---
# ############################################
# ## LDAP                                  ###
# ############################################
# Developer guide for the LDAP variable tree, DN layout, attribute SPOT, and
# OIDC pairing rules:
# @see docs/contributing/design/iam/ldap.md

# Helper Variables:
# Keep in mind to mapp this variables if there is ever the possibility for the user to define them in the inventory
LDAP_DN_BASE: "{{ DOMAIN_PRIMARY.split('.') | map('regex_replace', '^(.*)$', 'dc=\\1') | join(',') }}"
_ldap_docker_network_enabled: "{{ lookup('config','svc-db-openldap', 'services.openldap.network.compose') }}"
_ldap_protocol: "{{ 'ldap' if _ldap_docker_network_enabled else 'ldaps' }}"
_ldap_server_port: "{{ lookup('config', 'svc-db-openldap', 'services.openldap.ports.local.' ~ _ldap_protocol) if _ldap_docker_network_enabled else lookup('config',
  'svc-db-openldap', 'services.openldap.ports.public.' ~ _ldap_protocol) }}"
_ldap_name: "{{ lookup('config','svc-db-openldap', 'services.openldap.name') }}"
_ldap_domain: "{{ DOMAIN_PRIMARY }}" # LDAP is jsut listening to a port not to a dedicated domain, so primary domain should be sufficient
_ldap_user_id: "uid"
_ldap_filters_users_all: "(|(objectclass=inetOrgPerson))"

LDAP:
  DN:
    ROOT: "{{ LDAP_DN_BASE }}"
    ADMINISTRATOR:
      DATA: "cn={{ lookup('users', 'administrator').username }},{{ LDAP_DN_BASE }}"

      CONFIGURATION: "cn={{ lookup('users', 'administrator').username }},cn=config"

    OU:
      USERS: "ou=users,{{ LDAP_DN_BASE }}"
      GROUPS: "ou=groups,{{ LDAP_DN_BASE }}"
      ROLES: "ou=roles,{{ LDAP_DN_BASE }}"

  BIND_CREDENTIAL: "{{ lookup('config','svc-db-openldap', 'secrets.credentials.administrator_database_password') }}"
  SERVER:
    DOMAIN: "{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}" # Mapping for public or locale access
    PORT: "{{ _ldap_server_port }}"
    URI: "{{ _ldap_protocol }}://{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}:{{ _ldap_server_port }}"
    SECURITY: "" # TLS, SSL - Leave empty for none
  NETWORK:
    LOCAL: "{{ _ldap_docker_network_enabled }}" # Uses the application configuration to define if local network should be available or not
  USER:
    OBJECTS:
      STRUCTURAL:
        - person # Structural Classes define the core identity of an entry:
        - inetOrgPerson # An extension of person adding internet-related attributes
        - posixAccount # Provides UNIX account attributes (uidNumber, gidNumber,
      AUXILIARY:
        NEXTCLOUD_USER: "nextcloudUser" # Auxiliary Classes attach optional attributes without
        SSH_PUBLIC_KEY: "ldapPublicKey" # Allows storing SSH public keys for services like Gitea.
    ATTRIBUTES:
      ID: "{{ _ldap_user_id }}"
      MAIL: "mail"
      FULLNAME: "cn"
      FIRSTNAME: "givenName"
      SURNAME: "sn"
      SSH_PUBLIC_KEY: "sshPublicKey"
      NEXTCLOUD_QUOTA: "nextcloudQuota"
  FILTERS:
    USERS:
      LOGIN: "(&{{ _ldap_filters_users_all }}({{_ldap_user_id}}=%{{_ldap_user_id}}))"
      ALL: "{{ _ldap_filters_users_all }}"
  RBAC:
    FLAVORS:
      - groupOfNames
    EMPTY_MEMBER_DN: "cn=__empty__,{{ LDAP.DN.ROOT }}"