ldap-rest 0.1.3 → 0.1.5

package/docs/client-development/api/README.md

@@ -0,0 +1,75 @@
+# REST API
+
+LDAP-Rest REST API documentation.
+
+## Overview
+
+The LDAP-Rest REST API exposes endpoints for managing LDAP entities.
+
+## Documentation
+
+- **[rest-api.md](rest-api.md)** - Complete API usage guide
+- **[reference.md](reference.md)** - Technical reference (HTTP codes, headers, URL encoding)
+- **[openapi.md](openapi.md)** - OpenAPI specification
+
+## Authentication
+
+All API requests require authentication. See the [authentication documentation](../../usage/plugins/auth/README.md).
+
+### Token Example
+
+```bash
+curl -H "Authorization: Bearer your-token" \
+  http://localhost:8081/api/v1/ldap/users
+```
+
+## Main Endpoints
+
+### Entities (ldapFlatGeneric)
+
+```
+GET    /api/v1/ldap/{pluralName}           # List
+GET    /api/v1/ldap/{pluralName}/{id}      # Get
+POST   /api/v1/ldap/{pluralName}           # Create
+PUT    /api/v1/ldap/{pluralName}/{id}      # Modify
+DELETE /api/v1/ldap/{pluralName}/{id}      # Delete
+```
+
+### Groups
+
+```
+GET    /api/v1/ldap/groups
+GET    /api/v1/ldap/groups/{cn}
+POST   /api/v1/ldap/groups
+PUT    /api/v1/ldap/groups/{cn}
+DELETE /api/v1/ldap/groups/{cn}
+```
+
+### Organizations
+
+```
+GET    /api/v1/ldap/organizations/top
+GET    /api/v1/ldap/organizations/{dn}/subnodes
+POST   /api/v1/ldap/organizations
+PUT    /api/v1/ldap/organizations/{dn}
+DELETE /api/v1/ldap/organizations/{dn}
+```
+
+### Configuration
+
+```
+GET    /api/v1/config     # Available capabilities and schemas
+```
+
+## Response Codes
+
+| Code | Description               |
+| ---- | ------------------------- |
+| 200  | Success                   |
+| 201  | Created                   |
+| 400  | Invalid request           |
+| 401  | Not authenticated         |
+| 403  | Access forbidden          |
+| 404  | Not found                 |
+| 409  | Conflict (existing entry) |
+| 500  | Server error              |

package/docs/client-development/browser/README.md

@@ -0,0 +1,65 @@
+# Browser Libraries
+
+Web components for integrating LDAP-Rest into your applications.
+
+## Overview
+
+LDAP-Rest provides reusable web components for LDAP management.
+
+## Documentation
+
+- **[libraries.md](libraries.md)** - Complete component documentation
+
+## Available Components
+
+| Component            | Description                    |
+| -------------------- | ------------------------------ |
+| `LdapTreeViewer`     | LDAP tree navigation           |
+| `LdapUserEditor`     | User editing                   |
+| `LdapGroupEditor`    | Group management               |
+| `LdapUnitEditor`     | Organizational unit management |
+| `LdapResourceEditor` | Resource management            |
+
+## Utilities
+
+| Module                        | Description                    |
+| ----------------------------- | ------------------------------ |
+| `browser-shared-utils-totp`   | TOTP client for authentication |
+| `browser-shared-utils-hmac`   | HMAC client for authentication |
+| `browser-shared-utils-dom`    | DOM utilities                  |
+| `browser-shared-utils-form`   | Form utilities                 |
+| `browser-shared-utils-schema` | JSON schema utilities          |
+
+## Installation
+
+```bash
+npm install ldap-rest
+```
+
+## Import
+
+```typescript
+// Components
+import { LdapTreeViewer, LdapUserEditor } from 'ldap-rest/browser';
+
+// Utilities
+import { TotpAuthClient } from 'ldap-rest/browser-shared-utils-totp';
+import { HmacAuthClient } from 'ldap-rest/browser-shared-utils-hmac';
+```
+
+## Quick Example
+
+```typescript
+import { LdapTreeViewer } from 'ldap-rest/browser';
+
+const viewer = new LdapTreeViewer({
+  apiUrl: 'http://localhost:8081/api/v1',
+  container: document.getElementById('tree'),
+});
+
+viewer.render();
+```
+
+## Demos
+
+Interactive examples are available in the [examples](../examples/README.md) folder.

