mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-09-24 11:06:24 +02:00
Kevin Veen-Birkenbach
208848579d
- Add handlers/main.yml to load memberof/refint modules and import groups via docker exec - Use OPENLDAP_CONTAINER consistently (replace OPENLDAP_NAME) - Rename tasks/ldifs_creation.yml -> tasks/_ldifs_creation.yml and update includes - Drop default param from get_app_conf calls; add explicit meta: flush_handlers - docker-compose: honor OPENLDAP_NETWORK_EXPOSE_LOCAL | bool; minor formatting - env template: formatting/comments consistency - Remove unused 01_rbac_group.ldif.j2; rename 02_rbac_roles -> 01_rbac_roles and fix filter to LDAP - vars: rename OPENLDAP_NAME -> OPENLDAP_CONTAINER; prune LDIF schema type Conversation: https://chatgpt.com/share/68d1d25d-e788-800f-bfb6-13b1f5bc6121
87 lines
2.5 KiB
YAML
87 lines
2.5 KiB
YAML
---
|
|
|
|
- name: "include docker-compose role"
|
|
include_role:
|
|
name: docker-compose
|
|
|
|
- name: Create {{ domains | get_domain(application_id) }}.conf if LDAP is exposed to internet
|
|
template:
|
|
src: "nginx.stream.conf.j2"
|
|
dest: "{{ NGINX.DIRECTORIES.STREAMS }}{{ domains | get_domain(application_id) }}.conf"
|
|
notify: restart openresty
|
|
when: OPENLDAP_NETWORK_SWITCH_PUBLIC | bool
|
|
|
|
- name: Remove {{ domains | get_domain(application_id) }}.conf if LDAP is not exposed to internet
|
|
file:
|
|
path: "{{ NGINX.DIRECTORIES.STREAMS }}{{ domains | get_domain(application_id) }}.conf"
|
|
state: absent
|
|
when: not OPENLDAP_NETWORK_SWITCH_PUBLIC | bool
|
|
|
|
- name: create docker network for LDAP, so that other applications can access it
|
|
community.docker.docker_network:
|
|
name: "{{ OPENLDAP_NETWORK }}"
|
|
state: present
|
|
ipam_config:
|
|
- subnet: "{{ networks.local[application_id].subnet }}"
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: "Wait for LDAP to be available"
|
|
wait_for:
|
|
host: "127.0.0.1"
|
|
port: "{{ ports.localhost.ldap[application_id] }}"
|
|
delay: 5
|
|
timeout: 120
|
|
state: started
|
|
|
|
- name: "Reset LDAP Credentials"
|
|
include_tasks: 01_credentials.yml
|
|
when:
|
|
- OPENLDAP_NETWORK_SWITCH_LOCAL | bool
|
|
- applications | get_app_conf(application_id, 'provisioning.credentials')
|
|
|
|
- name: "create directory {{ OPENLDAP_LDIF_PATH_HOST }}{{ item }}"
|
|
file:
|
|
path: "{{ OPENLDAP_LDIF_PATH_HOST }}{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop: "{{ OPENLDAP_LDIF_TYPES }}"
|
|
|
|
- name: "Import LDIF Configuration"
|
|
include_tasks: _ldifs_creation.yml
|
|
loop:
|
|
- configuration
|
|
loop_control:
|
|
loop_var: folder
|
|
when: applications | get_app_conf(application_id, 'provisioning.configuration')
|
|
|
|
- name: flush LDIF handlers
|
|
meta: flush_handlers
|
|
|
|
- name: install python-ldap
|
|
community.general.pacman:
|
|
name:
|
|
- python-ldap
|
|
state: present
|
|
|
|
- name: "Include Schemas (if enabled)"
|
|
include_tasks: 02_schemas.yml
|
|
when: applications | get_app_conf(application_id, 'provisioning.schemas')
|
|
|
|
- name: "Import LDAP Entries (if enabled)"
|
|
include_tasks: 03_users.yml
|
|
when: applications | get_app_conf(application_id, 'provisioning.users')
|
|
|
|
- name: "Import LDIF Data (if enabled)"
|
|
include_tasks: _ldifs_creation.yml
|
|
loop:
|
|
- groups
|
|
loop_control:
|
|
loop_var: folder
|
|
when: applications | get_app_conf(application_id, 'provisioning.groups')
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: "Add Objects to all users"
|
|
include_tasks: 04_update.yml
|
|
when: applications | get_app_conf(application_id, 'provisioning.update') |