In between commit refactoring LDAP, to continue working on other computer

group_vars/all/07_applications.yml

@@ -213,38 +213,35 @@ defaults_applications:
     css_enabled:                  "{{css_enabled_default}}"                 # Enables\Disables Global CSS Style
     landingpage_iframe_enabled:   false                                     # Disabled by default, because it leads to authentification problems
 
-  ## LDAP
+  # LDAP Account Manager 
-  ldap:
   lam:
     version:                        "latest"
-      administrator_password:         "{{users.administrator.initial_password}}"  # CHANGE for security reasons
+#    administrator_password:         "{{users.administrator.initial_password}}"  # CHANGE for security reasons  
-    openldap:
+    ldap:
+      enabled:                        True                                        # Should have the same value as applications.ldap.network.local.
+    oauth2_proxy:
+      enabled:                        true                                        # Activate the OAuth2 Proxy for the LDAP Webinterface
+      application:                    application                                 # Needs to be the same as webinterface
+      port:                           80                                          # application port
+#     cookie_secret:                  None                                        # Set via openssl rand -hex 16
+    matomo_tracking_enabled:      "{{matomo_tracking_enabled_default}}"           # Enables\Disables Matomo Tracking
+    css_enabled:                  "{{css_enabled_default}}"                       # Enables\Disables Global CSS Style
+    landingpage_iframe_enabled:   "{{landingpage_iframe_enabled_default}}"        # Enables\Disables the possibility to embed this on landing page via iframe
+
+  ## LDAP
+  ldap:
     version:                        "latest"
     network:
       local:                        True                                        # Activates local network to allow other docker containers to connect
       public:                       False                                       # Set to true in inventory file if you want to expose the LDAP port to the internet
     hostname:                       "openldap"                                  # Hostname of the LDAP Server in the central_ldap network
-    phpldapadmin:
-      version:                        "2.0.0-dev"                                 # @todo Attention: Change this as fast as released to latest
     webinterface:                     "lam"                                       # The webinterface which should be used. Possible: lam and phpldapadmin
     users:  
       administrator:
         username:                     "{{users.administrator.username}}"
-    ldap:
-      enabled:                        True                                        # Should have the same value as applications.ldap.openldap.network.local.
-    oauth2_proxy:
-      enabled:                        true                                        # Activate the OAuth2 Proxy for the LDAP Webinterface
-      application:                    lam                                         # Needs to be the same as webinterface
-      port:                           80                                          # If you use phpldapadmin set it to 8080
-#     cookie_secret:                  None                                        # Set via openssl rand -hex 16
-    database:
-      central_storage:                false                                       # LDAP doesn't use an database in the current configuration. Propably a good idea to implement one later. 
     # administrator_password:                                                     # CHANGE for security reasons in inventory file
     # administrator_database_password:                                            # CHANGE for security reasons in inventory file
     force_import:                 False                                           # Forces the import of the LDIF files
-    matomo_tracking_enabled:      "{{matomo_tracking_enabled_default}}"           # Enables\Disables Matomo Tracking
-    css_enabled:                  "{{css_enabled_default}}"                       # Enables\Disables Global CSS Style
-    landingpage_iframe_enabled:   "{{landingpage_iframe_enabled_default}}"        # Enables\Disables the possibility to embed this on landing page via iframe
 
   ## Libre Office
   libreoffice:
@@ -653,6 +650,20 @@ defaults_applications:
     css_enabled:                  "{{ css_enabled_default }}"                   # Enables/Disables global CSS styling
     landingpage_iframe_enabled:   "{{ landingpage_iframe_enabled_default }}"    # Enables/Disables embedding via iframe
 