package/docs/{plugins/DEVELOPMENT.md → plugin-development/README.md}

@@ -205,15 +205,10 @@ Create a standalone file anywhere on your system, e.g., `/opt/custom-plugins/my-
  */
 import type { Express, Request, Response } from 'express';
 
-// Import from ldap-rest (if installed as npm package)
-// import DmPlugin, { asyncHandler } from 'ldap-rest/plugin';
-
-// Or use relative path to node_modules
-import DmPlugin from './node_modules/ldap-rest/dist/abstract/plugin.js';
-import type { DM } from './node_modules/ldap-rest/dist/bin/index.js';
-import type { Hooks } from './node_modules/ldap-rest/dist/hooks.js';
-// Import asyncHandler for error handling
-import { asyncHandler } from './node_modules/ldap-rest/dist/lib/utils.js';
+// Import from ldap-rest
+import DmPlugin, { asyncHandler } from 'ldap-rest/plugin';
+import type { DM } from 'ldap-rest';
+import type { Hooks } from 'ldap-rest/hooks';
 
 export default class ExternalAuditPlugin extends DmPlugin {
   name = 'externalAudit';

package/docs/plugin-development/hooks.md

@@ -0,0 +1,18 @@
+# Core hooks
+
+Set here the documentation of all hooks.
+
+Typescript definitions into [hooks.ts](./src/hooks.ts)
+
+## Demo hooks
+
+- **hello**: called by [helloworld demo plugin](./src/plugins/helloworld.ts)
+
+## [LDAP](./src/lib/ldapActions.ts) hooks
+
+- **ldapopts**: called before any ldapsearch to modify search options
+- **ldapsearchresult**: called after any ldapsearch to modify search result
+- **ldapaddrequest**: called before any ldapadd
+- **ldapmodifyrequest**: called before any ldapmodify
+- **ldapdeleterequest**: called before any ldapdelete
+- **ldaprenamerequest**: called before any ldap rename/modifyDN operation

package/docs/usage/README.md

@@ -0,0 +1,89 @@
+# Usage - Getting Started
+
+Getting started and usage guide for LDAP-Rest.
+
+## Installation
+
+```bash
+npm install ldap-rest
+```
+
+## Quick Start
+
+### Minimal Configuration
+
+```bash
+ldap-rest \
+  --plugin core/ldap/flatGeneric \
+  --ldap-url ldap://localhost:389 \
+  --ldap-dn "cn=admin,dc=example,dc=com" \
+  --ldap-pwd "password" \
+  --ldap-base "dc=example,dc=com" \
+  --ldap-flat-schema ./schemas/standard/users.json
+```
+
+### With Authentication
+
+```bash
+ldap-rest \
+  --plugin core/auth/token \
+  --plugin core/ldap/flatGeneric \
+  --auth-token "secret-token" \
+  --ldap-flat-schema ./schemas/standard/users.json \
+  ...
+```
+
+### Complete Configuration
+
+```bash
+ldap-rest \
+  --plugin core/auth/token \
+  --plugin core/ldap/flatGeneric \
+  --plugin core/ldap/groups \
+  --plugin core/ldap/organization \
+  --plugin core/ldap/bulkImport \
+  --plugin core/ldap/externalUsersInGroups \
+  --plugin core/static \
+  --plugin core/weblogs \
+  --ldap-flat-schema ./schemas/standard/users.json \
+  --bulk-import-schemas "users:./schemas/standard/users.json" \
+  --auth-token "admin-token" \
+  --static-path ./static \
+  ...
