fix ldap

install.sh

@@ -948,6 +948,14 @@ persist_domain_env() {
   env_set MINIO_PUBLIC_ENDPOINT "${MINIO_PUBLIC_ENDPOINT:-localhost:9000}"
   env_set MINIO_USE_SSL "${MINIO_USE_SSL:-false}"
 
+  if [[ "$(env_get INSTALL_MODE local)" == "intranet" && -z "$(env_get LDAP_USE_HOST_NETWORK "")" ]]; then
+    env_set LDAP_USE_HOST_NETWORK "true"
+  fi
+  env_set LDAP_USE_HOST_NETWORK "$(env_get LDAP_USE_HOST_NETWORK false)"
+  env_set LDAP_DNS_SERVERS "$(env_get LDAP_DNS_SERVERS "")"
+  env_set LDAP_DNS_SEARCH "$(env_get LDAP_DNS_SEARCH "")"
+  env_set LDAP_EXTRA_HOSTS "$(env_get LDAP_EXTRA_HOSTS "")"
+
   ok "Файл .env обновлён"
 }
 
@@ -955,34 +963,94 @@ write_compose_override() {
   resolve_nginx_mode_and_ports
   load_env
   local mode="${NGINX_MODE:-$(env_get NGINX_MODE host)}"
-  local has_domains
+  local has_domains install_mode
   has_domains="$(env_get DOMAIN_API "")"
+  install_mode="$(env_get INSTALL_MODE local)"
 
-  if [[ -z "$has_domains" || "$(env_get INSTALL_MODE local)" == "local" ]]; then
-    [[ -f "$COMPOSE_OVERRIDE" ]] && rm -f "$COMPOSE_OVERRIDE"
-    return
-  fi
+  local nginx_fragment="" ldap_fragment="" body=""
 
-  log "Настройка docker-compose override (Nginx: ${mode})..."
-
-  # Порты edge-сервисов и MinIO (127.0.0.1) заданы в docker-compose.yml.
-  # Override только добавляет Docker Nginx при NGINX_MODE=docker.
-
-  if [[ "$mode" == "docker" ]]; then
+  if [[ -n "$has_domains" && "$install_mode" != "local" && "$mode" == "docker" ]]; then
     local http_port https_port
     http_port="$(env_get NGINX_HTTP_PORT 80)"
     https_port="$(env_get NGINX_HTTPS_PORT 443)"
-    cat >"$COMPOSE_OVERRIDE" <<EOF
-services:
+    log "Настройка docker-compose override (Nginx: ${mode})..."
+    nginx_fragment="$(cat <<EOF
   nginx:
     ports:
       - "${http_port}:80"
       - "${https_port}:443"
 EOF
-  else
-    # host Nginx — override не нужен; удаляем старый (мог содержать ports: !reset [])
-    [[ -f "$COMPOSE_OVERRIDE" ]] && rm -f "$COMPOSE_OVERRIDE"
+)"
   fi
+
+  ldap_fragment="$(build_ldap_compose_fragment)"
+  [[ -n "$ldap_fragment" ]] && log "Настройка docker-compose override (LDAP DNS / host network)..."
+
+  body="${nginx_fragment}${ldap_fragment}"
+  if [[ -z "$body" ]]; then
+    [[ -f "$COMPOSE_OVERRIDE" ]] && rm -f "$COMPOSE_OVERRIDE"
+    return
+  fi
+
+  cat >"$COMPOSE_OVERRIDE" <<EOF
+services:
+${body}
+EOF
+}
+
+build_ldap_compose_fragment() {
+  load_env
+  local use_host dns_servers dns_search extra_hosts
+  use_host="$(env_get LDAP_USE_HOST_NETWORK false)"
+  dns_servers="$(env_get LDAP_DNS_SERVERS "")"
+  dns_search="$(env_get LDAP_DNS_SEARCH "")"
+  extra_hosts="$(env_get LDAP_EXTRA_HOSTS "")"
+
+  [[ "$use_host" == "true" || -n "$dns_servers" || -n "$extra_hosts" ]] || return 0
+
+  if [[ "$use_host" == "true" ]]; then
+    cat <<'EOF'
+
+  ldap-auth:
+    network_mode: host
+  sso-core:
+    environment:
+      LDAP_AUTH_URL: http://host.docker.internal:8086
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+EOF
+    return 0
+  fi
+
+  local fragment=$'\n  ldap-auth:'
+  if [[ -n "$dns_servers" ]]; then
+    fragment+=$'\n    dns:'
+    local server
+    IFS=',' read -ra _dns <<< "$dns_servers"
+    for server in "${_dns[@]}"; do
+      server="$(echo "$server" | xargs)"
+      [[ -n "$server" ]] && fragment+=$'\n      - "'"${server}"'"'
+    done
+  fi
+  if [[ -n "$dns_search" ]]; then
+    fragment+=$'\n    dns_search:'
+    local zone
+    IFS=',' read -ra _zones <<< "$dns_search"
+    for zone in "${_zones[@]}"; do
+      zone="$(echo "$zone" | xargs)"
+      [[ -n "$zone" ]] && fragment+=$'\n      - "'"${zone}"'"'
+    done
+  fi
+  if [[ -n "$extra_hosts" ]]; then
+    fragment+=$'\n    extra_hosts:'
+    local host_entry
+    IFS=',' read -ra _hosts <<< "$extra_hosts"
+    for host_entry in "${_hosts[@]}"; do
+      host_entry="$(echo "$host_entry" | xargs)"
+      [[ -n "$host_entry" ]] && fragment+=$'\n      - "'"${host_entry}"'"'
+    done
+  fi
+  printf '%s' "$fragment"
 }
 
 HOST_EDGE_SERVICES=(api-gateway frontend docs media-ws)
@@ -1754,6 +1822,14 @@ print_intranet_hint() {
     echo "    API вызывается через ${DOMAIN_FRONTEND}/idp-api — отдельно открывать ${DOMAIN_API} не нужно."
     echo ""
   fi
+  if [[ "$(env_get LDAP_USE_HOST_NETWORK false)" == "true" ]]; then
+    echo "    LDAP: контейнер ldap-auth использует сеть хоста (резолвит AD-имена как сервер)."
+  elif [[ -n "$(env_get LDAP_DNS_SERVERS "")" || -n "$(env_get LDAP_EXTRA_HOSTS "")" ]]; then
+    echo "    LDAP: для ldap-auth настроены DNS/extra_hosts из .env"
+  else
+    echo "    LDAP: если AD-имена не резолвятся — LDAP_USE_HOST_NETWORK=true или IP DC в LDAP_HOST."
+  fi
+  echo ""
 }
 
 print_summary() {
@@ -1946,8 +2022,8 @@ action_fix_host_proxy() {
   log "Шаг 1/4: остановка Docker Nginx..."
   stop_docker_nginx
 
-  log "Шаг 2/4: удаление override (мог блокировать порты)..."
-  rm -f "$COMPOSE_OVERRIDE"
+  log "Шаг 2/4: compose override (LDAP / Nginx)..."
+  write_compose_override
 
   log "Шаг 3/4: пересоздание api-gateway, frontend, docs, media-ws..."
   build_compose_stack_cmd