-                TcpStream::connect(&url).await?,
+                rustls::ServerName::try_from("localhost")
+                    .context("while parsing the server name")?,
+                TcpStream::connect(&url)
+                    .await
+                    .context("while connecting TCP")?,
            )
-            .await?,
+            .await
+            .context("while connecting TLS")?,
    )
    .await
 }
--- a/server/src/infra/ldap_server.rs
+++ b/server/src/infra/ldap_server.rs
@@ -4,7 +4,8 @@ use crate::{
        opaque_handler::OpaqueHandler,
    },
    infra::{
-        access_control::AccessControlledBackendHandler, configuration::Configuration,
+        access_control::AccessControlledBackendHandler,
+        configuration::{Configuration, LdapsOptions},
        ldap_handler::LdapHandler,
    },
 };
@@ -94,7 +95,7 @@ where
 }

 fn read_private_key(key_file: &str) -> Result<PrivateKey> {
-    use rustls_pemfile::{pkcs8_private_keys, rsa_private_keys};
+    use rustls_pemfile::{ec_private_keys, pkcs8_private_keys, rsa_private_keys};
    use std::{fs::File, io::BufReader};
    pkcs8_private_keys(&mut BufReader::new(File::open(key_file)?))
        .map_err(anyhow::Error::from)
@@ -112,29 +113,36 @@ fn read_private_key(key_file: &str) -> Result<PrivateKey> {
                        .ok_or_else(|| anyhow!("No PKCS1 key"))
                })
        })
+        .or_else(|_| {
+            ec_private_keys(&mut BufReader::new(File::open(key_file)?))
+                .map_err(anyhow::Error::from)
+                .and_then(|keys| keys.into_iter().next().ok_or_else(|| anyhow!("No EC key")))
+        })
        .with_context(|| {
            format!(
-                "Cannot read either PKCS1 or PKCS8 private key from {}",
+                "Cannot read either PKCS1, PKCS8 or EC private key from {}",
                key_file
            )
        })
        .map(rustls::PrivateKey)
 }

-fn get_tls_acceptor(config: &Configuration) -> Result<RustlsTlsAcceptor> {
-    use rustls::{Certificate, ServerConfig};
-    use rustls_pemfile::certs;
+pub fn read_certificates(
+    ldaps_options: &LdapsOptions,
+) -> Result<(Vec<rustls::Certificate>, rustls::PrivateKey)> {
    use std::{fs::File, io::BufReader};
-    // Load TLS key and cert files
-    let certs = certs(&mut BufReader::new(File::open(
-        &config.ldaps_options.cert_file,
-    )?))?
-    .into_iter()
-    .map(Certificate)
-    .collect::<Vec<_>>();
-    let private_key = read_private_key(&config.ldaps_options.key_file)?;
+    let certs = rustls_pemfile::certs(&mut BufReader::new(File::open(&ldaps_options.cert_file)?))?
+        .into_iter()
+        .map(rustls::Certificate)
+        .collect::<Vec<_>>();
+    let private_key = read_private_key(&ldaps_options.key_file)?;
+    Ok((certs, private_key))
+}
+
+fn get_tls_acceptor(ldaps_options: &LdapsOptions) -> Result<RustlsTlsAcceptor> {
+    let (certs, private_key) = read_certificates(ldaps_options)?;
    let server_config = std::sync::Arc::new(
-        ServerConfig::builder()
+        rustls::ServerConfig::builder()
            .with_safe_defaults()
            .with_no_client_auth()
            .with_single_cert(certs, private_key)?,
@@ -185,7 +193,8 @@ where
    if config.ldaps_options.enabled {
        let tls_context = (
            context_for_tls,
-            get_tls_acceptor(config).context("while setting up the SSL certificate")?,
+            get_tls_acceptor(&config.ldaps_options)
+                .context("while setting up the SSL certificate")?,
        );
        let tls_binder = move || {
            let tls_context = tls_context.clone();
--- a/server/src/infra/tcp_server.rs
+++ b/server/src/infra/tcp_server.rs
@@ -16,7 +16,7 @@ use actix_files::{Files, NamedFile};
 use actix_http::{header, HttpServiceBuilder};
 use actix_server::ServerBuilder;
 use actix_service::map_config;
-use actix_web::{dev::AppConfig, guard, middleware, web, App, HttpResponse, Responder};
+use actix_web::{dev::AppConfig, guard, web, App, HttpResponse, Responder};
 use anyhow::{Context, Result};
 use hmac::Hmac;
 use sha2::Sha512;
@@ -68,6 +68,10 @@ pub(crate) fn error_to_http_response(error: TcpError) -> HttpResponse {
 }

 async fn wasm_handler() -> actix_web::Result<impl Responder> {
+    Ok(actix_files::NamedFile::open_async("./app/pkg/lldap_app_bg.wasm").await?)
+}
+
+async fn wasm_handler_compressed() -> actix_web::Result<impl Responder> {
    Ok(
        actix_files::NamedFile::open_async("./app/pkg/lldap_app_bg.wasm.gz")
            .await?