+```
+
+## LDAP Connection
+
+### Single URL
+
+```bash
+--ldap-url ldap://localhost:389
+```
+
+### Failover (High Availability)
+
+```bash
+--ldap-url ldap://ldap1.example.com,ldap://ldap2.example.com,ldap://ldap3.example.com
+```
+
+The system will:
+
+1. Try each URL in order
+2. Use the first successful connection
+3. Automatically failover on connection failure
+
+## Log Levels
+
+```bash
+--log-level error   # Errors only
+--log-level warn    # Warnings and errors
+--log-level notice  # Web access logs (recommended for production)
+--log-level info    # General information
+--log-level debug   # Everything, including debug output
+```
+
+## Next Steps
+
+- **[Configuration](configuration.md)** - CLI options and environment variables
+- **[Plugins](plugins/README.md)** - Choose and configure plugins
+- **[Troubleshooting](troubleshooting.md)** - Problem resolution

package/docs/usage/configuration.md

@@ -0,0 +1,375 @@
+# Configuration
+
+All LDAP-Rest configuration options.
+
+## Table of Contents
+
+- [Environment Variables](#environment-variables)
+  - [Array Options](#array-options)
+- [General Options](#general-options)
+- [LDAP Connection](#ldap-connection)
+- [Special Attributes](#special-attributes)
+- [Plugin Options](#plugin-options)
+  - [LDAP Plugins](#ldap-plugins)
+    - [core/ldap/organizations](#coreldaporganizations)
+    - [core/ldap/groups](#coreldapgroups)
+    - [core/ldap/externalUsersInGroups](#coreldapexternalusersingroups)
+    - [core/ldap/flatGeneric](#coreldapflatgeneric)
+    - [core/ldap/bulkImport](#coreldapbulkimport)
+    - [core/ldap/trash](#coreldaptrash)
+    - [core/ldap/onChange](#coreldaponchange)
+    - [core/ldap/departmentSync](#coreldapdepartmentsync)
+  - [Authentication Plugins](#authentication-plugins)
+    - [core/auth/token](#coreauthtoken)
+    - [core/auth/totp](#coreauthtotp)
+    - [core/auth/hmac](#coreauthhmac)
+    - [core/auth/llng](#coreauthllng)
+    - [core/auth/openidconnect](#coreauthopenidconnect)
+  - [Authorization Plugins](#authorization-plugins)
+    - [core/auth/authzPerBranch](#coreauthauthzperbranch)
+    - [core/auth/authzLinid1](#coreauthauthzlinid1)
+  - [Security Plugins](#security-plugins)
+    - [core/auth/rateLimit](#coreauthratelimit)
+    - [core/auth/crowdsec](#coreauthcrowdsec)
+    - [core/auth/trustedProxy](#coreauthtrustedproxy)
+  - [Twake Integration Plugins](#twake-integration-plugins)
+    - [core/twake/james](#coretwakejames)
+    - [core/twake/calendarResources](#coretwakecalendarresources)
+    - [core/twake/applicativeAccounts](#coretwakeapplicativeaccounts)
+    - [core/twake/appAccountsConsistency](#coretwakeappaccountsconsistency)
+  - [Utility Plugins](#utility-plugins)
+    - [core/static](#corestatic)
+    - [core/weblogs](#coreweblogs)
+    - [core/configApi](#coreconfigapi)
+- [Configuration File](#configuration-file)
+- [LDAP Failover](#ldap-failover)
+- [Log Levels (`--log-level`)](#log-levels---log-level)
+
+## Environment Variables
+
+All CLI options can be set via environment variables with the `DM_` prefix.
+
+### Array Options
+
+Some options accept multiple values (e.g., `--plugin`, `--auth-token`, `--ldap-url`). These can be configured in several ways:
+
+**Via CLI - repeat the option:**
+
+```bash
+ldap-rest --plugin core/auth/token --plugin core/ldap/flatGeneric --plugin core/ldap/groups
+```
+
+**Via CLI - use plural form with comma-separated values:**
+
+```bash
+ldap-rest --plugins core/auth/token,core/ldap/flatGeneric,core/ldap/groups
+```
+
+**Via environment variable - use `;` or `,` as separator:**
+
+```bash
+# Semicolon separator (preferred for values containing commas)
+export DM_PLUGINS="core/auth/token;core/ldap/flatGeneric;core/ldap/groups"
+
+# Comma separator
+export DM_PLUGINS="core/auth/token,core/ldap/flatGeneric,core/ldap/groups"
+```
+
+> **Note:** If the value contains a semicolon, it will be used as the separator. Otherwise, commas are used. Whitespace around separators is ignored.