+  ## phpLDAPadmin
+  phpldapadmin:
+    version:                        "2.0.0-dev"                                 # @todo Attention: Change this as fast as released to latest
+    ldap:
+      enabled:                        True                                      # Should have the same value as applications.ldap.network.local.
+    oauth2_proxy:
+      enabled:                        true                                      # Activate the OAuth2 Proxy for the LDAP Webinterface
+      application:                    application                               # Needs to be the same as webinterface
+      port:                           8080                                      # application port
+#     cookie_secret:                  None                                      # Set via openssl rand -hex 16
+    matomo_tracking_enabled:      "{{matomo_tracking_enabled_default}}"         # Enables\Disables Matomo Tracking
+    css_enabled:                  "{{css_enabled_default}}"                     # Enables\Disables Global CSS Style
+    landingpage_iframe_enabled:   "{{landingpage_iframe_enabled_default}}"      # Enables\Disables the possibility to embed this on landing page via iframe
+
   ## PHPMyAdmin
   phpmyadmin:
     version:                      "latest"                                  # Use the latest phpmyadmin version

group_vars/all/09_ports.yml

@@ -5,10 +5,12 @@ ports:
       mastodon:         4001
     oauth2_proxy:
       phpmyadmin:       4181
-      ldap:           4182
+      lam:              4182
       openproject:      4183
       yourls:           4184
       pgadmin:          4185
+      phpldapadmin:     4186
+      fusiondirectory:  4187
     ldap:
       openldap:         389
     http:
@@ -44,10 +46,12 @@ ports:
       bluesky_api:      8030
       bluesky_web:      8031
       keycloak:         8032
-      ldap:           8033
+      lam:              8033
       phpmyadmin:       8034
       snipe_it:         8035
       sphinx:           8036
+      phpldapadmin:     8037
+      fusiondirectory:  8038
       bigbluebutton:    48087 # This port is predefined by bbb. @todo Try to change this to a 8XXX port
   # Ports which are exposed to the World Wide Web
   public:

group_vars/all/10_networks.yml

@@ -72,6 +72,13 @@ defaults_networks:
       subnet: 192.168.102.208/28
     sphinx:
       subnet: 192.168.102.224/28
+    lam:
+      subnet: 192.168.103.0/28
+    phpldapadmin:
+      subnet: 192.168.103.16/28
+    fusiondirectory:
+      subnet: 192.168.103.32/28
+      
     # /24 Networks / 254 Usable Clients
     bigbluebutton:
       subnet: 10.7.7.0/24 # This variable does not have an impact. It's just there for documentation reasons, because this network is used in bbb

roles/docker-lam/tasks/main.yml

@@ -0,0 +1,13 @@
+- name: "include docker-compose role"
+  include_role: 
+    name: docker-compose
+
+- name: "include role nginx-domain-setup for {{application_id}}"
+  include_role:
+    name: nginx-domain-setup
+  vars:
+    domain: 	"{{ domains[application_id] }}"
+    http_port: 	"{{ ports.localhost.http[application_id] }}"
+  
+- name: "copy docker-compose.yml and env file"
+  include_tasks: copy-docker-compose-and-env.yml

roles/docker-lam/templates/docker-compose.yml.j2

@@ -0,0 +1,18 @@
+services:
+
+{% include 'roles/docker-oauth2-proxy/templates/container.yml.j2' %}
+
+  application:
+    container_name: {{ application_id }}
+    logging:
+      driver: journald
+    restart: {{docker_restart_policy}}
+    image: ghcr.io/ldapaccountmanager/lam:{{applications[application_id].version}}
+    ports:
+      - 127.0.0.1:{{ports.localhost.http[application_id]}}:80 
+{% include 'roles/docker-compose/templates/services/base.yml.j2' %}
+{% include 'templates/docker/container/networks.yml.j2' %}
+
+{# include 'templates/docker/compose/volumes.yml.j2' #}
+
+{% include 'templates/docker/compose/networks.yml.j2' %}