@@ -110,12 +114,9 @@ fn http_config<Backend>(
            .configure(super::graphql::api::configure_endpoint::<Backend>),
    )
    .service(
-        web::resource("/pkg/lldap_app_bg.wasm").route(
-            web::route()
-                .wrap(middleware::Compress::default())
-                .to(wasm_handler),
-        ),
+        web::resource("/pkg/lldap_app_bg.wasm.gz").route(web::route().to(wasm_handler_compressed)),
    )
+    .service(web::resource("/pkg/lldap_app_bg.wasm").route(web::route().to(wasm_handler)))
    // Serve the /pkg path with the compiled WASM app.
    .service(Files::new("/pkg", "./app/pkg"))
    // Serve static files
--- a/server/tests/common/auth.rs
+++ b/server/tests/common/auth.rs
@@ -0,0 +1,27 @@
+use crate::common::env;
+use reqwest::blocking::Client;
+
+pub fn get_token(client: &Client) -> String {
+    let username = env::admin_dn();
+    let password = env::admin_password();
+    let base_url = env::http_url();
+    let response = client
+        .post(format!("{base_url}/auth/simple/login"))
+        .header(reqwest::header::CONTENT_TYPE, "application/json")
+        .body(
+            serde_json::to_string(&lldap_auth::login::ClientSimpleLoginRequest {
+                username,
+                password,
+            })
+            .expect("Failed to encode the username/password as json to log in"),
+        )
+        .send()
+        .expect("Failed to send auth request")
+        .error_for_status()
+        .expect("Auth attempt failed");
+    serde_json::from_str::<lldap_auth::login::ServerLoginResponse>(
+        &response.text().expect("Failed to get response text"),
+    )
+    .expect("Failed to parse json")
+    .token
+}
--- a/server/tests/common/env.rs
+++ b/server/tests/common/env.rs
@@ -0,0 +1,36 @@
+#![allow(dead_code)]
+use std::env::var;
+
+pub const DB_KEY: &str = "LLDAP_DATABASE_URL";
+
+pub fn database_url() -> String {
+    let url = var(DB_KEY).ok();
+    url.unwrap_or("sqlite://e2e_test.db?mode=rwc".to_string())
+}
+
+pub fn ldap_url() -> String {
+    let port = var("LLDAP_LDAP_PORT").ok();
+    let port = port.unwrap_or("3890".to_string());
+    format!("ldap://localhost:{}", port)
+}
+
+pub fn http_url() -> String {
+    let port = var("LLDAP_HTTP_PORT").ok();
+    let port = port.unwrap_or("17170".to_string());
+    format!("http://localhost:{}", port)
+}
+
+pub fn admin_dn() -> String {
+    let user = var("LLDAP_LDAP_USER_DN").ok();
+    user.unwrap_or("admin".to_string())
+}
+
+pub fn admin_password() -> String {
+    let pass = var("LLDAP_LDAP_USER_PASS").ok();
+    pass.unwrap_or("password".to_string())
+}
+
+pub fn base_dn() -> String {
+    let dn = var("LLDAP_LDAP_BASE_DN").ok();
+    dn.unwrap_or("dc=example,dc=com".to_string())
+}
--- a/server/tests/common/fixture.rs
+++ b/server/tests/common/fixture.rs
@@ -0,0 +1,240 @@
+use crate::common::{
+    auth::get_token,
+    env,
+    graphql::{
+        add_user_to_group, create_group, create_user, delete_group_query, delete_user_query, post,
+        AddUserToGroup, CreateGroup, CreateUser, DeleteGroupQuery, DeleteUserQuery,
+    },
+};
+use assert_cmd::prelude::*;
+use nix::{
+    sys::signal::{self, Signal},
+    unistd::Pid,
+};
+use reqwest::blocking::{Client, ClientBuilder};
+use std::collections::{HashMap, HashSet};
+use std::process::{Child as ChildProcess, Command};
+use std::{fs::canonicalize, thread, time::Duration};
+use uuid::Uuid;
+
+#[derive(Clone)]
+pub struct User {
+    pub username: String,
+    pub groups: Vec<String>,
+}
+
+impl User {
+    pub fn new(username: &str, groups: Vec<&str>) -> Self {
+        let username = username.to_owned();
+        let groups = groups.iter().map(|username| username.to_string()).collect();
+        Self { username, groups }
+    }
+}
+
+pub struct LLDAPFixture {
+    token: String,
+    client: Client,
+    child: ChildProcess,
+    users: HashSet<String>,
+    groups: HashMap<String, i64>,
+}
+
+const MAX_HEALTHCHECK_ATTEMPS: u8 = 10;
+
+impl LLDAPFixture {
+    pub fn new() -> Self {
+        let mut cmd = create_lldap_command();
+        cmd.arg("run");
+        cmd.arg("--verbose");
+        let child = cmd.spawn().expect("Unable to start server");
+        let mut started = false;
+        for _ in 0..MAX_HEALTHCHECK_ATTEMPS {
+            let status = create_lldap_command()
+                .arg("healthcheck")
+                .status()
+                .expect("healthcheck fail");
+            if status.success() {
+                started = true;
+                break;
+            }