+
+## General Options
+
+| CLI              | Plural           | Env               | Default          | Description                                 |
+| ---------------- | ---------------- | ----------------- | ---------------- | ------------------------------------------- |
+| `--port`         |                  | `DM_PORT`         | `8081`           | Listen port                                 |
+| `--plugin`       | `--plugins`      | `DM_PLUGINS`      | `[]`             | Plugins to load                             |
+| `--log-level`    |                  | `DM_LOG_LEVEL`    | `notice`         | Log level: error, warn, notice, info, debug |
+| `--logger`       |                  | `DM_LOGGER`       | `console`        | Logger type                                 |
+| `--api-prefix`   |                  | `DM_API_PREFIX`   | `/api`           | API URL prefix                              |
+| `--mail-domain`  | `--mail-domains` | `DM_MAIL_DOMAIN`  | `[]`             | Mail domains                                |
+| `--schemas-path` |                  | `DM_SCHEMAS_PATH` | `static/schemas` | Path to JSON schemas                        |
+
+## LDAP Connection
+
+| CLI                          | Plural           | Env                      | Default                            | Description                |
+| ---------------------------- | ---------------- | ------------------------ | ---------------------------------- | -------------------------- |
+| `--ldap-url`                 | `--ldap-urls`    | `DM_LDAP_URL`            | `ldap://localhost`                 | LDAP server URL(s)         |
+| `--ldap-dn`                  |                  | `DM_LDAP_DN`             | `cn=admin,dc=example,dc=com`       | Bind DN                    |
+| `--ldap-pwd`                 |                  | `DM_LDAP_PWD`            | `admin`                            | Password                   |
+| `--ldap-base`                |                  | `DM_LDAP_BASE`           |                                    | Base DN for searches       |
+| `--ldap-user-main-attribute` |                  | `DM_LDAP_USER_ATTRIBUTE` | `uid`                              | User identifier attribute  |
+| `--ldap-cache-max`           |                  | `DM_LDAP_CACHE_MAX`      | `1000`                             | Max cache entries          |
+| `--ldap-cache-ttl`           |                  | `DM_LDAP_CACHE_TTL`      | `300`                              | Cache TTL (seconds)        |
+| `--ldap-pool-size`           |                  | `DM_LDAP_POOL_SIZE`      | `5`                                | Connection pool size       |
+| `--ldap-connection-ttl`      |                  | `DM_LDAP_CONNECTION_TTL` | `60`                               | Connection TTL (seconds)   |
+| `--user-class`               | `--user-classes` | `DM_USER_CLASSES`        | `top,twakeAccount,twakeWhitePages` | Default user objectClasses |
+
+## Special Attributes
+
+| CLI                        | Env                         | Default                 | Description            |
+| -------------------------- | --------------------------- | ----------------------- | ---------------------- |
+| `--mail-attribute`         | `DM_MAIL_ATTRIBUTE`         | `mail`                  | Email attribute        |
+| `--quota-attribute`        | `DM_QUOTA_ATTRIBUTE`        | `mailQuota`             | Quota attribute        |
+| `--delegation-attribute`   | `DM_DELEGATION_ATTRIBUTE`   | `twakeDelegatedUsers`   | Delegation attribute   |
+| `--alias-attribute`        | `DM_ALIAS_ATTRIBUTE`        | `mailAlternateAddress`  | Email alias attribute  |
+| `--forward-attribute`      | `DM_FORWARD_ATTRIBUTE`      | `mailForwardingAddress` | Forward attribute      |
+| `--display-name-attribute` | `DM_DISPLAY_NAME_ATTRIBUTE` | `displayName`           | Display name attribute |
+
+## Plugin Options
+
+### LDAP Plugins
+
+#### `core/ldap/organizations`
+
+| CLI                                  | Plural                        | Env                                   | Default                                  | Description                |
+| ------------------------------------ | ----------------------------- | ------------------------------------- | ---------------------------------------- | -------------------------- |
+| `--ldap-top-organization`            |                               | `DM_LDAP_TOP_ORGANIZATION`            |                                          | Top organization DN        |
+| `--ldap-organization-class`          | `--ldap-organization-classes` | `DM_LDAP_ORGANIZATION_CLASSES`        | `top,organizationalUnit,twakeDepartment` | Organization objectClasses |
