kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-09-24 11:06:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Normalized OpenLDAP constants

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach
2025-09-22 19:08:11 +02:00
parent 588cd1959f
commit 97e2d440b2
10 changed files with 47 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
roles/svc-db-openldap/tasks/01_credentials.yml
View File

@@ -3,7 +3,7 @@
- name: "Query available LDAP databases"
shell: |
docker exec {{ openldap_name }} \
docker exec {{ OPENLDAP_NAME }} \
ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b cn=config "(olcDatabase=*)" dn
register: ldap_databases
@@ -27,13 +27,13 @@
- name: "Generate hash for Database Admin password"
shell: |
docker exec {{ openldap_name }} \
docker exec {{ OPENLDAP_NAME }} \
slappasswd -s "{{ LDAP.BIND_CREDENTIAL }}"
register: database_admin_pw_hash
- name: "Reset Database Admin password in LDAP (olcRootPW)"
shell: |
docker exec -i {{ openldap_name }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
docker exec -i {{ OPENLDAP_NAME }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: {{ data_backend_dn }}
changetype: modify
replace: olcRootPW
@@ -42,13 +42,13 @@
- name: "Generate hash for Configuration Admin password"
shell: |
docker exec {{ openldap_name }} \
docker exec {{ OPENLDAP_NAME }} \
slappasswd -s "{{ applications | get_app_conf(application_id, 'credentials.administrator_password', True) }}"
register: config_admin_pw_hash
- name: "Reset Configuration Admin password in LDAP (olcRootPW)"
shell: |
docker exec -i {{ openldap_name }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
docker exec -i {{ OPENLDAP_NAME }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
dn: {{ config_backend_dn }}
changetype: modify
replace: olcRootPW

6
roles/svc-db-openldap/tasks/03_users.yml
View File

@@ -4,7 +4,7 @@
- name: Ensure LDAP users exist
community.general.ldap_entry:
dn: "{{ LDAP.USER.ATTRIBUTES.ID }}={{ item.key }},{{ LDAP.DN.OU.USERS }}"
server_uri: "{{ openldap_server_uri }}"
server_uri: "{{ OPENLDAP_SERVER_URI }}"
bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
bind_pw: "{{ LDAP.BIND_CREDENTIAL }}"
objectClass: "{{ LDAP.USER.OBJECTS.STRUCTURAL }}"
@@ -30,7 +30,7 @@
- name: Ensure required objectClass values and mail address are present
community.general.ldap_attrs:
dn: "{{ LDAP.USER.ATTRIBUTES.ID }}={{ item.key }},{{ LDAP.DN.OU.USERS }}"
server_uri: "{{ openldap_server_uri }}"
server_uri: "{{ OPENLDAP_SERVER_URI }}"
bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
bind_pw: "{{ LDAP.BIND_CREDENTIAL }}"
attributes:
@@ -46,7 +46,7 @@
- name: "Ensure container for application roles exists"
community.general.ldap_entry:
dn: "{{ LDAP.DN.OU.ROLES }}"
server_uri: "{{ openldap_server_uri }}"
server_uri: "{{ OPENLDAP_SERVER_URI }}"
bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
bind_pw: "{{ LDAP.BIND_CREDENTIAL }}"
objectClass: organizationalUnit

4
roles/svc-db-openldap/tasks/04_update.yml
View File

@@ -1,6 +1,6 @@
- name: Gather all users with their current objectClass list
community.general.ldap_search:
server_uri: "{{ openldap_server_uri }}"
server_uri: "{{ OPENLDAP_SERVER_URI }}"
bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
bind_pw: "{{ LDAP.BIND_CREDENTIAL }}"
dn: "{{ LDAP.DN.OU.USERS }}"
@@ -14,7 +14,7 @@
- name: Add only missing auxiliary classes
community.general.ldap_attrs:
server_uri: "{{ openldap_server_uri }}"
server_uri: "{{ OPENLDAP_SERVER_URI }}"
bind_dn: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
bind_pw: "{{ LDAP.BIND_CREDENTIAL }}"
dn: "{{ item.dn }}"

4
roles/svc-db-openldap/tasks/ldifs_creation.yml
View File

@@ -1,7 +1,7 @@
- name: "Create LDIF files at {{ openldap_ldif_host_path }}{{ folder }}"
- name: "Create LDIF files at {{ OPENLDAP_LDIF_PATH_HOST }}{{ folder }}"
template:
src: "{{ item }}"
dest: "{{ openldap_ldif_host_path }}{{ folder }}/{{ item | basename | regex_replace('\\.j2$', '') }}"
dest: "{{ OPENLDAP_LDIF_PATH_HOST }}{{ folder }}/{{ item | basename | regex_replace('\\.j2$', '') }}"
mode: "0770"
loop: >-
{{