roles/docker-lam/templates/env.j2

@@ -0,0 +1,14 @@
+# See all variables here: 
+# https://github.com/LDAPAccountManager/lam/blob/develop/lam-packaging/docker/.env  
+      
+# Basic Configuration   
+LAM_PASSWORD=               {{applications[application_id].administrator_password}}    # LAM configuration master password and password for server profile "lam
+     
+# Database
+LAM_CONFIGURATION_DATABASE= files                                               # configuration database (files or mysql) @todo implement mariadb
+
+# LDAP Configuration
+LDAP_SERVER=                {{ldap.server.domain}}                              # domain of LDAP database root entry
+LDAP_BASE_DN=               {{ldap.dn.root}}                                    # LDAP base DN to overwrite value generated by LDAP_DOMAIN
+LDAP_USER=                  {{ldap.dn.administrator}}                           # LDAP admin user (set as login user for LAM)
+LDAP_ADMIN_PASSWORD=        {{ldap.bind_credential}}                            # LDAP admin password

roles/docker-lam/vars/main.yml

@@ -0,0 +1 @@
+application_id: "lam"

roles/docker-ldap/tasks/lam.yml

@@ -1,33 +0,0 @@
-- name: "load lam variables"
-  include_vars:
-    file: lam.yml
-
-- name: "Ensure LAM profiles directory exists"
-  file:
-    path: "{{ lam_profiles_dir }}"
-    state: directory
-    mode: '0755'
-    recurse: true
-
-#- name: "create {{docker_compose.directories.env}}lam.env"
-#  template: 
-#    src:  "lam/env.j2" 
-#    dest: "{{docker_compose.directories.env}}lam.env"
-#    mode: '770'
-#    force: yes
-#  notify: docker compose project setup
-#
-#- name: "create default.group to enable groupOfNames in LAM"
-#  template:
-#    src: "lam/default.group.j2"
-#    dest: "{{ lam_profiles_dir }}/default.group"
-#    mode: '0644'
-#  notify: docker compose project setup
-#
-#- name: "Create groupOfNames.conf to enable groupOfNames as base module in LAM"
-#  template:
-#    src: "lam/groupOfNames.conf.j2"
-#    dest: "{{ lam_profiles_dir }}/groupOfNames.conf"
-#    mode: '0644'
-
-

roles/docker-ldap/tasks/main.yml

@@ -3,13 +3,6 @@
   include_role: 
     name: docker-compose
 
-- name: "include role nginx-domain-setup for {{application_id}}"
-  include_role:
-    name: nginx-domain-setup
-  vars:
-    domain: 	"{{ domains[application_id] }}"
-    http_port: 	"{{ ports.localhost.http[application_id] }}"
-
 - name: Create {{domains[application_id]}}.conf if LDAP is exposed to internet
   template: 
     src:  "nginx.stream.conf.j2" 
@@ -30,19 +23,6 @@
     ipam_config:
       - subnet: "{{ networks.local.central_ldap.subnet }}"
   
-- name: "create {{docker_compose.directories.env}}phpldapadmin.env"
-  template: 
-    src:  "phpldapadmin.env.j2" 
-    dest: "{{docker_compose.directories.env}}phpldapadmin.env"
-    mode: '770'
-    force: yes
-  notify: docker compose project setup
-  when: applications.ldap.webinterface == 'phpldapadmin'
-  
-- name: "execute lam tasks"
-  include_tasks: lam.yml
-  when: applications.ldap.webinterface == 'lam'
-
 - name: "copy docker-compose.yml and env file"
   include_tasks: copy-docker-compose-and-env.yml
 

roles/docker-ldap/templates/docker-compose.yml.j2

@@ -2,32 +2,11 @@ services:
 