+| `--ldap-organization-link-attribute` |                               | `DM_LDAP_ORGANIZATION_LINK_ATTRIBUTE` | `twakeDepartmentLink`                    | Link attribute             |
+| `--ldap-organization-path-attribute` |                               | `DM_LDAP_ORGANIZATION_PATH_ATTRIBUTE` | `twakeDepartmentPath`                    | Path attribute             |
+| `--ldap-organization-path-separator` |                               | `DM_LDAP_ORGANIZATION_PATH_SEPARATOR` | `/`                                      | Path separator             |
+| `--ldap-organization-max-subnodes`   |                               | `DM_LDAP_ORGANIZATION_MAX_SUBNODES`   | `50`                                     | Max subnodes returned      |
+
+#### `core/ldap/groups`
+
+| CLI                                | Plural            | Env                             | Default                            | Description                 |
+| ---------------------------------- | ----------------- | ------------------------------- | ---------------------------------- | --------------------------- |
+| `--ldap-group-base`                |                   | `DM_LDAP_GROUP_BASE`            |                                    | Groups base DN              |
+| `--ldap-groups-main-attribute`     |                   | `DM_LDAP_GROUPS_MAIN_ATTRIBUTE` | `cn`                               | Group identifier attribute  |
+| `--group-class`                    | `--group-classes` | `DM_GROUP_CLASSES`              | `top,groupOfNames`                 | Group objectClasses         |
+| `--group-allow-unexistent-members` |                   | `DM_ALLOW_UNEXISTENT_MEMBERS`   | `false`                            | Allow non-existent members  |
+| `--group-default-attributes`       |                   | `DM_GROUP_DEFAULT_ATTRIBUTES`   | `{}`                               | Default attributes (JSON)   |
+| `--group-dummy-user`               |                   | `DM_GROUP_DUMMY_USER`           | `cn=fakeuser`                      | Dummy user for empty groups |
+| `--group-schema`                   |                   | `DM_GROUP_SCHEMA`               | `static/schemas/twake/groups.json` | Group JSON schema path      |
+
+#### `core/ldap/externalUsersInGroups`
+
+| CLI                         | Plural                      | Env                          | Default                         | Description                 |
+| --------------------------- | --------------------------- | ---------------------------- | ------------------------------- | --------------------------- |
+| `--external-members-branch` |                             | `DM_EXTERNAL_MEMBERS_BRANCH` | `ou=contacts,dc=example,dc=com` | External contacts branch    |
+| `--external-branch-class`   | `--external-branch-classes` | `DM_EXTERNAL_BRANCH_CLASSES` | `top,inetOrgPerson`             | External user objectClasses |
+
+#### `core/ldap/flatGeneric`
+
+| CLI                  | Plural                | Env                   | Default | Description           |
+| -------------------- | --------------------- | --------------------- | ------- | --------------------- |
+| `--ldap-flat-schema` | `--ldap-flat-schemas` | `DM_LDAP_FLAT_SCHEMA` | `[]`    | Entity schema path(s) |
+
+#### `core/ldap/bulkImport`
+
+| CLI                           | Env                            | Default    | Description              |
+| ----------------------------- | ------------------------------ | ---------- | ------------------------ |
+| `--bulk-import-schemas`       | `DM_BULK_IMPORT_SCHEMAS`       |            | Bulk import schemas path |
+| `--bulk-import-max-file-size` | `DM_BULK_IMPORT_MAX_FILE_SIZE` | `10485760` | Max file size (bytes)    |
+| `--bulk-import-batch-size`    | `DM_BULK_IMPORT_BATCH_SIZE`    | `100`      | Batch size               |
+
+#### `core/ldap/trash`
+
+| CLI                     | Env                      | Default | Description                 |
+| ----------------------- | ------------------------ | ------- | --------------------------- |
+| `--trash-base`          | `DM_TRASH_BASE`          |         | Trash container DN          |
+| `--trash-watched-bases` | `DM_TRASH_WATCHED_BASES` |         | DNs to watch for deletions  |
+| `--trash-add-metadata`  | `DM_TRASH_ADD_METADATA`  | `true`  | Add deletion metadata       |
+| `--trash-auto-create`   | `DM_TRASH_AUTO_CREATE`   | `true`  | Auto-create trash container |
+
+#### `core/ldap/onChange`
+
+Monitors LDAP modifications and triggers hooks for attribute changes. No configuration options - uses [Special Attributes](#special-attributes) settings.