8
roles/svc-db-openldap/tasks/main.yml
View File

@@ -19,7 +19,7 @@
- name: create docker network for LDAP, so that other applications can access it
community.docker.docker_network:
name: "{{ openldap_network }}"
name: "{{ OPENLDAP_NETWORK }}"
state: present
ipam_config:
- subnet: "{{ networks.local[application_id].subnet }}"
@@ -40,12 +40,12 @@
- applications | get_app_conf(application_id, 'network.local')
- applications | get_app_conf(application_id, 'provisioning.credentials', True)
- name: "create directory {{openldap_ldif_host_path}}{{item}}"
- name: "create directory {{OPENLDAP_LDIF_PATH_HOST}}{{item}}"
file:
path: "{{openldap_ldif_host_path}}{{item}}"
path: "{{OPENLDAP_LDIF_PATH_HOST}}{{item}}"
state: directory
mode: "0755"
loop: "{{openldap_ldif_types}}"
loop: "{{OPENLDAP_LDIF_TYPES}}"
- name: "Import LDIF Configuration"
include_tasks: ldifs_creation.yml

6
roles/svc-db-openldap/tasks/schemas/nextcloud.yml
View File

@@ -13,9 +13,9 @@
- "( 1.3.6.1.4.1.99999.2 NAME '{{ LDAP.USER.OBJECTS.AUXILIARY.NEXTCLOUD_USER }}' DESC 'Auxiliary class for Nextcloud attributes' AUXILIARY MAY ( {{ LDAP.USER.ATTRIBUTES.NEXTCLOUD_QUOTA }} ) )"
command: >
ldapsm
-s {{ openldap_server_uri }}
-D '{{ openldap_bind_dn }}'
-W '{{ openldap_bind_pw }}'
-s {{ OPENLDAP_SERVER_URI }}
-D '{{ OPENLDAP_BIND_DN }}'
-W '{{ OPENLDAP_BIND_PW }}'
-n {{ schema_name }}
{% for at in attribute_defs %}
-a "{{ at }}"

6
roles/svc-db-openldap/tasks/schemas/openssh_lpk.yml
View File

@@ -21,9 +21,9 @@
command: >
ldapsm
-s {{ openldap_server_uri }}
-D '{{ openldap_bind_dn }}'
-W '{{ openldap_bind_pw }}'
-s {{ OPENLDAP_SERVER_URI }}
-D '{{ OPENLDAP_BIND_DN }}'
-W '{{ OPENLDAP_BIND_PW }}'
-n {{ schema_name }}
{% for at in attribute_defs %}
-a "{{ at }}"

14
roles/svc-db-openldap/templates/docker-compose.yml.j2
View File

@@ -1,20 +1,20 @@
{% include 'roles/docker-compose/templates/base.yml.j2' %}
application:
image: "{{ openldap_image }}:{{ openldap_version }}"
container_name: "{{ openldap_name }}"
image: "{{ OPENLDAP_IMAGE }}:{{ OPENLDAP_VERSION }}"
container_name: "{{ OPENLDAP_NAME }}"
{% include 'roles/docker-container/templates/base.yml.j2' %}
{% if openldap_network_expose_local %}
{% if OPENLDAP_NETWORK_EXPOSE_LOCAL %}
ports:
- 127.0.0.1:{{ports.localhost.ldap['svc-db-openldap']}}:{{openldap_docker_port_open}}
- 127.0.0.1:{{ports.localhost.ldap['svc-db-openldap']}}:{{OPENLDAP_DOCKER_PORT_OPEN}}
{% endif %}
volumes:
- 'data:/bitnami/openldap'
- '{{openldap_ldif_host_path}}:{{ openldap_ldif_docker_path }}:ro'
- '{{OPENLDAP_LDIF_PATH_HOST}}:{{ OPENLDAP_LDIF_PATH_DOCKER }}:ro'
healthcheck:
test: >
bash -c '
ldapsearch -x -H ldap://localhost:{{ openldap_docker_port_open }} \
ldapsearch -x -H ldap://localhost:{{ OPENLDAP_DOCKER_PORT_OPEN }} \
-D "{{ LDAP.DN.ADMINISTRATOR.DATA }}" -w "{{ LDAP.BIND_CREDENTIAL }}" -b "{{ LDAP.DN.ROOT }}" > /dev/null \
&& ldapsearch -Y EXTERNAL -H ldapi:/// \
-b cn=config "(&(objectClass=olcOverlayConfig)(olcOverlay=memberof))" \
@@ -24,6 +24,6 @@
{% include 'roles/docker-compose/templates/volumes.yml.j2' %}
data:
name: "{{ openldap_volume }}"
name: "{{ OPENLDAP_VOLUME }}"
{% include 'roles/docker-compose/templates/networks.yml.j2' %}

