mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
f7868ef49a
f713ba835 rewrote the BIND_CREDENTIAL lookup onto secrets.credentials and left a doubled blank line above it. Autoformat collected it after that commit had already landed. No key, value or indentation is touched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
67 lines
3.1 KiB
YAML
67 lines
3.1 KiB
YAML
---
|
|
# ############################################
|
|
# ## LDAP ###
|
|
# ############################################
|
|
# Developer guide for the LDAP variable tree, DN layout, attribute SPOT, and
|
|
# OIDC pairing rules:
|
|
# @see docs/contributing/design/iam/ldap.md
|
|
|
|
# Helper Variables:
|
|
# Keep in mind to mapp this variables if there is ever the possibility for the user to define them in the inventory
|
|
LDAP_DN_BASE: "{{ DOMAIN_PRIMARY.split('.') | map('regex_replace', '^(.*)$', 'dc=\\1') | join(',') }}"
|
|
_ldap_docker_network_enabled: "{{ lookup('config','svc-db-openldap', 'services.openldap.network.compose') }}"
|
|
_ldap_protocol: "{{ 'ldap' if _ldap_docker_network_enabled else 'ldaps' }}"
|
|
_ldap_server_port: "{{ lookup('config', 'svc-db-openldap', 'services.openldap.ports.local.' ~ _ldap_protocol) if _ldap_docker_network_enabled else lookup('config',
|
|
'svc-db-openldap', 'services.openldap.ports.public.' ~ _ldap_protocol) }}"
|
|
_ldap_name: "{{ lookup('config','svc-db-openldap', 'services.openldap.name') }}"
|
|
_ldap_domain: "{{ DOMAIN_PRIMARY }}" # LDAP is jsut listening to a port not to a dedicated domain, so primary domain should be sufficient
|
|
_ldap_user_id: "uid"
|
|
_ldap_filters_users_all: "(|(objectclass=inetOrgPerson))"
|
|
|
|
LDAP:
|
|
DN:
|
|
ROOT: "{{ LDAP_DN_BASE }}"
|
|
ADMINISTRATOR:
|
|
DATA: "cn={{ lookup('users', 'administrator').username }},{{ LDAP_DN_BASE }}"
|
|
|
|
CONFIGURATION: "cn={{ lookup('users', 'administrator').username }},cn=config"
|
|
|
|
OU:
|
|
USERS: "ou=users,{{ LDAP_DN_BASE }}"
|
|
GROUPS: "ou=groups,{{ LDAP_DN_BASE }}"
|
|
ROLES: "ou=roles,{{ LDAP_DN_BASE }}"
|
|
|
|
BIND_CREDENTIAL: "{{ lookup('config','svc-db-openldap', 'secrets.credentials.administrator_database_password') }}"
|
|
SERVER:
|
|
DOMAIN: "{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}" # Mapping for public or locale access
|
|
PORT: "{{ _ldap_server_port }}"
|
|
URI: "{{ _ldap_protocol }}://{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}:{{ _ldap_server_port }}"
|
|
SECURITY: "" # TLS, SSL - Leave empty for none
|
|
NETWORK:
|
|
LOCAL: "{{ _ldap_docker_network_enabled }}" # Uses the application configuration to define if local network should be available or not
|
|
USER:
|
|
OBJECTS:
|
|
STRUCTURAL:
|
|
- person # Structural Classes define the core identity of an entry:
|
|
- inetOrgPerson # An extension of person adding internet-related attributes
|
|
- posixAccount # Provides UNIX account attributes (uidNumber, gidNumber,
|
|
AUXILIARY:
|
|
NEXTCLOUD_USER: "nextcloudUser" # Auxiliary Classes attach optional attributes without
|
|
SSH_PUBLIC_KEY: "ldapPublicKey" # Allows storing SSH public keys for services like Gitea.
|
|
ATTRIBUTES:
|
|
ID: "{{ _ldap_user_id }}"
|
|
MAIL: "mail"
|
|
FULLNAME: "cn"
|
|
FIRSTNAME: "givenName"
|
|
SURNAME: "sn"
|
|
SSH_PUBLIC_KEY: "sshPublicKey"
|
|
NEXTCLOUD_QUOTA: "nextcloudQuota"
|
|
FILTERS:
|
|
USERS:
|
|
LOGIN: "(&{{ _ldap_filters_users_all }}({{_ldap_user_id}}=%{{_ldap_user_id}}))"
|
|
ALL: "{{ _ldap_filters_users_all }}"
|
|
RBAC:
|
|
FLAVORS:
|
|
- groupOfNames
|
|
EMPTY_MEMBER_DN: "cn=__empty__,{{ LDAP.DN.ROOT }}"
|