Adding LDAP support

.env.example

@@ -29,6 +29,32 @@ COOKIE_SECURE=false
 # --- CORS (JSON list) ---
 CORS_ORIGINS=["*"]
 
+# --- LDAP / Active Directory (optional) ---
+# When enabled, login credentials are validated against the directory and a
+# local user is provisioned on first login. Local DB auth still works as a
+# fallback (so the seeded superuser can log in). Disabled by default.
+LDAP_ENABLED=false
+LDAP_SERVER_URI="ldap://ldap.example.com:389"
+LDAP_USE_SSL=false
+LDAP_START_TLS=false
+LDAP_TLS_VALIDATE=true
+# LDAP_CA_CERTS_FILE="/etc/ssl/certs/ca.pem"
+
+# Option 1 — direct bind: build the user DN from the login name.
+# LDAP_BIND_DN_TEMPLATE="uid={username},ou=people,dc=example,dc=com"
+
+# Option 2 — search + bind: a service account finds the user, then we bind as
+# the found DN. Leave the template above empty to use this mode.
+# LDAP_BIND_DN="cn=svc-reader,dc=example,dc=com"
+# LDAP_BIND_PASSWORD="service-account-password"
+# LDAP_USER_SEARCH_BASE="ou=people,dc=example,dc=com"
+# LDAP_USER_SEARCH_FILTER="(uid={username})"
+
+# Directory attributes copied onto the local user, and roles granted on first login.
+LDAP_ATTR_EMAIL=mail
+LDAP_ATTR_FULL_NAME=cn
+LDAP_DEFAULT_ROLES=["user"]
+
 # --- Bootstrap superuser (used by scripts/seed.py) ---
 FIRST_SUPERUSER_EMAIL=admin@example.com
 FIRST_SUPERUSER_PASSWORD=changethis