From c4bbbba933cff29d990339147e5b41e818ea5bbf Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 6 Aug 2026 19:35:23 +0200
Subject: [PATCH] fix(svc-db-openldap): let the cn=config check decide, not
 slaptest's exit

slaptest converts slapd.conf into slapd.d and only then runs slap_startup,
which opens the database that this very entrypoint seeds a few lines later.
On a fresh volume that open fails, slaptest exits 1 with "Restore from
backup!", and under set -e the container dies. It heals by accident because
slapd.d is already written, so the task swarm starts next takes the
has_cn_config branch, but it costs a dead task and its startup delay on every
fresh volume.

Measured against slaptest 2.6: the failing run writes cn=config.ldif,
olcDatabase={-1}frontend, {0}config, {1}mdb and every schema, so the
conversion is complete and only the exit code is misleading. A parse error
behaves the opposite way and writes nothing at all, as does an unwritable
target directory, so the has_cn_config check right below still catches every
case where the conversion did not happen.

Not -u: that switch makes slaptest a pure dry run. It exits 0 and leaves the
target directory empty, which would turn a single dead task into a container
that can never start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 roles/svc-db-openldap/files/entrypoint.sh | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/roles/svc-db-openldap/files/entrypoint.sh b/roles/svc-db-openldap/files/entrypoint.sh
index a75993acc8..9bbbf0134e 100644
--- a/roles/svc-db-openldap/files/entrypoint.sh
+++ b/roles/svc-db-openldap/files/entrypoint.sh
@@ -67,14 +67,12 @@ moduleload      refint
 pidfile         /run/slapd/slapd.pid
 argsfile        /run/slapd/slapd.args
 
-# --- cn=config database ---
 database        config
 access to *
   by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
   by dn.exact="${LDAP_ROOT_DN}" manage
   by * none
 
-# --- main data database ---
 database        mdb
 maxsize         1073741824
 suffix          "${LDAP_SUFFIX}"
@@ -82,14 +80,12 @@ rootdn          "${LDAP_ROOT_DN}"
 rootpw          ${hash}
 directory       "${DB_DIR}"
 
-# Allow binds for normal users (needed for Keycloak / simple bind)
 access to attrs=userPassword
   by dn.exact="${LDAP_ROOT_DN}" manage
   by self write
   by anonymous auth
   by * none
 
-# Generic access (tighten later if needed)
 access to *
   by dn.exact="${LDAP_ROOT_DN}" manage
   by * read
@@ -100,15 +96,13 @@ bootstrap_cn_config_via_slaptest() {
   rm -rf "${SLAPD_D_DIR:?}/"*
   mkdir -p "${SLAPD_D_DIR}" /run/slapd "${DB_DIR}"
 
-  # important: make sure openldap can read/write everything afterwards
   chown -R openldap:openldap /run/slapd "${DB_DIR}" "${SLAPD_D_DIR}"
 
   write_slapd_conf
 
   log "bootstrap slapd.d via slaptest for suffix ${LDAP_SUFFIX}"
-  slaptest -f "${TMP_CONF}" -F "${SLAPD_D_DIR}" >/dev/null
+  slaptest -f "${TMP_CONF}" -F "${SLAPD_D_DIR}" >/dev/null || true
 
-  # slaptest creates root-owned files → fix
   chown -R openldap:openldap "${SLAPD_D_DIR}"
 
   if ! has_cn_config; then
@@ -143,7 +137,6 @@ o: ${dc}
 dc: ${dc}
 EOF
 
-  # After slapadd, ensure permissions are correct (locks are sensitive)
   chown -R openldap:openldap "${DB_DIR}"
   chmod 700 "${DB_DIR}" || true
 
@@ -156,7 +149,6 @@ EOF
 
 log "starting entrypoint (suffix=${LDAP_SUFFIX}, rootdn=${LDAP_ROOT_DN})"
 
-# Always ensure runtime dirs exist and are writable
 mkdir -p /run/slapd "${DB_DIR}" "${SLAPD_D_DIR}"
 chown -R openldap:openldap /run/slapd "${DB_DIR}" "${SLAPD_D_DIR}"
 
@@ -173,7 +165,6 @@ fi
 
 init_mdb_files_if_needed
 
-# Final permission sweep (this is often the real fix)
 chown -R openldap:openldap /run/slapd "${DB_DIR}" "${SLAPD_D_DIR}"
 chmod 700 "${DB_DIR}" || true