lldap

A lightweight LDAP server for centralized user account management.

Decommissioned

lldap was removed from the Talos cluster in October 2026. It had been the user directory behind Keycloak's LDAP federation, but once every account existed natively in the kueber.eu realm and no other LDAP consumer was left, the directory only duplicated what Keycloak already held. Keycloak is the central identity provider now; its account console answers on the old hostname, account.web.kueber.eu. The last restic snapshots of the SQLite database stay in the backup repositories for the usual retention. The page stays as a record of what it was and why it went.

lldap is a simplified LDAP server designed for self-hosting that provides a clean web UI for managing users and groups. It supports a minimal but sufficient LDAP subset for use with compatible apps (Gitea, Nextcloud, Keycloak user federation, etc.). Self-hosting gives you a single source of truth for user identities without paying for a directory service.

Alternatives considered

Cloud Hosted

Tool	Open Source	Free Tier	Monthly Cost
Azure Entra ID	No	Limited	From $6/user

Self Hosted

Tool	Open Source	Full Features	Notes
OpenLDAP	Yes	Yes	More complete but much harder to configure
FreeIPA	Yes	Yes	Full identity stack; heavy for homelab
Active Directory	No	No	Windows-only; enterprise-grade complexity

What it did here

• Deployment: one lldap Deployment in the lldap namespace, SQLite on an encrypted Longhorn PVC, backed up by k8up to Hetzner and Backblaze.
• Interfaces: LDAP on service port 389 for Keycloak's user federation (read-only sync), the web UI on account.web.kueber.eu for managing users and groups.
• Why it went: with Pocket ID gone in August 2026 and all clients registered in Keycloak, the directory had one consumer. Keycloak holds users, groups and second factors itself, so federation added a second place to administer accounts and a second service to keep alive for every login.