+            thread::sleep(Duration::from_millis(1000));
+        }
+        assert!(started);
+        let client = ClientBuilder::new()
+            .connect_timeout(std::time::Duration::from_secs(2))
+            .timeout(std::time::Duration::from_secs(5))
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .expect("failed to make http client");
+        let token = get_token(&client);
+        Self {
+            client,
+            token,
+            child,
+            users: HashSet::new(),
+            groups: HashMap::new(),
+        }
+    }
+
+    pub fn load_state(&mut self, state: &Vec<User>) {
+        let mut users: HashSet<String> = HashSet::new();
+        let mut groups: HashSet<String> = HashSet::new();
+        for user in state {
+            users.insert(user.username.clone());
+            groups.extend(user.groups.clone());
+        }
+        for user in &users {
+            self.add_user(user);
+        }
+        for group in &groups {
+            self.add_group(group);
+        }
+        for User { username, groups } in state {
+            for group in groups {
+                self.add_user_to_group(username, group);
+            }
+        }
+    }
+
+    fn add_user(&mut self, user: &String) {
+        post::<CreateUser>(
+            &self.client,
+            &self.token,
+            create_user::Variables {
+                user: create_user::CreateUserInput {
+                    id: user.clone(),
+                    email: format!("{}@lldap.test", user),
+                    avatar: None,
+                    display_name: None,
+                    first_name: None,
+                    last_name: None,
+                },
+            },
+        )
+        .expect("failed to add user");
+        self.users.insert(user.clone());
+    }
+
+    fn add_group(&mut self, group: &str) {
+        let id = post::<CreateGroup>(
+            &self.client,
+            &self.token,
+            create_group::Variables {
+                name: group.to_owned(),
+            },
+        )
+        .expect("failed to add group")
+        .create_group
+        .id;
+        self.groups.insert(group.to_owned(), id);
+    }
+
+    fn delete_user(&mut self, user: &String) {
+        post::<DeleteUserQuery>(
+            &self.client,
+            &self.token,
+            delete_user_query::Variables { user: user.clone() },
+        )
+        .expect("failed to delete user");
+        self.users.remove(user);
+    }
+
+    fn delete_group(&mut self, group: &String) {
+        let group_id = self.groups.get(group).unwrap();
+        post::<DeleteGroupQuery>(
+            &self.client,
+            &self.token,
+            delete_group_query::Variables {
+                group_id: *group_id,
+            },
+        )
+        .expect("failed to delete group");
+        self.groups.remove(group);
+    }
+
+    fn add_user_to_group(&mut self, user: &str, group: &String) {
+        let group_id = self.groups.get(group).unwrap();
+        post::<AddUserToGroup>(
+            &self.client,
+            &self.token,
+            add_user_to_group::Variables {
+                user: user.to_owned(),
+                group: *group_id,
+            },
+        )
+        .expect("failed to add user to group");
+    }
+}
+
+impl Drop for LLDAPFixture {
+    fn drop(&mut self) {
+        let users = self.users.clone();
+        for user in users {
+            self.delete_user(&user);
+        }
+        let groups = self.groups.clone();
+        for group in groups.keys() {
+            self.delete_group(group);
+        }
+        let result = signal::kill(
+            Pid::from_raw(self.child.id().try_into().unwrap()),
+            Signal::SIGTERM,
+        );
+        if let Err(err) = result {
+            println!("Failed to send kill signal: {:?}", err);
+            let _ = self
+                .child
+                .kill()
+                .map_err(|err| println!("Failed to kill LLDAP: {:?}", err));
+            return;
+        }
+
+        for _ in 0..10 {
+            let status = self.child.try_wait();
+            if status.is_err() {}
+            match status {
+                Err(e) => {
+                    println!(
+                        "Failed to get status while waiting for graceful exit: {}",
+                        e
+                    );
+                    break;
+                }
+                Ok(None) => {
+                    println!("LLDAP still running, sleeping for 1 second.");
+                }
+                Ok(Some(status)) => {
