LLDAP - Lightweight LDAP Identity Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

LLDAP (Light LDAP) is a lightweight, self-hosted authentication server that speaks LDAP and ships with a friendly web admin UI for managing users and groups. It is an opinionated, easy alternative to OpenLDAP or Active Directory for small and mid-size self-hosted deployments, acting as a single identity backbone for the many applications that already speak LDAP - Nextcloud, Gitea, Grafana, Jellyfin, Portainer and more. This AMI delivers LLDAP fully installed, hardened and running so you have a working identity backend within minutes of launch.

The upstream LLDAP project has earned over 4,000 stars on GitHub, reflecting strong community trust in its design and reliability.

## Why This Image vs a Manual Install

This image eliminates the manual binary installation, systemd unit authoring, reverse-proxy and TLS setup, and credential hardening a manual install requires. LLDAP's own examples ship with well-known placeholder secrets (admin password, JWT secret and key seed); this image never keeps them. Everything that would otherwise take several steps across download, service configuration and security hardening is completed for you at image build time. Launch the instance, read your unique credential, and start creating users and groups.

## Application Stack

LLDAP is a single self-contained Rust binary with an embedded SQLite datastore. It serves an LDAP endpoint for downstream services and a web admin UI for managing users and groups. The web admin UI is bound to the loopback interface only and is fronted by an nginx reverse proxy that terminates TLS on port 443; the raw web port is never exposed off-box. systemd starts LLDAP and nginx on boot and restarts them on failure. The SQLite datastore lives on a dedicated data volume, independently resizable and separate from the OS disk.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the web admin UI binds exclusively to the loopback interface; only the nginx TLS reverse proxy on port 443 is exposed
• TLS by default: a unique self-signed certificate is generated on each instance's first boot; the web admin UI is only served over HTTPS
• No default or shared credentials: a cryptographically random administrator password, JWT signing secret and key seed are generated on each instance's first boot and written only to a root-only file
• No anonymous LDAP: the LDAP endpoint requires bind credentials, so a network probe cannot dump the directory
• Least privilege: the server runs as an unprivileged system user with NoNewPrivileges, ProtectSystem and ProtectHome set
• Dedicated data volume: the directory database lives on its own disk, surviving OS-disk changes and resizable independently

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Single sign-on backbone for a self-hosted stack: point Nextcloud, Gitea, Grafana and Jellyfin at one LDAP directory so users have a single set of credentials across every app
• Team and group management: model teams as LDAP groups in the web UI and drive per-app authorization from group membership without editing config files
• Lightweight directory for homelabs and small businesses: run a real LDAP identity server without the operational weight of OpenLDAP or a Windows domain controller

## AWS Integration

Deploy on any EC2 instance type. Back up the directory database using EBS snapshots or AWS Backup. Resize the dedicated data volume independently of the OS disk as your directory grows. The security group opens the LDAP port for downstream services within your VPC and port 443 for the web admin UI.

## Getting Started

Read your credential from the root-only file, open the web admin UI over HTTPS, sign in, and start creating users and groups. Point your applications at the LDAP endpoint using the admin bind DN, or create a dedicated read-only service account in the UI. For integration planning or a guided pilot setup, contact cloudimg support at any time.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, connecting downstream applications over LDAP, TLS termination with your own domain and certificate, user and group modelling, and backup planning for your directory database.