mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
f669f56b45
The three credential tasks exec into the container the moment the service reports up, which races the directory's own startup and fails the run. Retry until the exec succeeds instead. The first task also ran slappasswd with the bind password as an argument and the second carried the resulting hash, both in clear text in the task result, so both now honour MASK_CREDENTIALS_IN_LOGS. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
75 lines
2.2 KiB
YAML
75 lines
2.2 KiB
YAML
---
|
|
- name: 🔍 Query data backend DN (cn=config)
|
|
ansible.builtin.shell: >
|
|
container exec {{ OPENLDAP_CONTAINER_ADDRESS }}
|
|
ldapsearch -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }} -LLL -b cn=config "(olcDatabase=*)" dn
|
|
register: ldap_databases
|
|
delegate_to: "{{ STACK_HOST }}"
|
|
run_once: true
|
|
changed_when: false
|
|
retries: 30
|
|
delay: 5
|
|
until: ldap_databases.rc == 0
|
|
|
|
- name: 🤔 Determine data backend DN (prefer mdb, fallback hdb)
|
|
ansible.builtin.set_fact:
|
|
openldap_data_backend_dn: >-
|
|
{{
|
|
(
|
|
ldap_databases.stdout_lines
|
|
| select('search', '^dn: olcDatabase=.*mdb,cn=config$')
|
|
| map('regex_replace', '^dn: ', '')
|
|
| list
|
|
| first
|
|
| default('')
|
|
)
|
|
| default(
|
|
(
|
|
ldap_databases.stdout_lines
|
|
| select('search', '^dn: olcDatabase=.*hdb,cn=config$')
|
|
| map('regex_replace', '^dn: ', '')
|
|
| list
|
|
| first
|
|
| default('')
|
|
)
|
|
)
|
|
}}
|
|
|
|
- name: 🛑 Fail if backend DN could not be detected
|
|
ansible.builtin.fail:
|
|
msg: "Could not detect OpenLDAP data backend DN from cn=config."
|
|
when: openldap_data_backend_dn | default('') | length == 0
|
|
|
|
- name: ⚙️ Generate hash for desired RootPW
|
|
ansible.builtin.shell: >
|
|
container exec {{ OPENLDAP_CONTAINER_ADDRESS }}
|
|
slappasswd -s "{{ OPENLDAP_BIND_PW }}"
|
|
register: openldap_rootpw_hash
|
|
delegate_to: "{{ STACK_HOST }}"
|
|
run_once: true
|
|
changed_when: false
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
retries: 30
|
|
delay: 5
|
|
until: openldap_rootpw_hash.rc == 0
|
|
|
|
- name: 🔧 Set RootDN and RootPW only if bind check failed
|
|
ansible.builtin.shell: |
|
|
container exec -i {{ OPENLDAP_CONTAINER_ADDRESS }} ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }} <<EOF
|
|
dn: {{ openldap_data_backend_dn }}
|
|
changetype: modify
|
|
replace: olcRootDN
|
|
olcRootDN: {{ OPENLDAP_BIND_DN }}
|
|
-
|
|
replace: olcRootPW
|
|
olcRootPW: {{ openldap_rootpw_hash.stdout }}
|
|
EOF
|
|
register: openldap_rootdn_set
|
|
delegate_to: "{{ STACK_HOST }}"
|
|
run_once: true
|
|
changed_when: true
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
retries: 30
|
|
delay: 5
|
|
until: openldap_rootdn_set.rc == 0
|