+                    if !status.success() {
+                        println!("LLDAP exited with status {}", status)
+                    }
+                    return;
+                }
+            }
+            thread::sleep(Duration::from_millis(1000));
+        }
+        println!("LLDAP alive after 10 seconds, forcing exit.");
+        let _ = self
+            .child
+            .kill()
+            .map_err(|err| println!("Failed to kill LLDAP: {:?}", err));
+    }
+}
+
+pub fn new_id(prefix: Option<&str>) -> String {
+    let id = Uuid::new_v4();
+    let id = format!("{}-lldap-test", id.simple());
+    match prefix {
+        Some(prefix) => format!("{}{}", prefix, id),
+        None => id,
+    }
+}
+
+fn create_lldap_command() -> Command {
+    let mut cmd = Command::cargo_bin(env!("CARGO_PKG_NAME")).expect("cargo bin not found");
+    // This gives us the absolute path of the repo base instead of running it in server/
+    let path = canonicalize("..").expect("canonical path");
+    let db_url = env::database_url();
+    cmd.current_dir(path);
+    cmd.env(env::DB_KEY, db_url);
+    cmd
+}
--- a/server/tests/common/graphql.rs
+++ b/server/tests/common/graphql.rs
@@ -0,0 +1,121 @@
+use crate::common::env;
+use anyhow::{anyhow, Context, Result};
+use graphql_client::GraphQLQuery;
+use reqwest::blocking::Client;
+
+pub type DateTimeUtc = chrono::DateTime<chrono::Utc>;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/add_user_to_group.graphql",
+    response_derives = "Debug",
+    variables_derives = "Debug,Clone",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct AddUserToGroup;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/create_user.graphql",
+    response_derives = "Debug",
+    variables_derives = "Debug,Clone",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct CreateUser;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/create_group.graphql",
+    response_derives = "Debug",
+    variables_derives = "Debug,Clone",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct CreateGroup;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/list_users.graphql",
+    response_derives = "Debug",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct ListUsers;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/get_user_details.graphql",
+    response_derives = "Debug",
+    variables_derives = "Debug,Clone",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct GetUserDetails;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/list_groups.graphql",
+    response_derives = "Debug",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct ListGroups;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/delete_group.graphql",
+    response_derives = "Debug",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct DeleteGroupQuery;
+
+#[derive(GraphQLQuery)]
+#[graphql(
+    schema_path = "../schema.graphql",
+    query_path = "tests/queries/delete_user.graphql",
+    response_derives = "Debug",
+    custom_scalars_module = "crate::common::graphql"
+)]
+pub struct DeleteUserQuery;
+
+pub fn post<QueryType>(
+    client: &Client,
+    token: &String,
+    variables: QueryType::Variables,
+) -> Result<QueryType::ResponseData>
+where
+    QueryType: GraphQLQuery + 'static,
+{
+    let unwrap_graphql_response = |graphql_client::Response { data, errors, .. }| {
+        data.ok_or_else(|| {
+            anyhow!(
+                "Errors: [{}]",
+                errors
+                    .unwrap_or_default()
+                    .iter()
+                    .map(ToString::to_string)
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            )
+        })
+    };
+    let url = env::http_url() + "/api/graphql";
+    let auth_header = format!("Bearer {}", token);
+    client
+        .post(url)
+        .header(reqwest::header::AUTHORIZATION, auth_header)
+        // Request body.
+        .json(&QueryType::build_query(variables))
+        .send()
+        .context("while sending a request to the LLDAP server")?
+        .error_for_status()
+        .context("error from an LLDAP response")?
+        // Parse response as Json.
+        .json::<graphql_client::Response<QueryType::ResponseData>>()
+        .context("while parsing backend response")
+        .and_then(unwrap_graphql_response)
+        .context("GraphQL error from an LLDAP response")
+}
--- a/server/tests/common/mod.rs
+++ b/server/tests/common/mod.rs
@@ -0,0 +1,4 @@
+pub mod auth;
+pub mod env;
+pub mod fixture;
+pub mod graphql;
--- a/server/tests/graphql.rs
+++ b/server/tests/graphql.rs
@@ -0,0 +1,70 @@
