---
- name: 🔍 Query data backend DN (cn=config)
  ansible.builtin.shell: >
    container exec {{ OPENLDAP_CONTAINER_ADDRESS }}
    ldapsearch -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }} -LLL -b cn=config "(olcDatabase=*)" dn
  register: ldap_databases
  delegate_to: "{{ STACK_HOST }}"
  run_once: true
  changed_when: false
  retries: 30
  delay: 5
  until: ldap_databases.rc == 0

- name: 🤔 Determine data backend DN (prefer mdb, fallback hdb)
  ansible.builtin.set_fact:
    openldap_data_backend_dn: >-
      {{
        (
          ldap_databases.stdout_lines
          | select('search', '^dn: olcDatabase=.*mdb,cn=config$')
          | map('regex_replace', '^dn: ', '')
          | list
          | first
          | default('')
        )
        | default(
          (
            ldap_databases.stdout_lines
            | select('search', '^dn: olcDatabase=.*hdb,cn=config$')
            | map('regex_replace', '^dn: ', '')
            | list
            | first
            | default('')
          )
        )
      }}

- name: 🛑 Fail if backend DN could not be detected
  ansible.builtin.fail:
    msg: "Could not detect OpenLDAP data backend DN from cn=config."
  when: openldap_data_backend_dn | default('') | length == 0

- name: ⚙️ Generate hash for desired RootPW
  ansible.builtin.shell: >
    container exec {{ OPENLDAP_CONTAINER_ADDRESS }}
    slappasswd -s "{{ OPENLDAP_BIND_PW }}"
  register: openldap_rootpw_hash
  delegate_to: "{{ STACK_HOST }}"
  run_once: true
  changed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  retries: 30
  delay: 5
  until: openldap_rootpw_hash.rc == 0

- name: 🔧 Set RootDN and RootPW only if bind check failed
  ansible.builtin.shell: |
    container exec -i {{ OPENLDAP_CONTAINER_ADDRESS }} ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }} <<EOF
    dn: {{ openldap_data_backend_dn }}
    changetype: modify
    replace: olcRootDN
    olcRootDN: {{ OPENLDAP_BIND_DN }}
    -
    replace: olcRootPW
    olcRootPW: {{ openldap_rootpw_hash.stdout }}
    EOF
  register: openldap_rootdn_set
  delegate_to: "{{ STACK_HOST }}"
  run_once: true
  changed_when: true
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  retries: 30
  delay: 5
  until: openldap_rootdn_set.rc == 0