+
+**Hooks triggered:**
+
+- `onLdapChange` - Any LDAP modification
+- `onLdapMailChange` - Mail attribute changes
+- `onLdapQuotaChange` - Quota attribute changes
+- `onLdapAliasChange` - Alias attribute changes
+- `onLdapForwardChange` - Forward attribute changes
+- `onLdapDisplayNameChange` - Display name changes (cn, givenName, sn)
+
+#### `core/ldap/departmentSync`
+
+Maintains consistency of department links when organizations are renamed/moved. No configuration options - uses [core/ldap/organizations](#coreldaporganizations) settings.
+
+### Authentication Plugins
+
+#### `core/auth/token`
+
+| CLI            | Plural          | Env              | Default | Description           |
+| -------------- | --------------- | ---------------- | ------- | --------------------- |
+| `--auth-token` | `--auth-tokens` | `DM_AUTH_TOKENS` | `[]`    | Authentication tokens |
+
+#### `core/auth/totp`
+
+| CLI                  | Plural         | Env                   | Default | Description                      |
+| -------------------- | -------------- | --------------------- | ------- | -------------------------------- |
+| `--auth-totp`        | `--auth-totps` | `DM_AUTH_TOTP`        | `[]`    | TOTP config (secret:name:digits) |
+| `--auth-totp-window` |                | `DM_AUTH_TOTP_WINDOW` | `1`     | Validation window                |
+| `--auth-totp-step`   |                | `DM_AUTH_TOTP_STEP`   | `30`    | Time step (seconds)              |
+
+#### `core/auth/hmac`
+
+| CLI                  | Plural         | Env                   | Default  | Description                          |
+| -------------------- | -------------- | --------------------- | -------- | ------------------------------------ |
+| `--auth-hmac`        | `--auth-hmacs` | `DM_AUTH_HMAC`        | `[]`     | HMAC config (service-id:secret:name) |
+| `--auth-hmac-window` |                | `DM_AUTH_HMAC_WINDOW` | `120000` | Time window (ms)                     |
+
+#### `core/auth/llng`
+
+| CLI          | Env           | Default                              | Description               |
+| ------------ | ------------- | ------------------------------------ | ------------------------- |
+| `--llng-ini` | `DM_LLNG_INI` | `/etc/lemonldap-ng/lemonldap-ng.ini` | LemonLDAP::NG config path |
+
+#### `core/auth/openidconnect`
+
+| CLI                    | Env                     | Default | Description              |
+| ---------------------- | ----------------------- | ------- | ------------------------ |
+| `--oidc-server`        | `DM_OIDC_SERVER`        |         | OIDC server URL          |
+| `--oidc-client-id`     | `DM_OIDC_CLIENT_ID`     |         | OIDC Client ID           |
+| `--oidc-client-secret` | `DM_OIDC_CLIENT_SECRET` |         | OIDC Client Secret       |
+| `--base-url`           | `DM_BASE_URL`           |         | Public URL for callbacks |
+
+### Authorization Plugins
+
+#### `core/auth/authzPerBranch`
+
+| CLI                            | Env                             | Default                                          | Description                 |
+| ------------------------------ | ------------------------------- | ------------------------------------------------ | --------------------------- |
+| `--authz-per-branch-config`    | `DM_AUTHZ_PER_BRANCH_CONFIG`    | `{default:{read:true,write:false,delete:false}}` | Authorization config (JSON) |
+| `--authz-per-branch-cache-ttl` | `DM_AUTHZ_PER_BRANCH_CACHE_TTL` | `60`                                             | Cache TTL (seconds)         |
+
+#### `core/auth/authzLinid1`
+
+| CLI                             | Env                              | Default               | Description           |
+| ------------------------------- | -------------------------------- | --------------------- | --------------------- |
+| `--authz-local-admin-attribute` | `DM_AUTHZ_LOCAL_ADMIN_ATTRIBUTE` | `twakeLocalAdminLink` | Local admin attribute |
+
+### Security Plugins