+use crate::common::{
+    auth::get_token,
+    env,
+    fixture::{new_id, LLDAPFixture, User},
+    graphql::{get_user_details, list_users, post, GetUserDetails, ListUsers},
+};
+use reqwest::blocking::ClientBuilder;
+use serial_test::file_serial;
+use std::collections::HashSet;
+mod common;
+
+#[test]
+#[file_serial]
+fn list_users() {
+    let mut fixture = LLDAPFixture::new();
+    let prefix = "graphql-list_users-";
+    let user1_name = new_id(Some(prefix));
+    let user2_name = new_id(Some(prefix));
+    let user3_name = new_id(Some(prefix));
+    let group1_name = new_id(Some(prefix));
+    let group2_name = new_id(Some(prefix));
+    let initial_state = vec![
+        User::new(&user1_name, vec![&group1_name]),
+        User::new(&user2_name, vec![&group1_name, &group2_name]),
+        User::new(&user3_name, vec![]),
+    ];
+    fixture.load_state(&initial_state);
+
+    let client = ClientBuilder::new()
+        .connect_timeout(std::time::Duration::from_secs(2))
+        .timeout(std::time::Duration::from_secs(5))
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .expect("failed to make http client");
+    let token = get_token(&client);
+    let result =
+        post::<ListUsers>(&client, &token, list_users::Variables {}).expect("failed to list users");
+    let users: HashSet<String> = result.users.iter().map(|user| user.id.clone()).collect();
+    assert!(users.contains(&user1_name));
+    assert!(users.contains(&user2_name));
+    assert!(users.contains(&user3_name));
+}
+
+#[test]
+#[file_serial]
+fn get_admin() {
+    let mut _fixture = LLDAPFixture::new();
+    let client = ClientBuilder::new()
+        .connect_timeout(std::time::Duration::from_secs(2))
+        .timeout(std::time::Duration::from_secs(5))
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .expect("failed to make http client");
+    let admin_name = env::admin_dn();
+    let admin_group_name = "lldap_admin";
+    let token = get_token(&client);
+    let result = post::<GetUserDetails>(
+        &client,
+        &token,
+        get_user_details::Variables { id: admin_name },
+    )
+    .expect("failed to get admin");
+    let admin_groups: HashSet<String> = result
+        .user
+        .groups
+        .iter()
+        .map(|group| group.display_name.clone())
+        .collect();
+    assert!(admin_groups.contains(admin_group_name));
+}
--- a/server/tests/integrations.rs
+++ b/server/tests/integrations.rs
@@ -0,0 +1,57 @@
+use std::collections::HashSet;
+
+use crate::common::{
+    env,
+    fixture::{new_id, LLDAPFixture, User},
+};
+use ldap3::{LdapConn, Scope, SearchEntry};
+use serial_test::file_serial;
+mod common;
+
+#[test]
+#[file_serial]
+fn gitea() {
+    let mut fixture = LLDAPFixture::new();
+    let gitea_user_group = new_id(Some("gitea_user-"));
+    let gitea_admin_group = new_id(Some("gitea_admin-"));
+    let gitea_user1 = new_id(Some("gitea1-"));
+    let gitea_user2 = new_id(Some("gitea2-"));
+    let gitea_user3 = new_id(Some("gitea3-"));
+    let initial_state = vec![
+        User::new(&gitea_user1, vec![&gitea_user_group, &gitea_admin_group]),
+        User::new(&gitea_user2, vec![&gitea_user_group]),
+        User::new(&gitea_user3, vec![]),
+    ];
+    fixture.load_state(&initial_state);
+
+    let mut ldap =
+        LdapConn::new(env::ldap_url().as_str()).expect("failed to create ldap connection");
+    let base_dn = env::base_dn();
+    let bind_dn = format!("uid={},ou=people,{}", env::admin_dn(), base_dn);
+    ldap.simple_bind(bind_dn.as_str(), env::admin_password().as_str())
+        .expect("failed to bind to ldap");
+
+    let user_base = format!("ou=people,{}", base_dn);
+    let attrs = vec!["uid", "givenName", "sn", "mail", "jpegPhoto"];
+    let results = ldap
+        .search(
+            user_base.as_str(),
+            Scope::Subtree,
+            format!("(memberof=cn={},ou=groups,{})", gitea_user_group, base_dn).as_str(),
+            attrs,
+        )
+        .expect("failed to find gitea users")
+        .success()
+        .expect("failed to get gitea user results")
+        .0;
+    let mut found_users: HashSet<String> = HashSet::new();
+    for result in results {
+        let attrs = SearchEntry::construct(result).attrs;
+        let user = attrs.get("uid").unwrap().get(0).unwrap();
+        found_users.insert(user.clone());
+    }
+    assert!(found_users.contains(&gitea_user1));
+    assert!(found_users.contains(&gitea_user2));
+    assert!(!found_users.contains(&gitea_user3));
+    ldap.unbind().expect("failed to unbind ldap connection");
