first version of ldap server role

roles/ldap/server/tasks/main.yml

@@ -0,0 +1,139 @@
+---
+- name: install packages
+  package:
+    name: openldap-servers
+    state: installed
+
+- name: fix selinux context from ldap data directory
+  sefcontext:
+    path: /export/ldap(/.*)?
+    setype: slapd_db_t
+
+- name: create ldap data directory
+  file:
+    path: /export/ldap
+    state: directory
+    mode: 0700
+    owner: ldap
+    group: ldap
+
+- name: link ldap data directory
+  file:
+    path: /srv/ldap
+    src: /export/ldap
+    state: link
+    owner: root
+    group: root
+    follow: false
+
+- name: remove nss cert databases
+  file:
+    path: "/etc/openldap/certs/{{ item }}"
+    state: absent
+  with_items:
+    - cert8.db
+    - key3.db
+    - password
+    - secmod.db
+
+- name: copy ldap server certificates
+  copy:
+    dest: "{{ tls_certs }}/{{ ldap_server_cert }}.crt"
+    src: "/srv/letsencrypt/live/{{ ldap_server_cert }}/cert.pem"
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+  notify: restart slapd
+- name: copy ldap server key
+  copy:
+    dest: "{{ tls_private }}/{{ ldap_server_cert }}.key"
+    src: "/srv/letsencrypt/live/{{ ldap_server_cert }}/privkey.pem"
+    mode: 0640
+    owner: root
+    group: ldap
+  notify: restart slapd
+- name: copy ldap server certificate chain
+  copy:
+    dest: "{{ tls_certs }}/{{ ldap_server_cert }}-chain.crt"
+    src: "/srv/letsencrypt/live/{{ ldap_server_cert }}/chain.pem"
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+  notify: restart slapd
+- name: get ldap server chain hash
+  command: "openssl x509 -in /srv/letsencrypt/live/{{ ldap_server_cert }}/chain.pem -noout -hash"
+  delegate_to: localhost
+  register: result
+  changed_when: false
+- name: link server chain certificate
+  file:
+    path: "/etc/openldap/certs/{{ result.stdout }}.0"
+    src: "{{ tls_certs }}/{{ ldap_server_cert }}-chain.crt"
+    owner: root
+    group: "{{ ansible_wheel }}"
+    follow: false
+    state: link
+- name: link local ca certificate
+  file:
+    path: "/etc/openldap/certs/{{ pki_cacert_hash }}.0"
+    src: "{{ tls_certs }}/ca.crt"
+    owner: root
+    group: "{{ ansible_wheel }}"
+    follow: false
+    state: link
+
+- name: create slapd sysconfig  file
+  copy:
+    dest: /etc/sysconfig/slapd
+    src: slapd.sysconfig
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+  notify: restart slapd
+
+- name: add custom schema files
+  copy:
+    dest: "/etc/openldap/schema/{{ item }}"
+    src: "{{ item }}"
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+  with_items:
+    - kerberos.schema         # centos krb5-server-ldap 1.15.1
+    - openssh-lpk.schema      # via google, no original source found
+    - rfc2307bis.schema       # rfc2307bis version 2
+    - samba.schema            # centos samba 4.8.3
+  notify: restart slapd
+
+- name: copy check password config
+  copy:
+    dest: /etc/openldap/check_password.conf
+    src: check_password.conf
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+
+- name: create slapd main config
+  template:
+    dest: /etc/openldap/slapd.conf
+    src: slapd.conf.j2
+    mode: 0640
+    owner: root
+    group: ldap
+  notify: restart slapd
+
+- name: add ldap aliases for root
+  blockinfile:
+    path: /root/.bash_profile
+    block: |
+      # use slapd.conf by default for slap commands
+      alias slapadd='echo "run as user ldap"'
+      alias slapcat='slapcat -f /etc/openldap/slapd.conf'
+      alias slapindex='echo "run as user ldap"'
+      alias slaptest='slaptest -f /etc/openldap/slapd.conf'
+
+- name: enable slapd service
+  service:
+    name: slapd
+    state: started
+    enabled: true