+
+#### `core/auth/rateLimit`
+
+| CLI                      | Env                       | Default  | Description              |
+| ------------------------ | ------------------------- | -------- | ------------------------ |
+| `--rate-limit-window-ms` | `DM_RATE_LIMIT_WINDOW_MS` | `900000` | Time window (ms, 15 min) |
+| `--rate-limit-max`       | `DM_RATE_LIMIT_MAX`       | `100`    | Max requests per window  |
+
+#### `core/auth/crowdsec`
+
+| CLI                    | Env                     | Default                              | Description         |
+| ---------------------- | ----------------------- | ------------------------------------ | ------------------- |
+| `--crowdsec-url`       | `DM_CROWDSEC_URL`       | `http://localhost:8080/v1/decisions` | CrowdSec API URL    |
+| `--crowdsec-api-key`   | `DM_CROWDSEC_API_KEY`   |                                      | CrowdSec API key    |
+| `--crowdsec-cache-ttl` | `DM_CROWDSEC_CACHE_TTL` | `60`                                 | Cache TTL (seconds) |
+
+#### `core/auth/trustedProxy`
+
+| CLI                           | Plural              | Env                            | Default     | Description            |
+| ----------------------------- | ------------------- | ------------------------------ | ----------- | ---------------------- |
+| `--trusted-proxy`             | `--trusted-proxies` | `DM_TRUSTED_PROXIES`           | `[]`        | Trusted proxy IPs/CIDR |
+| `--trusted-proxy-auth-header` |                     | `DM_TRUSTED_PROXY_AUTH_HEADER` | `Auth-User` | User header name       |
+
+### Twake Integration Plugins
+
+#### `core/twake/james`
+
+| CLI                              | Plural                          | Env                               | Default                 | Description                 |
+| -------------------------------- | ------------------------------- | --------------------------------- | ----------------------- | --------------------------- |
+| `--james-webadmin-url`           |                                 | `DM_JAMES_WEBADMIN_URL`           | `http://localhost:8000` | James WebAdmin API URL      |
+| `--james-webadmin-token`         |                                 | `DM_JAMES_WEBADMIN_TOKEN`         |                         | James authentication token  |
+| `--james-signature-template`     |                                 | `DM_JAMES_SIGNATURE_TEMPLATE`     |                         | Email signature template    |
+| `--james-concurrency`            |                                 | `DM_JAMES_CONCURRENCY`            | `10`                    | James API concurrency       |
+| `--james-init-delay`             |                                 | `DM_JAMES_INIT_DELAY`             | `1000`                  | Init delay (ms)             |
+| `--james-mailing-list-branch`    | `--james-mailing-list-branches` | `DM_JAMES_MAILING_LIST_BRANCHES`  | `[]`                    | Mailing list branches       |
+| `--james-mailbox-type-attribute` |                                 | `DM_JAMES_MAILBOX_TYPE_ATTRIBUTE` | `twakeMailboxType`      | Mailbox type attribute      |
+| `--ldap-concurrency`             |                                 | `DM_LDAP_CONCURRENCY`             | `10`                    | LDAP operations concurrency |
+
+#### `core/twake/calendarResources`
+
+| CLI                               | Env                                | Default                 | Description                   |
+| --------------------------------- | ---------------------------------- | ----------------------- | ----------------------------- |
+| `--calendar-webadmin-url`         | `DM_CALENDAR_WEBADMIN_URL`         | `http://localhost:8080` | Calendar API URL              |
+| `--calendar-webadmin-token`       | `DM_CALENDAR_WEBADMIN_TOKEN`       |                         | Calendar authentication token |
+| `--calendar-concurrency`          | `DM_CALENDAR_CONCURRENCY`          | `10`                    | API concurrency               |