+}
--- a/server/tests/ldap.rs
+++ b/server/tests/ldap.rs
@@ -0,0 +1,112 @@
+use std::collections::{HashMap, HashSet};
+
+use crate::common::{
+    env,
+    fixture::{new_id, LLDAPFixture, User},
+};
+use ldap3::{LdapConn, Scope, SearchEntry, SearchResult};
+use serial_test::file_serial;
+mod common;
+
+#[test]
+#[file_serial]
+fn basic_users_search() {
+    let mut fixture = LLDAPFixture::new();
+    let prefix = "ldap-basic_users_search-";
+    let user1_name = new_id(Some(prefix));
+    let user2_name = new_id(Some(prefix));
+    let user3_name = new_id(Some(prefix));
+    let group1_name = new_id(Some(prefix));
+    let group2_name = new_id(Some(prefix));
+    let initial_state = vec![
+        User::new(&user1_name, vec![&group1_name]),
+        User::new(&user2_name, vec![&group1_name, &group2_name]),
+        User::new(&user3_name, vec![]),
+    ];
+    fixture.load_state(&initial_state);
+
+    let mut ldap =
+        LdapConn::new(env::ldap_url().as_str()).expect("failed to create ldap connection");
+    let base_dn = env::base_dn();
+    let bind_dn = format!("uid={},ou=people,{}", env::admin_dn(), base_dn);
+    ldap.simple_bind(bind_dn.as_str(), env::admin_password().as_str())
+        .expect("failed to bind to ldap");
+
+    let attrs = vec!["uid", "memberof"];
+    let found_users = get_users_and_groups(
+        ldap.search(
+            env::base_dn().as_str(),
+            Scope::Subtree,
+            "(objectclass=person)",
+            attrs,
+        )
+        .expect("failed to find users"),
+    );
+    assert!(found_users.contains_key(&user1_name));
+    assert!(found_users
+        .get(&user1_name)
+        .unwrap()
+        .contains(format!("cn={},ou=groups,{}", &group1_name, base_dn).as_str()));
+    assert!(found_users.contains_key(&user2_name));
+    assert!(found_users
+        .get(&user2_name)
+        .unwrap()
+        .contains(format!("cn={},ou=groups,{}", &group1_name, base_dn).as_str()));
+    assert!(found_users
+        .get(&user2_name)
+        .unwrap()
+        .contains(format!("cn={},ou=groups,{}", &group2_name, base_dn).as_str()));
+    assert!(found_users.contains_key(&user3_name));
+    assert!(found_users.get(&user3_name).unwrap().is_empty());
+    ldap.unbind().expect("failed to unbind ldap connection");
+}
+
+#[test]
+#[file_serial]
+fn admin_search() {
+    let mut _fixture = LLDAPFixture::new();
+
+    let mut ldap =
+        LdapConn::new(env::ldap_url().as_str()).expect("failed to create ldap connection");
+    let base_dn = env::base_dn();
+    let bind_dn = format!("uid={},ou=people,{}", env::admin_dn(), base_dn);
+    ldap.simple_bind(bind_dn.as_str(), env::admin_password().as_str())
+        .expect("failed to bind to ldap");
+
+    let attrs = vec!["uid", "memberof"];
+    let admin_name = env::admin_dn();
+    let admin_group_name = "lldap_admin";
+    let found_users = get_users_and_groups(
+        ldap.search(
+            env::base_dn().as_str(),
+            Scope::Subtree,
+            format!("(&(objectclass=person)(uid={}))", admin_name).as_str(),
+            attrs,
+        )
+        .expect("failed to find admin"),
+    );
+
+    assert!(found_users.contains_key(&admin_name));
+    assert!(found_users
+        .get(&admin_name)
+        .unwrap()
+        .contains(format!("cn={},ou=groups,{}", admin_group_name, base_dn).as_str()));
+    ldap.unbind().expect("failed to unbind ldap connection");
+}
+
+fn get_users_and_groups(results: SearchResult) -> HashMap<String, HashSet<String>> {
+    let results = results
+        .success()
+        .expect("failed to get successful result")
+        .0;
+    let mut found_users: HashMap<String, HashSet<String>> = HashMap::new();
+    for result in results {
+        let attrs = SearchEntry::construct(result).attrs;
+        let user = attrs.get("uid").unwrap().get(0).unwrap();
+        let user_groups = attrs.get("memberof").unwrap().clone();
+        let mut groups: HashSet<String> = HashSet::new();
+        groups.extend(user_groups.clone());
+        found_users.insert(user.clone(), groups);
+    }
+    found_users
+}
--- a/server/tests/queries/add_user_to_group.graphql
+++ b/server/tests/queries/add_user_to_group.graphql
@@ -0,0 +1,5 @@
+mutation AddUserToGroup($user: String!, $group: Int!) {
+  addUserToGroup(userId: $user, groupId: $group) {
+    ok
+  }
+}
--- a/server/tests/queries/create_group.graphql
+++ b/server/tests/queries/create_group.graphql
@@ -0,0 +1,6 @@
+mutation CreateGroup($name: String!) {
+  createGroup(name: $name) {
+    id
+    displayName
