diff --git a/openldap-server/defaults/main.yml b/openldap-server/defaults/main.yml index 5b2b3e85..5061121e 100644 --- a/openldap-server/defaults/main.yml +++ b/openldap-server/defaults/main.yml @@ -11,6 +11,9 @@ openldap_pkg_list: - ldapscripts - db-util +# DB_CONFIG options +openldap_db_set_cachesize: '0 524288000 1' + openldap_slapd_services: 'ldap:/// ldapi:///' openldap_slapd_tcp_port: 389 openldap_slapd_ssl_port: 636 diff --git a/openldap-server/tasks/openldap_initializazion.yml b/openldap-server/tasks/openldap_initializazion.yml index 32759414..d424dde2 100644 --- a/openldap-server/tasks/openldap_initializazion.yml +++ b/openldap-server/tasks/openldap_initializazion.yml @@ -1,67 +1,61 @@ --- -- name: Install the apparmor additional configuration if we are going to use letsencrypt - copy: src=usr.sbin.slapd.apparmor dest=/etc/apparmor.d/local/usr.sbin.slapd force=yes - register: slapd_apparmour - when: openldap_letsencrypt_managed +- block: + - name: Install the apparmor additional configuration if we are going to use letsencrypt + copy: src=usr.sbin.slapd.apparmor dest=/etc/apparmor.d/local/usr.sbin.slapd force=yes + register: slapd_apparmour + when: openldap_letsencrypt_managed + + - name: Restart apparmor + service: name=apparmor state=restarted + + - name: Install the ldif file needed to change the BASE DN and the Root DN + template: src=base-dn.ldif.j2 dest=/etc/ldap/schema/base-dn.ldif owner=root group=root mode=0400 + register: base_dn_ldif + + - name: Change the Base DN and Root DN + shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/base-dn.ldif + when: base_dn_ldif is changed + + - name: Generate the local admin password + shell: slappasswd -h {SSHA} -s {{ slapd_admin_pwd }} > /root/.slapdadmin ; chmod 400 /root/.slapdadmin + args: + creates: /root/.slapdadmin + when: slapd_admin_pwd is defined + register: admin_pass_file + + - name: Copy the ldif template to set the admin password + template: src=adminpwd.ldif.j2 dest=/etc/ldap/adminpwd_ldif.tmpl + when: slapd_admin_pwd is defined + + - name: Create the ldif file to set the admin password + shell: export ADMIN_PASS=$( cat /root/.slapdadmin ); sed -e "s/@ADMINPWD@/${ADMIN_PASS}/" /etc/ldap/adminpwd_ldif.tmpl > /etc/ldap/adminpwd.ldif ; chmod 400 /etc/ldap/adminpwd.ldif + when: slapd_admin_pwd is defined + + - name: Finally set the admin password + shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/adminpwd.ldif + when: admin_pass_file is changed + + - name: Copy the monitor ldif file + template: src={{ item }}.j2 dest=/etc/ldap/schema/{{ item }} + with_items: '{{ openldap_base_schemas | default([]) }}' + + - name: Install some default schemas + shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed + args: + creates: '/etc/ldap/schema/{{ item }}.installed' + with_items: '{{ openldap_base_schemas | default([]) }}' + + - name: Install some additional schemas + shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed + args: + creates: '/etc/ldap/schema/{{ item }}.installed' + with_items: '{{ openldap_additional_schemas | default([]) }}' + + - name: Install the default environment for slapd + template: src=slapd-default.j2 dest=/etc/default/slapd owner=root group=root mode=0644 + + - name: Install the DB_CONFIG settings + template: src=DB_CONFIG.j2 dest=/var/lib/ldap/DB_CONFIG owner=openldap group=openldap mode=0644 + tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] -- name: Restart apparmor - service: name=apparmor state=restarted - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Install the ldif file needed to change the BASE DN and the Root DN - template: src=base-dn.ldif.j2 dest=/etc/ldap/schema/base-dn.ldif owner=root group=root mode=0400 - register: base_dn_ldif - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Change the Base DN and Root DN - shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/base-dn.ldif - when: base_dn_ldif is changed - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Generate the local admin password - shell: slappasswd -h {SSHA} -s {{ slapd_admin_pwd }} > /root/.slapdadmin ; chmod 400 /root/.slapdadmin - args: - creates: /root/.slapdadmin - when: slapd_admin_pwd is defined - register: admin_pass_file - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Copy the ldif template to set the admin password - template: src=adminpwd.ldif.j2 dest=/etc/ldap/adminpwd_ldif.tmpl - when: slapd_admin_pwd is defined - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Create the ldif file to set the admin password - shell: export ADMIN_PASS=$( cat /root/.slapdadmin ); sed -e "s/@ADMINPWD@/${ADMIN_PASS}/" /etc/ldap/adminpwd_ldif.tmpl > /etc/ldap/adminpwd.ldif ; chmod 400 /etc/ldap/adminpwd.ldif - when: slapd_admin_pwd is defined - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Finally set the admin password - shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/adminpwd.ldif - when: admin_pass_file is changed - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Copy the monitor ldif file - template: src={{ item }}.j2 dest=/etc/ldap/schema/{{ item }} - with_items: '{{ openldap_base_schemas | default([]) }}' - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Install some default schemas - shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed - args: - creates: '/etc/ldap/schema/{{ item }}.installed' - with_items: '{{ openldap_base_schemas | default([]) }}' - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Install some additional schemas - shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed - args: - creates: '/etc/ldap/schema/{{ item }}.installed' - with_items: '{{ openldap_additional_schemas | default([]) }}' - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - -- name: Install the default environment for slapd - template: src=slapd-default.j2 dest=/etc/default/slapd owner=root group=root mode=0644 - tags: [ 'ldap_server', 'ldap', 'ldap_conf' ] - diff --git a/openldap-server/tasks/openldap_master_setup.yml b/openldap-server/tasks/openldap_master_setup.yml index 6863a047..5fb972f0 100644 --- a/openldap-server/tasks/openldap_master_setup.yml +++ b/openldap-server/tasks/openldap_master_setup.yml @@ -6,6 +6,9 @@ - name: Create the accesslog directory file: dest=/var/lib/ldap/accesslog state=directory owner=openldap group=openldap + - name: Install the DB_CONFIG settings into the accesslog directory + template: src=DB_CONFIG.j2 dest=/var/lib/ldap/accesslog/DB_CONFIG owner=openldap group=openldap mode=0644 + - name: Install the accesslog and syncprov configuration shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed args: diff --git a/openldap-server/templates/DB_CONFIG.j2 b/openldap-server/templates/DB_CONFIG.j2 new file mode 100644 index 00000000..bd956396 --- /dev/null +++ b/openldap-server/templates/DB_CONFIG.j2 @@ -0,0 +1,5 @@ +set_cachesize {{ openldap_db_set_cachesize }} +set_lk_max_objects 1500 +set_lk_max_locks 3000 +set_lk_max_lockers 1500 +set_flags DB_LOG_AUTOREMOVE