summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/LDAP-provider/files/etc/ldap/syncprov.ldif13
-rw-r--r--roles/LDAP-provider/tasks/main.yml12
-rw-r--r--roles/common-LDAP/tasks/main.yml10
3 files changed, 25 insertions, 10 deletions
diff --git a/roles/LDAP-provider/files/etc/ldap/syncprov.ldif b/roles/LDAP-provider/files/etc/ldap/syncprov.ldif
new file mode 100644
index 0000000..42f06a0
--- /dev/null
+++ b/roles/LDAP-provider/files/etc/ldap/syncprov.ldif
@@ -0,0 +1,13 @@
+# References:
+# - http://www.openldap.org/doc/admin24/replication.html#Syncrepl
+# - http://www.zytrax.com/books/ldap/ch7/#ol-syncrepl-rap
+# - man 5 slapo-syncprov
+
+dn: olcOverlay=syncprov,olcDatabase={*}hdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcSyncProvConfig
+olcOverlay: syncprov
+# contextCSN saved to database every 50 updates or 5
+# minutes
+olcSpCheckpoint: 50 5
+olcSpReloadHint: TRUE
diff --git a/roles/LDAP-provider/tasks/main.yml b/roles/LDAP-provider/tasks/main.yml
new file mode 100644
index 0000000..64c8e30
--- /dev/null
+++ b/roles/LDAP-provider/tasks/main.yml
@@ -0,0 +1,12 @@
+- name: Copy the syncprov overlay configuration
+ copy: src=etc/ldap/syncprov.ldif
+ dest=/etc/ldap/fripost/syncprov.ldif
+ owner=root group=root
+ mode=0644
+
+- name: Load and configure the syncprov overlay
+ openldap: module=syncprov state=present
+ suffix=o=mailHosting,dc=fripost,dc=org
+ target=/etc/ldap/fripost/syncprov.ldif
+
+# TODO: authz constraint
diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml
index 27a0298..06eb692 100644
--- a/roles/common-LDAP/tasks/main.yml
+++ b/roles/common-LDAP/tasks/main.yml
@@ -66,18 +66,8 @@
# TODO load other required schemas *before* loading the database
- fripost/database.ldif
-- name: Load LDAP modules
- openldap: module={{ item }}.la state=present
- with_items:
- # TODO only if provider
- - syncprov
- # TODO only if writable
- - constraint
-
- name: Start slapd
service: name=slapd state=started
when: not (r1.changed or r2.changed)
- meta: flush_handlers
-
-# TODO: authz constraint syncprov