+  }
+}
--- a/server/tests/queries/create_user.graphql
+++ b/server/tests/queries/create_user.graphql
@@ -0,0 +1,5 @@
+mutation CreateUser($user: CreateUserInput!) {
+  createUser(user: $user) {
+    id
+  }
+}
--- a/server/tests/queries/delete_group.graphql
+++ b/server/tests/queries/delete_group.graphql
@@ -0,0 +1,5 @@
+mutation DeleteGroupQuery($groupId: Int!) {
+  deleteGroup(groupId: $groupId) {
+    ok
+  }
+}
--- a/server/tests/queries/delete_user.graphql
+++ b/server/tests/queries/delete_user.graphql
@@ -0,0 +1,5 @@
+mutation DeleteUserQuery($user: String!) {
+  deleteUser(userId: $user) {
+    ok
+  }
+}
--- a/server/tests/queries/get_user_details.graphql
+++ b/server/tests/queries/get_user_details.graphql
@@ -0,0 +1,16 @@
+query GetUserDetails($id: String!) {
+  user(userId: $id) {
+    id
+    email
+    displayName
+    firstName
+    lastName
+    avatar
+    creationDate
+    uuid
+    groups {
+      id
+      displayName
+    }
+  }
+}
--- a/server/tests/queries/list_groups.graphql
+++ b/server/tests/queries/list_groups.graphql
@@ -0,0 +1,9 @@
+query ListGroups {
+  groups {
+    id
+    displayName
+    users {
+      id
+    }
+  }
+}
--- a/server/tests/queries/list_users.graphql
+++ b/server/tests/queries/list_users.graphql
@@ -0,0 +1,5 @@
+query ListUsers {
+  users(filters: null) {
+    id
+  }
+}
--- a/set-password/Cargo.toml
+++ b/set-password/Cargo.toml
@@ -1,12 +1,17 @@
 [package]
-name = "lldap_set_password"
-version = "0.1.0"
+authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
+description = "CLI tool to set a user password in LLDAP"
 edition = "2021"
+homepage = "https://github.com/lldap/lldap"
+license = "GPL-3.0-only"
+name = "lldap_set_password"
+repository = "https://github.com/lldap/lldap"
+version = "0.1.0"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
-anyhow = "*"
+anyhow = "1"
 rand = "0.8"
 serde = "1"
 serde_json = "1"
@@ -16,10 +21,10 @@ features = ["std", "color", "suggestions", "derive", "env"]
 version = "4"

 [dependencies.lldap_auth]
-path = "../auth"
+version = "0.3"
 features = ["opaque_client"]

 [dependencies.reqwest]
-version = "*"
+version = "0.11"
 default-features = false
 features = ["json", "blocking", "rustls-tls"]
Author	SHA1	Message	Date
Dedy Martadinata S	1b2dfbe52e	Publish job using matrix Change publish job with matrix, don't fail if another job fail.	2023-05-12 20:41:35 +07:00
Valentin Tolmer	e1aa2bfb18	cargo: depend on the published version of lldap_auth	2023-05-12 15:37:39 +02:00
Valentin Tolmer	1377d5aed9	github: create actions to publish crates	2023-05-12 15:25:59 +02:00
Valentin Tolmer	fa0185af5e	cargo: set specific versions for each dependency	2023-05-12 15:25:59 +02:00
nitnelave	d720a7812a	cargo: set metadata for publishing crates (#577 )	2023-05-12 18:06:06 +07:00
nitnelave	d2dec56cca	readme: add buymeacoffee link	2023-05-12 16:21:09 +09:00
poVoq	ab2da7b975	example_configs: Add Ejabberd Basic auth only for now	2023-05-09 14:31:54 +02:00
Anudeep	8f69e4badd	example_configs: add chmod to home-assistant instructions	2023-05-06 07:08:41 +02:00
Valentin Tolmer	5bd00f24a2	docker: ignore more files	2023-05-02 16:15:54 +02:00
Valentin Tolmer	ab9ee8d962	tests: allow dead code in common module We're running afoul of https://github.com/rust-lang/rust/issues/46379, where each test is compiled independently, so any test that doesn't use every helper method triggers a dead code warning.	2023-05-02 16:15:54 +02:00
lordratner	852e1586e7	example_configs: Fix a filter in Grafana	2023-05-02 15:45:04 +02:00
Herwig Hochleitner	23b388f3b8	docs: correct env var names in docker template toml	2023-05-02 15:40:16 +02:00
Hobbabobba	22ae2c7124	example_configs: fix zendto memberrole	2023-04-25 20:53:38 +02:00
lordratner	5ad63d31d3	example_docs: add pfsense.md	2023-04-20 18:10:14 +02:00
Tyler Pace	d55d4487ed	Add OPNsense example config. (#558 ) * Add OPNsense example config. --------- Co-authored-by: Tyler Pace <tpace@newrelic.com>	2023-04-15 10:06:34 +07:00
Austin Alvarado	4283d27da6	server: Initial stab at e2e tests (#534 ) Initial end to end testing. generates unique names for user and groups, and all tests run serially	2023-04-14 11:45:15 -06:00
Valentin Tolmer	4576cf9f2c	bump: bump the version to 0.5-alpha, since we have a breaking change	2023-04-14 17:36:04 +02:00
Valentin Tolmer	d1d5d38b32	server: fix incorrect logging	2023-04-14 17:02:00 +02:00
Valentin Tolmer	e5ce98c874	server: Improve the error message in case of duplicate emails	2023-04-14 17:02:00 +02:00
Valentin Tolmer	96b7dbb1c5	server: Make key_seed a secret value	2023-04-14 00:07:54 +02:00
