radiuscontroller/Dockerfile

@@ -34,10 +34,10 @@ FROM base AS final
 WORKDIR /app
 
 # Copy pre-configured FreeRADIUS PostgreSQL rules & EAP authentication config
-COPY raddb/clients.conf /etc/freeradius/3.0/clients.conf
+COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
-COPY raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
+COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
-COPY raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
+COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
-COPY raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
+COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
 
 # Copy published application and entrypoint script
 COPY --from=publish /app/publish .

radiuscontroller/raddb/clients.conf

@@ -0,0 +1,11 @@
+client localhost {
+	ipaddr = 127.0.0.1
+	secret = testing123
+	shortname = localhost
+}
+
+client local_net {
+	ipaddr = 0.0.0.0/0
+	secret = radpass
+	shortname = all_clients
+}

radiuscontroller/raddb/mods-enabled/sql

@@ -0,0 +1,30 @@
+sql {
+	driver = "rlm_sql_postgresql"
+	dialect = "postgresql"
+
+	server = "postgres"
+	port = 5432
+	login = "radius"
+	password = "radpass"
+	radius_db = "radius"
+
+	read_clients = yes
+	client_table = "nas"
+
+	group_attribute = "User-Group"
+
+	pool {
+		start = 2
+		min = 1
+		max = 10
+		spare = 3
+		uses = 0
+		retry_delay = 30
+		lifetime = 0
+		idle_timeout = 60
+	}
+
+	read_groups = yes
+
+	$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
+}

radiuscontroller/raddb/sites-enabled/default

@@ -0,0 +1,78 @@
+server default {
+listen {
+	type = auth
+	ipaddr = *
+	port = 1812
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+
+listen {
+	type = acct
+	ipaddr = *
+	port = 1813
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+
+authorize {
+	filter_username
+	preprocess
+	chap
+	mschap
+	digest
+	pap
+	eap {
+		ok = return
+	}
+	sql
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+pre-proxy {
+}
+
+post-proxy {
+	eap
+}
+
+accounting {
+	detail
+	sql
+	exec
+}
+
+session {
+	sql
+}
+
+post-auth {
+	sql
+	exec
+	Post-Auth-Type REJECT {
+		sql
+		attr_filter.access_reject
+	}
+}
+}

radiuscontroller/raddb/sites-enabled/inner-tunnel

@@ -0,0 +1,36 @@
+server inner-tunnel {
+authorize {
+	filter_username
+	chap
+	mschap
+	pap
+	eap {
+		ok = return
+	}
+	sql
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+post-auth {
+	sql
+	Post-Auth-Type REJECT {
+		sql
+		attr_filter.access_reject
+	}
+}
+}