openldap: Install a custom DB_CONFIG

openldap-server/defaults/main.yml

@@ -11,6 +11,9 @@ openldap_pkg_list:
   - ldapscripts
   - db-util
 
+# DB_CONFIG options 
+openldap_db_set_cachesize: '0 524288000 1'
+
 openldap_slapd_services: 'ldap:/// ldapi:///'
 openldap_slapd_tcp_port: 389
 openldap_slapd_ssl_port: 636

openldap-server/tasks/openldap_initializazion.yml

@@ -1,23 +1,20 @@
 ---
+- block: 
   - name: Install the apparmor additional configuration if we are going to use letsencrypt
     copy: src=usr.sbin.slapd.apparmor dest=/etc/apparmor.d/local/usr.sbin.slapd force=yes 
     register: slapd_apparmour
     when: openldap_letsencrypt_managed
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Restart apparmor
     service: name=apparmor state=restarted
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Install the ldif file needed to change the BASE DN and the Root DN
     template: src=base-dn.ldif.j2 dest=/etc/ldap/schema/base-dn.ldif owner=root group=root mode=0400
     register: base_dn_ldif
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Change the Base DN and Root DN
     shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/base-dn.ldif
     when: base_dn_ldif is changed
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Generate the local admin password
     shell: slappasswd -h {SSHA} -s {{ slapd_admin_pwd }} > /root/.slapdadmin ; chmod 400 /root/.slapdadmin
@@ -25,43 +22,40 @@
       creates: /root/.slapdadmin
     when: slapd_admin_pwd is defined
     register: admin_pass_file
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Copy the ldif template to set the admin password
     template: src=adminpwd.ldif.j2 dest=/etc/ldap/adminpwd_ldif.tmpl
     when: slapd_admin_pwd is defined
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Create the ldif file to set the admin password
     shell: export ADMIN_PASS=$( cat /root/.slapdadmin ); sed -e "s/@ADMINPWD@/${ADMIN_PASS}/" /etc/ldap/adminpwd_ldif.tmpl > /etc/ldap/adminpwd.ldif ; chmod 400 /etc/ldap/adminpwd.ldif
     when: slapd_admin_pwd is defined
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Finally set the admin password
     shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/adminpwd.ldif
     when: admin_pass_file is changed
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Copy the monitor ldif file
     template: src={{ item }}.j2 dest=/etc/ldap/schema/{{ item }}
     with_items: '{{ openldap_base_schemas | default([]) }}'
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Install some default schemas
     shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed
     args:
       creates: '/etc/ldap/schema/{{ item }}.installed'
     with_items: '{{ openldap_base_schemas | default([]) }}'
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Install some additional schemas
     shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed
     args:
       creates: '/etc/ldap/schema/{{ item }}.installed'
     with_items: '{{ openldap_additional_schemas | default([]) }}'
-  tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 
   - name: Install the default environment for slapd
     template: src=slapd-default.j2 dest=/etc/default/slapd owner=root group=root mode=0644
+    
+  - name: Install the DB_CONFIG settings
+    template: src=DB_CONFIG.j2 dest=/var/lib/ldap/DB_CONFIG owner=openldap group=openldap mode=0644
+
   tags: [ 'ldap_server', 'ldap', 'ldap_conf' ]
 

openldap-server/tasks/openldap_master_setup.yml

@@ -6,6 +6,9 @@
   - name: Create the accesslog directory
     file: dest=/var/lib/ldap/accesslog state=directory owner=openldap group=openldap
 
+  - name: Install the DB_CONFIG settings into the accesslog directory
+    template: src=DB_CONFIG.j2 dest=/var/lib/ldap/accesslog/DB_CONFIG owner=openldap group=openldap mode=0644
+
   - name: Install the accesslog and syncprov configuration
     shell: ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/{{ item }} ; touch /etc/ldap/schema/.{{ item }}.installed
     args:

openldap-server/templates/DB_CONFIG.j2

@@ -0,0 +1,5 @@
+set_cachesize {{ openldap_db_set_cachesize }}
+set_lk_max_objects 1500
+set_lk_max_locks 3000
+set_lk_max_lockers 1500
+set_flags DB_LOG_AUTOREMOVE