dependabot[bot]	9408b12bc7	build(deps): bump actions/checkout from 3.5.1 to 3.5.2 Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.1 to 3.5.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v3.5.1...v3.5.2) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-04-13 23:18:22 +02:00
Valentin Tolmer	4e85a4718f	server: enforce email and uuid unicity	2023-04-13 17:51:49 +02:00
Valentin Tolmer	d1f1eb8e80	config: Explicit the env variables	2023-04-13 09:22:09 +02:00
Valentin Tolmer	da364746c4	server: Derive the server key from a seed Fixes #504.	2023-04-13 09:17:05 +02:00
dependabot[bot]	d672f68049	build(deps): bump actions/checkout from 3.5.0 to 3.5.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v3.5.0...v3.5.1) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-04-13 09:03:27 +02:00
Valentin Tolmer	dcca768b6c	github: Add more folders to ignore for coverage	2023-04-11 17:17:28 +02:00
Valentin Tolmer	ea69b4bead	version: bump to 0.4.4-alpha	2023-04-11 17:17:28 +02:00
Valentin Tolmer	7b4188a376	cargo: update cargo.lock	2023-04-11 17:17:28 +02:00
Valentin Tolmer	252132430c	github: always generate artifacts for a release	2023-04-11 15:01:41 +02:00
Valentin Tolmer	7f9bc95c5c	release: 0.4.3	2023-04-11 14:41:57 +02:00
Valentin Tolmer	69fca82a86	readme: fix the codecov badge	2023-04-11 14:12:17 +02:00
Valentin Tolmer	9a30cac7b0	healthcheck: check that the server's certificate is the one in the config	2023-04-11 13:51:02 +02:00
Michał Mrozek	558bb37354	server: add support for ec private keys	2023-04-11 10:57:25 +02:00
Dedy Martadinata S	5b74852193	github: Leverage metadata (#532 )	2023-04-11 11:03:56 +07:00
Valentin Tolmer	d18cf1ac37	server: decode graphql parameter	2023-04-10 19:10:42 +02:00
Valentin Tolmer	96f55ff28e	github: use codecov token only for main push, no token for PRs	2023-04-10 17:29:36 +02:00
Dedy Martadinata S	825f37d360	github: add healthcheck to the test DB services	2023-04-10 17:09:54 +02:00
Austin Alvarado	8eb27c5267	docs: Create Home Assistant config (#535 )	2023-04-07 14:59:21 -06:00
budimanjojo	18d9dd6ff9	github: also push to ghcr.io and add docker.io/lldap/lldap	2023-04-05 17:51:23 +02:00
Austin Alvarado	308521c632	Use jq in CI to extract json deterministically (#529 ) cut relies on the string being a fixed length, which is subject to change in the future	2023-04-05 22:20:15 +07:00
Valentin Tolmer	86b2b5148d	server: remove default value for SMTP user Otherwise, not setting the user would default to "admin", which breaks the unauthenticated workflow. No user specified should mean unauthenticated. Fixes #520.	2023-04-04 16:27:44 +02:00
Valentin Tolmer	b9e0e4a6dc	version: bump cargo.lock	2023-04-04 16:27:44 +02:00
nitnelave	1b8849ead1	version: bump to 0.4.3-alpha (#522 )	2023-04-04 13:00:17 +02:00
amiga23	1fe635384f	docs: Add email attribute to nextcloud config Otherwise nextcloud will not set the email address in users profile	2023-04-04 12:14:41 +02:00
Hobbabobba	df16d66753	added Shaarli configuration example (#519 ) * Create shaarli.md * added Shaarli doc * fixed uid	2023-04-03 18:54:39 +02:00
nitnelave	65e2c24928	github: Add CODEOWNERS	2023-03-31 10:42:53 +02:00
Austin Alvarado	c4b8621e2a	app: Fix password reset redirection (#513 ) * Fix password reset redirection * Add password reset enable flag	2023-03-30 09:47:41 -06:00
Valentin Tolmer	88a9f8a97b	github: fix github_ref reference	2023-03-28 20:59:38 +02:00
Valentin Tolmer	fc91d59b99	github: Don't skip rebuilding a docker image on main because it was built on a branch	2023-03-28 19:34:43 +02:00
Valentin Tolmer	aad4711056	app: server uncompressed WASM to webkit browsers	2023-03-28 17:33:13 +02:00
Dedy Martadinata S	c7c6d95334	docker: Add DB migration tests in the CI	2023-03-28 13:59:23 +02:00
Valentin Tolmer	84b4c66309	cargo: Update Cargo.lock with latest release	2023-03-28 12:10:04 +02:00
Valentin Tolmer	923d77072b	gitattributes: Tag folders as docs, generated or ignored for linguist	2023-03-28 12:10:04 +02:00
Austin Alvarado	758aa7f7f7	docs: Fix md links	2023-03-27 18:08:27 +02:00
Valentin Tolmer	866a74fa29	github: Reduce actions trigger on metadata updates	2023-03-27 16:52:34 +02:00
Valentin Tolmer	36a51070b3	docker: ignore README	2023-03-27 16:52:34 +02:00
Valentin Tolmer	585b65e11d	README: Add details about other DBs, migrations	2023-03-27 14:12:00 +02:00
Valentin Tolmer	2c8fe2a481	Revert "workflows: allow action to upload artifacts" This reverts commit `1b67bad270`.	2023-03-27 13:53:21 +02:00
Valentin Tolmer	1b67bad270	workflows: allow action to upload artifacts	2023-03-27 12:45:11 +02:00