mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c925150848
OpenBao 2.7 removed the builtin LDAP auth engine from the server binary (openbao/openbao GH-3882). `bao auth enable ldap` answered "plugin not found in the catalog: ldap" and the deploy stopped there. The role now builds its own image. A multi-stage Dockerfile copies the openbao-plugin-auth-ldap binary out of the image declared as the `auth-ldap` service entry into /opt/openbao/plugins. A second server config file, plugins.hcl, names that directory and registers the plugin declaratively. It sets plugin_auto_register = true explicitly: the image starts the server with a config directory, and on that path 2.7.1 does not apply the documented default, so without the line the catalog stays empty. The Dockerfile sets the file mode in a helper stage instead of COPY --chmod, which only BuildKit accepts. The mount is enabled with -plugin-version=latest, so it follows whichever plugin version the image ships. A mount created by the former builtin engine is tuned and reloaded onto the plugin, which needs `update` on sys/plugins/reload/backend in the ansible-admin policy. The LDAP tasks move into tasks/addons/auth-ldap.yml and the plugin is declared under meta/addons as a required addon bridged to `ldap`. Its Playwright spec logs in through the mount and asserts that sys/auth reports an external running plugin version. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
27 lines
1.3 KiB
Django/Jinja
27 lines
1.3 KiB
Django/Jinja
{% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
|
|
{% set service_update_order = 'stop-first' %}
|
|
{% set service_name = 'openbao' %}
|
|
{{ service_name }}:
|
|
{{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
|
|
args:
|
|
OPENBAO_IMAGE: "{{ OPENBAO_IMAGE }}"
|
|
OPENBAO_VERSION: "{{ OPENBAO_VERSION }}"
|
|
OPENBAO_LDAP_PLUGIN_IMAGE: "{{ OPENBAO_LDAP_PLUGIN_IMAGE }}"
|
|
OPENBAO_LDAP_PLUGIN_VERSION: "{{ OPENBAO_LDAP_PLUGIN_VERSION }}"
|
|
OPENBAO_LDAP_PLUGIN_BINARY: "{{ OPENBAO_LDAP_PLUGIN_BINARY }}"
|
|
OPENBAO_PLUGIN_DIR: "{{ OPENBAO_PLUGIN_DIR_DOCKER }}"
|
|
{{ lookup('container_image', application_id, 'openbao', version=OPENBAO_IMAGE_TAG) }}
|
|
{{ lookup('compose_only', 'container_name', OPENBAO_NAME) }}
|
|
{% include 'roles/sys-svc-container/templates/base.yml.j2' %}
|
|
{{ lookup('container_ports', ['openbao', 'http', DOCKER_BIND_HOST]) | indent(4) }}
|
|
{{ lookup('container_healthcheck', service_name) | indent(4) }}
|
|
command:
|
|
- "server"
|
|
{{ lookup('container_depends_on', application_id) | indent(4) }}
|
|
{{ lookup('container_volumes', service_name) | indent(4) }}
|
|
{{ lookup('container_networks') | indent(4) }}
|
|
|
|
{{ lookup('compose_volumes') }}
|
|
|
|
{{ lookup('compose_networks') }}
|