4
roles/svc-db-openldap/templates/env.j2
View File

@@ -18,9 +18,9 @@ LDAP_CONFIG_ADMIN_USERNAME= {{ applications | get_app_conf(application_id, 'user
LDAP_CONFIG_ADMIN_PASSWORD= {{ applications | get_app_conf(application_id, 'credentials.administrator_password') }}
# Network
LDAP_PORT_NUMBER= {{openldap_docker_port_open}} # Route to default port
LDAP_PORT_NUMBER= {{OPENLDAP_DOCKER_PORT_OPEN}} # Route to default port
LDAP_ENABLE_TLS= no # Using nginx proxy for tls
LDAP_LDAPS_PORT_NUMBER= {{openldap_docker_port_secure}} # Port used for TLS secure traffic. Priviledged port is supported (e.g. 636). Default: 1636 (non privileged port).
LDAP_LDAPS_PORT_NUMBER= {{OPENLDAP_DOCKER_PORT_SECURE}} # Port used for TLS secure traffic. Priviledged port is supported (e.g. 636). Default: 1636 (non privileged port).
# Security
LDAP_ALLOW_ANON_BINDING= no # Allow anonymous bindings to the LDAP server. Default: yes.

30
roles/svc-db-openldap/vars/main.yml
View File

@@ -1,24 +1,26 @@
application_id: "svc-db-openldap"
# LDAP Variables
openldap_docker_port_secure: 636
openldap_docker_port_open: 389
openldap_server_uri: "ldap://127.0.0.1:{{ ports.localhost.ldap[application_id] }}"
openldap_bind_dn: "{{ LDAP.DN.ADMINISTRATOR.CONFIGURATION }}"
openldap_bind_pw: "{{ applications | get_app_conf(application_id, 'credentials.administrator_password', True) }}"
OPENLDAP_DOCKER_PORT_SECURE: 636
OPENLDAP_DOCKER_PORT_OPEN: 389
OPENLDAP_SERVER_URI: "ldap://127.0.0.1:{{ ports.localhost.ldap[application_id] }}"
OPENLDAP_BIND_DN: "{{ LDAP.DN.ADMINISTRATOR.CONFIGURATION }}"
OPENLDAP_BIND_PW: "{{ applications | get_app_conf(application_id, 'credentials.administrator_password') }}"
# LDIF Variables
openldap_ldif_host_path: "{{ docker_compose.directories.volumes }}ldif/"
openldap_ldif_docker_path: "/tmp/ldif/"
openldap_ldif_types:
OPENLDAP_LDIF_PATH_HOST: "{{ docker_compose.directories.volumes }}ldif/"
OPENLDAP_LDIF_PATH_DOCKER: "/tmp/ldif/"
OPENLDAP_LDIF_TYPES:
- configuration
- groups
- schema # Don't know if this is still needed, it's now setup via tasks
openldap_name: "{{ applications | get_app_conf(application_id, 'docker.services.openldap.name', True) }}"
openldap_image: "{{ applications | get_app_conf(application_id, 'docker.services.openldap.image', True) }}"
openldap_version: "{{ applications | get_app_conf(application_id, 'docker.services.openldap.version', True) }}"
openldap_volume: "{{ applications | get_app_conf(application_id, 'docker.volumes.data', True) }}"
openldap_network: "{{ applications | get_app_conf(application_id, 'docker.network', True) }}"
# Container
OPENLDAP_NAME: "{{ applications | get_app_conf(application_id, 'docker.services.openldap.name') }}"
OPENLDAP_IMAGE: "{{ applications | get_app_conf(application_id, 'docker.services.openldap.image') }}"
OPENLDAP_VERSION: "{{ applications | get_app_conf(application_id, 'docker.services.openldap.version') }}"
OPENLDAP_VOLUME: "{{ applications | get_app_conf(application_id, 'docker.volumes.data') }}"
OPENLDAP_NETWORK: "{{ applications | get_app_conf(application_id, 'docker.network') }}"
openldap_network_expose_local: "{{ applications | get_app_conf(application_id, 'network.public', True) | bool or applications | get_app_conf(application_id, 'network.local') | bool }}"
# Network
OPENLDAP_NETWORK_EXPOSE_LOCAL: "{{ applications | get_app_conf(application_id, 'network.public') | bool or applications | get_app_conf(application_id, 'network.local') | bool }}"