+| `--calendar-resource-base`        | `DM_CALENDAR_RESOURCE_BASE`        |                         | Resource base DN              |
+| `--calendar-resource-objectclass` | `DM_CALENDAR_RESOURCE_OBJECTCLASS` |                         | Resource objectClass          |
+| `--calendar-resource-creator`     | `DM_CALENDAR_RESOURCE_CREATOR`     |                         | Resource creator              |
+| `--calendar-resource-domain`      | `DM_CALENDAR_RESOURCE_DOMAIN`      |                         | Resource domain               |
+
+#### `core/twake/applicativeAccounts`
+
+| CLI                            | Plural                          | Env                              | Default       | Description                       |
+| ------------------------------ | ------------------------------- | -------------------------------- | ------------- | --------------------------------- |
+| `--applicative-account-base`   |                                 | `DM_APPLICATIVE_ACCOUNT_BASE`    |               | Applicative accounts base DN      |
+| `--max-app-accounts`           |                                 | `DM_MAX_APP_ACCOUNTS`            | `5`           | Max accounts per user             |
+| `--ldap-operational-attribute` | `--ldap-operational-attributes` | `DM_LDAP_OPERATIONAL_ATTRIBUTES` | _(see below)_ | Operational attributes to exclude |
+
+Default operational attributes: `dn`, `controls`, `structuralObjectClass`, `entryUUID`, `entryDN`, `subschemaSubentry`, `modifyTimestamp`, `modifiersName`, `createTimestamp`, `creatorsName`, `userPassword`
+
+#### `core/twake/appAccountsConsistency`
+
+Automatically creates/updates/deletes applicative account entries when users are created/modified/deleted. No configuration options - uses [core/twake/applicativeAccounts](#coretwakeapplicativeaccounts) settings.
+
+**Requires:** `core/ldap/onChange`
+
+### Utility Plugins
+
+#### `core/static`
+
+| CLI             | Env              | Default  | Description            |
+| --------------- | ---------------- | -------- | ---------------------- |
+| `--static-path` | `DM_STATIC_PATH` | `static` | Static files directory |
+| `--static-name` | `DM_STATIC_NAME` | `static` | URL path prefix        |
+
+#### `core/weblogs`
+
+Web access logging plugin. No configuration options - just add the plugin to enable access logs.
+
+#### `core/configApi`
+
+Exposes API configuration at `/api/v1/config` for client applications. Returns available features, schemas, and endpoints. No configuration options.
+
+## Configuration File
+
+Use a `.env` file or shell script:
+
+```bash
+# ~/.ldap-rest-config
+export DM_LDAP_URL="ldap://localhost:389"
+export DM_LDAP_DN="cn=admin,dc=example,dc=com"
+export DM_LDAP_PWD="password"
+export DM_LDAP_BASE="dc=example,dc=com"
+export DM_PLUGINS="core/auth/token,core/ldap/flatGeneric"
+export DM_AUTH_TOKENS="secret-token"
+export DM_LOG_LEVEL="notice"
+```
+
+```bash
+# Load and start
+source ~/.ldap-rest-config
+ldap-rest
+```
+
+## LDAP Failover
+
+For high availability, specify multiple servers:
+
+```bash
+DM_LDAP_URL="ldap://ldap1.example.com,ldap://ldap2.example.com,ldap://ldap3.example.com"
+```
+
+The system will:
+
+1. Try each URL in order
+2. Use the first successful connection
+3. Automatically failover if connection fails
+4. Log failover events
+
+## Log Levels _(`--log-level`)_
+
+| Level    | Description                                  |
+| -------- | -------------------------------------------- |
+| `error`  | Errors only                                  |
+| `warn`   | Warnings and errors                          |
+| `notice` | Web access logs (recommended for production) |
+| `info`   | General information                          |
+| `debug`  | Everything, including debug output           |
+
+The `notice` level is ideal for production as it shows web access logs without flooding with general info messages.