diff --git a/templates/CoreConfig.tpl b/templates/CoreConfig.tpl
index 299bad3..5092b72 100644
--- a/templates/CoreConfig.tpl
+++ b/templates/CoreConfig.tpl
@@ -11,11 +11,29 @@
         <connector port="8446" clientAuth="false" _name="cert_https"/>
         -->
         <!-- Disable webtak and non-admin user interfaces -->
-        <connector port="8443" _name="https" enableWebtak="false" enableNonAdminUI="false" />
+        <connector port="8443" _name="https" enableWebtak="{{getenv "WEBTAK_ENABLE" "false"}}" enableNonAdminUI="false" />
     </network>
-    <auth>
+{{if getenv "LDAP_BIND_PASSWORD" ""}}
+    <auth default="ldap" x509groups="true" x509addAnonymous="false">
         <File location="/opt/tak/data/UserAuthenticationFile.xml"/>
+        <ldap url="{{getenv "LDAP_URL" "ldap://openldap:1389"}}"
+              updateinterval="60"
+              userstring="uid={username},ou=users,dc=example,dc=org"
+              style="DS"
+              ldapSecurityType="simple"
+              serviceAccountDN="cn={{getenv "LDAP_BIND_USER" "admin"}},dc=example,dc=org"
+              serviceAccountCredential="{{getenv "LDAP_BIND_PASSWORD" ""}}"
+              groupBaseRDN="ou=groups,dc=example,dc=org"
+              groupObjectClass="groupOfNames"
+              groupNameExtractorRegex="(?:cn|CN)=(?:tak_)?(.+?),"
+              groupprefix="CN=tak_"
+        />
     </auth>
+{{else}}
+    <auth x509groups="true" x509addAnonymous="false">
+        <File location="/opt/tak/data/UserAuthenticationFile.xml"/>
+    </auth>
+{{end}}
     <submission ignoreStaleMessages="false" validateXml="false"/>
 
     <subscription reloadPersistent="false">
diff --git a/updates/.keep b/updates/.keep
new file mode 100644
index 0000000..e69de29