---
- name: 🔌 Load memberof module in OpenLDAP (cn=config via EXTERNAL)
  ansible.builtin.shell: >-
    container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
    ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
    -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/01_member_of_configuration.ldif'] | path_join }}"
  listen:
    - "import-configuration-ldif-files"
  register: r
  failed_when: >-
    r.rc != 0 and
    not (r.stderr | default('') | ldap_modify_noop)

- name: 🔌 Load refint module in OpenLDAP (cn=config via EXTERNAL)
  ansible.builtin.shell: >-
    container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
    ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
    -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/04_refint_module.ldif'] | path_join }}"
  listen:
    - "import-configuration-ldif-files"
  register: r
  failed_when: >-
    r.rc != 0 and
    not (r.stderr | default('') | ldap_modify_noop)

- name: ➕ Add memberof overlay (cn=config via EXTERNAL)
  ansible.builtin.shell: >-
    container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
    ldapadd -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
    -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/02_member_of_configuration.ldif'] | path_join }}"
  listen:
    - "import-configuration-ldif-files"
  register: r
  failed_when: r.rc not in [0, 68]

- name: ➕ Add refint overlay (cn=config via EXTERNAL)
  ansible.builtin.shell: >-
    container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
    ldapadd -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
    -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/03_member_of_configuration.ldif'] | path_join }}"
  listen:
    - "import-configuration-ldif-files"
  register: r
  failed_when: r.rc not in [0, 68]

- name: 📥 Import users, groups, etc. to LDAP (data tree)
  ansible.builtin.shell: >-
    container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }} ldapadd -x
    -D "{{ OPENLDAP_BIND_DN }}"
    -w "{{ OPENLDAP_BIND_PW }}"
    -c
    -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'groups', (item | basename | regex_replace('\.j2$', ''))] | path_join }}"
  listen:
    - "import-groups-ldif-files"
  register: ldapadd_result
  changed_when: "'adding new entry' in ldapadd_result.stdout"
  failed_when: ldapadd_result.rc not in [0, 20, 68, 65]
  loop: "{{ query('fileglob', role_path ~ '/templates/ldif/groups/*.j2') | sort }}"
  loop_control:
    label: "{{ item | basename }}"