summaryrefslogtreecommitdiffstats
path: root/roles/common-LDAP/tasks
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common-LDAP/tasks')
-rw-r--r--roles/common-LDAP/tasks/main.yml36
1 files changed, 9 insertions, 27 deletions
diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml
index 43c6bfb..3b8b36c 100644
--- a/roles/common-LDAP/tasks/main.yml
+++ b/roles/common-LDAP/tasks/main.yml
@@ -18,30 +18,11 @@
notify:
- Restart slapd
-# Upon install slapd create and populate a database under /var/lib/ldap.
-# We clear it up and create a children directory to get finer-grain
-# control.
-- name: Clear empty /var/lib/ldap
- # Don't remove the database (and fail) if it contains something else
- # than its suffix or cn=admin,...
- openldap: dbdirectory=/var/lib/ldap ignoredn=cn=admin
- state=absent
-
-- name: Create directory /var/lib/ldap/fripost
- file: path=/var/lib/ldap/fripost
- state=directory
+- name: Copy DB_CONFIG
+ copy: src=var/lib/ldap/DB_CONFIG
+ dest=/var/lib/ldap/DB_CONFIG
owner=openldap group=openldap
- mode=0700
-
-- name: Copy /var/lib/ldap/fripost/DB_CONFIG
- copy: src=var/lib/ldap/fripost/DB_CONFIG
- dest=/var/lib/ldap/fripost/DB_CONFIG
- owner=openldap group=openldap
- mode=0600
- register: r2
- notify:
- # Not sure if required
- - Restart slapd
+ mode=0644
- name: Create directory /etc/ldap/ssl
file: path=/etc/ldap/ssl
@@ -63,9 +44,9 @@
--usage=digitalSignature,keyEncipherment
-t rsa -b 4096 -h sha256
--chown="root:openldap" --chmod=0640
- register: r3
- changed_when: r3.rc == 0
- failed_when: r3.rc > 1
+ register: r2
+ changed_when: r2.rc == 0
+ failed_when: r2.rc > 1
with_items:
- { group: 'LDAP-provider', name: ldap.fripost.org, ou: }
- { group: 'MX', name: mx, ou: --ou=SyncRepl }
@@ -123,12 +104,13 @@
tags:
- ldap
+# We assume a clean (=stock) cn=config
- name: Configure the LDAP database
openldap: target=etc/ldap/database.ldif.j2 local=template
state=present
- name: Start slapd
service: name=slapd state=started
- when: not (r1.changed or r2.changed or r3.changed)
+ when: not (r1.changed or r2.changed)
- meta: flush_handlers