diff options
Diffstat (limited to 'roles/common-LDAP')
| -rw-r--r-- | roles/common-LDAP/tasks/main.yml | 21 | ||||
| -rw-r--r-- | roles/common-LDAP/templates/etc/ldap/database.ldif.j2 | 22 |
2 files changed, 38 insertions, 5 deletions
diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml index 06eb692..5c993fc 100644 --- a/roles/common-LDAP/tasks/main.yml +++ b/roles/common-LDAP/tasks/main.yml @@ -53,19 +53,32 @@ owner=root group=root mode=0600 -- name: Copy fripost schema - copy: src=etc/ldap/schema/fripost.ldif - dest=/etc/ldap/schema/fripost.ldif +- name: Copy fripost & amavis' schema + copy: src=etc/ldap/schema/{{ item }} + dest=/etc/ldap/schema/{{ item }} owner=root group=root mode=0644 + # It'd certainly be nicer if we didn't have to deploy amavis' schema + # everywhere, but we need the 'objectClass' in our replicates, hence + # they need to be aware of the 'amavisAccount' class. + with_items: + - fripost.ldif + - amavis.schema + tags: + - amavis - name: Load fripost's schema and configure the database openldap: target=/etc/ldap/{{ item }} state=present with_items: - schema/fripost.ldif - # TODO load other required schemas *before* loading the database - fripost/database.ldif +- name: Load amavis' schema + openldap: target=/etc/ldap/schema/amavis.schema state=present + format=slapd.conf name=amavis + tags: + - ldap + - name: Start slapd service: name=slapd state=started when: not (r1.changed or r2.changed) diff --git a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 index cf12f10..f76eb78 100644 --- a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 +++ b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 @@ -73,7 +73,13 @@ olcDbIndex: entryCSN,entryUUID eq # - http://www.openldap.org/doc/admin24/replication.html#Syncrepl # - http://www.zytrax.com/books/ldap/ch7/#ol-syncrepl-rap # -{% if 'LDAP-provider' not in group_names %} +{% if 'LDAP-provider' in group_names %} +olcLimits: dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" + time.soft=unlimited + time.hard=unlimited + size.soft=unlimited + size.hard=unlimited +{% elif 'MX' in group_names %} olcSyncrepl: rid=000 provider=ldap://{{ LDAP_provider }} type=refreshAndPersist @@ -129,6 +135,20 @@ olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org" by dn.exact="username=postfix,cn=peercred,cn=external,cn=auth" =rsd by users =0 break # +# The following is required for the content filter +{% if 'MDA' in group_names %} +olcAccess: to dn.regex="^fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=entry + filter=(&(objectClass=FripostVirtualDomain)(fripostIsStatusActive=TRUE)) + by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" =s + by users =0 break +olcAccess: to dn.regex="^fvl=[^,]+,fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org$" + attrs=entry,objectClass,fvl,@AmavisAccount + filter=(&(objectClass=FripostVirtualUser)(objectClass=AmavisAccount)(fripostIsStatusActive=TRUE)) + by dn.exact="username=amavis,cn=peercred,cn=external,cn=auth" =rsd + by users =0 break +{% endif %} +# # Anonymous can authenticate into the services. (But not read or write the password.) olcAccess: to dn.one="ou=services,o=mailHosting,dc=fripost,dc=org" attrs=userPassword |