 {% include 'roles/docker-oauth2-proxy/templates/container.yml.j2' %}
 
-  {{applications.ldap.webinterface}}:
+  application:
-    container_name: {{applications.ldap.webinterface}}
+    image: bitnami/openldap:{{ applications[application_id].version }}
-    logging:
+    container_name: {{ application_id }}
-      driver: journald
-    restart: {{docker_restart_policy}}
-{% if applications.ldap.webinterface == 'lam' %}
-    image: ghcr.io/ldapaccountmanager/lam:{{applications.ldap.lam.version}}
-    ports:
-      - 127.0.0.1:{{ports.localhost.http.ldap}}:80 
-    env_file:
-      - "{{docker_compose.directories.env}}lam.env"
-#    volumes:
-#      - "{{ lam_profiles_dir }}:/var/lib/ldap-account-manager/config/profiles/"
-
-{% elif applications.ldap.webinterface == 'phpldapadmin' %}
-    image: leenooks/phpldapadmin:{{applications.ldap.phpldapadmin.version}}
-    ports:
-      - 127.0.0.1:{{ports.localhost.http.ldap}}:8080
-    env_file:
-      - "{{docker_compose.directories.env}}phpldapadmin.env"
-{% endif %}
-  openldap:
-    image: bitnami/openldap:{{applications.ldap.openldap.version}}
-    container_name: {{applications.ldap.openldap.hostname}}
 {% include 'roles/docker-compose/templates/services/base.yml.j2' %}
-{% if applications.ldap.openldap.network.public | bool %}
+{% if applications[application_id].network.public | bool %}
     ports:
       - 127.0.0.1:{{ports.localhost.ldap.openldap}}:{{ldap_docker_port}}  # Expose just on localhost so that nginx stream proxy can use it
 {% endif %}

roles/docker-ldap/templates/lam/default.group.j2

@@ -1 +0,0 @@
-Modules: groupOfNames

roles/docker-ldap/templates/lam/env.j2

@@ -1,13 +0,0 @@
-# See all variables here: https://github.com/LDAPAccountManager/lam/blob/develop/lam-packaging/docker/.env  
-      
-# Basic Configuration   
-LAM_PASSWORD=               {{applications.ldap.lam.administrator_password}}        # LAM configuration master password and password for server profile "lam
-     
-# Database
-LAM_CONFIGURATION_DATABASE= files                                                   # configuration database (files or mysql) @todo implement mariadb
-
-# LDAP Configuration
-LDAP_SERVER=                {{ldap.server.domain}}                                  # domain of LDAP database root entry
-LDAP_BASE_DN=               {{ldap.dn.root}}                                        # LDAP base DN to overwrite value generated by LDAP_DOMAIN
-LDAP_USER=                  {{ldap.dn.administrator}}                                        # LDAP admin user (set as login user for LAM)
-LDAP_ADMIN_PASSWORD=        {{ldap.bind_credential}}                             # LDAP admin password

roles/docker-ldap/templates/lam/groupOfNames.conf.j2

@@ -1,5 +0,0 @@
-type: group
-module: groupOfNames
-cn: cn
-description: description
-member: member

roles/docker-ldap/vars/lam.yml

@@ -1 +0,0 @@
-lam_profiles_dir: "{{ docker_compose.directories.volumes }}lam/config/profiles/"

roles/docker-phpldapadmin/tasks/main.yml

@@ -0,0 +1,13 @@
+- name: "include docker-compose role"
+  include_role: 
+    name: docker-compose
+
+- name: "include role nginx-domain-setup for {{application_id}}"
+  include_role:
+    name: nginx-domain-setup
+  vars:
+    domain: 	"{{ domains[application_id] }}"
+    http_port: 	"{{ ports.localhost.http[application_id] }}"
+  
+- name: "copy docker-compose.yml and env file"
+  include_tasks: copy-docker-compose-and-env.yml

roles/docker-phpldapadmin/templates/docker-compose.yml.j2

@@ -0,0 +1,19 @@
+services:
+
+{% include 'roles/docker-oauth2-proxy/templates/container.yml.j2' %}
+
+  application:
+    container_name: {{ application_id }}
+    logging:
+      driver: journald
+    restart: {{docker_restart_policy}}
+    image: leenooks/phpldapadmin:{{applications[application_id].version}}
+    ports:
+      - 127.0.0.1:{{ports.localhost.http[application_id]}}:8080
+{% include 'roles/docker-compose/templates/services/base.yml.j2' %}
+{% include 'templates/docker/container/networks.yml.j2' %}
+
+{% include 'templates/docker/compose/volumes.yml.j2' %}
+  data:
+
+{% include 'templates/docker/compose/networks.yml.j2' %}

roles/docker-phpldapadmin/vars/main.yml

@@ -0,0 +1 @@
+application_id: "phpldapadmin"