Renamed the mariadb, openldap and postgres database

2025-08-30 23:38:13 +02:00 · 2025-07-12 16:06:13 +02:00
parent e174523fc6
commit 3b03c5171d
84 changed files with 210 additions and 106 deletions
--- a/roles/svc-db-openldap/tasks/main.yml
+++ b/roles/svc-db-openldap/tasks/main.yml
@@ -0,0 +1,135 @@
+---
+
+- name: "include docker-compose role"
+  include_role: 
+    name: docker-compose
+
+- name: Create {{domains | get_domain(application_id)}}.conf if LDAP is exposed to internet
+  template: 
+    src:  "nginx.stream.conf.j2" 
+    dest: "{{nginx.directories.streams}}{{domains | get_domain(application_id)}}.conf"
+  notify: restart nginx
+  when: applications[application_id].network.public | bool
+
+- name: Remove {{domains | get_domain(application_id)}}.conf if LDAP is not exposed to internet
+  file:
+    path: "{{ nginx.directories.streams }}{{ domains | get_domain(application_id) }}.conf"
+    state: absent
+  when: not applications[application_id].network.public | bool
+
+- name: create docker network for LDAP, so that other applications can access it
+  docker_network:
+    name: "{{ applications[application_id].network.name }}"
+    state: present
+    ipam_config:
+      - subnet: "{{ networks.local['svc-db-openldap'].subnet }}"
+
+- meta: flush_handlers
+
+- name: "Wait for LDAP to be available"
+  wait_for:
+    host: "127.0.0.1"
+    port: "{{ ports.localhost.ldap['svc-db-openldap'] }}"
+    delay: 5
+    timeout: 120
+    state: started
+
+- name: "Reset LDAP admin passwords"
+  include_tasks: reset_admin_passwords.yml
+  when: applications[application_id].network.local
+
+- name: "create directory {{ldif_host_path}}{{item}}"
+  file:
+    path: "{{ldif_host_path}}{{item}}"
+    state: directory
+    mode: 0755
+  loop: "{{ldif_types}}"
+
+- name: "Process all LDIF types"
+  include_tasks: create_ldif_files.yml
+  loop:
+    - configuration
+  loop_control:
+    loop_var: folder
+
+- name: flush LDIF handlers
+  meta: flush_handlers
+
+- name: install python-ldap
+  community.general.pacman:
+    name:
+      - python-ldap
+    state: present
+
+- name: "Include Nextcloud Schema"
+  include_tasks: schemas/nextcloud.yml
+
+- name: "Include openssh-lpk Schema"
+  include_tasks: schemas/openssh_lpk.yml
+
+###############################################################################
+# 1) Create the LDAP entry if it does not yet exist
+###############################################################################
+- name: Ensure LDAP users exist
+  community.general.ldap_entry:
+    dn:           "{{ ldap.user.attributes.id }}={{ item.key }},{{ ldap.dn.ou.users }}"
+    server_uri:   "{{ ldap_server_uri }}"
+    bind_dn:      "{{ ldap.dn.administrator.data }}"
+    bind_pw:      "{{ ldap.bind_credential }}"
+    objectClass:  "{{ ldap.user.objects.structural }}"
+    attributes:
+      uid:           "{{ item.value.username }}"
+      sn:            "{{ item.value.sn  | default(item.key) }}"
+      cn:            "{{ item.value.cn  | default(item.key) }}"
+      userPassword:  "{SSHA}{{ item.value.password }}"
+      loginShell:    /bin/bash
+      homeDirectory: "/home/{{ item.key }}"
+      uidNumber:     "{{ item.value.uid | int }}"
+      gidNumber:     "{{ item.value.gid | int }}"
+    state: present            # ↳ creates but never updates
+  async: 60
+  poll: 0
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+###############################################################################
+# 2) Keep the objectClass list AND the mail attribute up-to-date
+###############################################################################
+- name: Ensure required objectClass values and mail address are present
+  community.general.ldap_attrs:
+    dn: "{{ ldap.user.attributes.id }}={{ item.key }},{{ ldap.dn.ou.users }}"
+    server_uri: "{{ ldap_server_uri }}"
+    bind_dn: "{{ ldap.dn.administrator.data }}"
+    bind_pw: "{{ ldap.bind_credential }}"
+    attributes:
+      objectClass: "{{ ldap.user.objects.structural }}"
+      mail:        "{{ item.value.email }}"
+    state: exact
+  async: 60
+  poll: 0
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: "Ensure container for application roles exists"
+  community.general.ldap_entry:
+    dn: "{{ ldap.dn.ou.roles }}"
+    server_uri: "{{ ldap_server_uri }}"
+    bind_dn:  "{{ ldap.dn.administrator.data }}"
+    bind_pw:  "{{ ldap.bind_credential }}"
+    objectClass: organizationalUnit
+    attributes:
+      ou: roles
+      description: Container for application access profiles
+    state: present
+
+- name: "Process all LDIF types"
+  include_tasks: create_ldif_files.yml
+  loop:
+    - data
+  loop_control:
+    loop_var: folder
+
+- name: "Add Objects to all users"
+  include_tasks: add_user_objects.yml