feat(openldap): add ansible role for deployment

roles/openldap/tasks/configure.yml

@@ -0,0 +1,58 @@
+---
+- name: Ensure ACLs are configured
+  community.general.ldap_attrs:
+    dn: "{{ openldap_default_database_config }}"
+    attributes:
+      olcAccess: "{{ openldap_config_db_olc_access }}"
+    state: "exact"
+    server_uri: "{{ openldap_socket_url }}"
+  retries: 3
+  delay: 3
+  register: openldap_acl_result
+  until: openldap_acl_result is succeeded
+
+- name: Ensure LDAP DIT is configured
+  when:
+    - openldap_default_database_root_dn is defined
+    - openldap_default_database_root_pw is defined
+  vars:
+    _meta: &openldap_bind_info
+      bind_dn: "{{ openldap_default_database_root_dn }}"
+      bind_pw: "{{ openldap_default_database_root_pw }}"
+      server_uri: "{{ openldap_socket_url }}"
+  block:
+    - name: Ensure rootDN + credentials are correct
+      community.general.ldap_attrs:
+        dn: "{{ openldap_default_database_config }}"
+        attributes: "{{ {entry.key: entry.value} }}"
+        state: "exact"
+        server_uri: "{{ openldap_socket_url }}"
+      no_log: "{{ entry.log is defined and not entry.log }}"
+      loop:
+        - key: "olcRootDN"
+          value: "{{ openldap_default_database_root_dn }}"
+        - key: "olcRootPW"
+          value: "{{ openldap_default_database_root_pw }}"
+          log: false
+      loop_control:
+        loop_var: "entry"
+        label: "{{ entry.key }}"
+
+    - name: Ensure root node is {{ openldap_state }}
+      community.general.ldap_entry:
+        dn: "{{ openldap_dn }}"
+        objectClass: "{{ openldap_root_node_object_classes }}"
+        attributes:
+          dc: "{{ openldap_root_node_dc }}"
+          o: "{{ openldap_root_node_o }}"
+        <<: *openldap_bind_info
+
+    - name: Ensure root node attributes are up to date
+      community.general.ldap_attrs:
+        dn: "{{ openldap_dn }}"
+        attributes:
+          dc: "{{ openldap_root_node_dc }}"
+          o: "{{ openldap_root_node_o }}"
+        state: exact
+        <<: *openldap_bind_info
+      when: openldap_state == 'present'

roles/openldap/tasks/deploy-docker.yml

@@ -0,0 +1,25 @@
+---
+- name: Ensure container '{{ openldap_container_name }}' is {{ openldap_container_state }}
+  community.docker.docker_container:
+    name: "{{ openldap_container_name }}"
+    image: "{{ openldap_container_image }}"
+    env: "{{ openldap_container_env | default(omit, true) }}"
+    user: "{{ openldap_container_user | default(omit, true) }}"
+    ports: "{{ openldap_container_ports | default(omit, true) }}"
+    labels: "{{ openldap_container_labels | default(omit, true) }}"
+    volumes: "{{ openldap_container_all_volumes | default(omit, true) }}"
+    networks: "{{ openldap_container_networks | default(omit, true) }}"
+    network_mode: "{{ openldap_container_network_mode | default(omit, true) }}"
+    dns_servers: "{{ openldap_container_dns_servers | default(omit, true) }}"
+    etc_hosts: "{{ openldap_container_etc_hosts | default(omit, true) }}"
+    command: "{{ openldap_container_command | default(omit, true) }}"
+    ulimits: "{{ openldap_container_ulimits | default(omit, true) }}"
+    memory: "{{ openldap_container_memory | default(omit, true) }}"
+    memory_swap: "{{ openldap_container_memory_swap | default(omit, true) }}"
+    memory_reservation: >-2
+      {{ openldap_container_memory_reservation | default(omit, true) }}
+    restart_policy: >-2
+      {{ openldap_container_restart_policy | default(omit, true) }}
+    healthcheck: "{{ openldap_container_healthcheck | default(omit, true) }}"
+    state: "{{ openldap_container_state }}"
+

roles/openldap/tasks/initialize-docker.yml

@@ -0,0 +1,37 @@
+---
+- name: Ensure additional schemas are mapped to container
+  ansible.builtin.set_fact:
+    openldap_init_container_volumes: >-2
+      {{ openldap_init_container_volumes + [ schema_mount ] }}
+  vars:
+    schema_file: "{{ openldap_schema_path }}/{{ schema.name }}.ldif"
+    schema_mount: >-2
+      {{ schema_file }}:{{ schema_file }}:ro
+  loop: "{{ openldap_additional_schemas }}"
+  loop_control:
+    loop_var: "schema"
+    label: "{{ schema.name }}"
+
+- name: Ensure ldap container is initialized
+  community.docker.docker_container:
+    name: "{{ openldap_container_name }}"
+    image: "{{ openldap_container_image }}"
+    env: "{{ openldap_container_env | default(omit, true) }}"
+    user: "{{ openldap_container_user | default(omit, true) }}"
+    ports: "{{ openldap_container_ports | default(omit, true) }}"
+    labels: "{{ openldap_container_labels | default(omit, true) }}"
+    volumes: "{{ openldap_container_merged_volumes | default(omit, true) }}"
+    networks: "{{ openldap_container_networks | default(omit, true) }}"
+    network_mode: "{{ openldap_container_network_mode | default(omit, true) }}"
+    dns_servers: "{{ openldap_container_dns_servers | default(omit, true) }}"
+    etc_hosts: "{{ openldap_container_etc_hosts | default(omit, true) }}"
+    memory: "{{ openldap_container_memory | default(omit, true) }}"
+    memory_swap: "{{ openldap_container_memory_swap | default(omit, true) }}"
+    memory_reservation: >-2
+      {{ openldap_container_memory_reservation | default(omit, true) }}
+    command: "{{ openldap_slapadd_init_command }}"
+    detach: false
+    cleanup: true
+  vars:
+    openldap_container_merged_volumes: >-2
+      {{ openldap_container_all_volumes + openldap_init_container_volumes }}

roles/openldap/tasks/initialize.yml

@@ -0,0 +1,47 @@
+---
+- name: Determine if persisted OLC config exists
+  ansible.builtin.stat:
+    path: "{{ openldap_olc_path }}/cn=config"
+  register: openldap_olc_stat_info
+
+- name: Ensure openldap databases are initialized
+  when: not openldap_olc_stat_info.stat.exists
+  block:
+    - name: Ensure initial slapd.ldif is templated
+      ansible.builtin.template:
+        src: "slapd.ldif.j2"
+        dest: "{{ openldap_slapd_path }}"
+        mode: "0644"
+    - name: Ensure additional schemas to install are present
+      ansible.builtin.copy:
+        content: "{{ schema.content }}"
+        dest: "{{ openldap_schema_path }}/{{ schema.name }}.ldif"
+        mode: "0644"
+      loop: "{{ openldap_additional_schemas }}"
+      loop_control:
+        loop_var: "schema"
+        label: "{{ schema.name }}"
+    - name: Ensure db data directory exists
+      ansible.builtin.file:
+        path: "{{ openldap_default_database_directory }}"
+        state: directory
+        mode: "0750"
+    - name: Ensure container is initialized using {{ openldap_deployment_method }}
+      ansible.builtin.include_tasks:
+        file: "initialize-{{ openldap_deployment_method }}.yml"
+  rescue:
+    - name: Ensure temporary schema files are absent
+      ansible.builtin.file:
+        path: "{{ openldap_schema_path }}/{{ file.name }}.ldif"
+        state: absent
+      loop: >-2
+        {{ openldap_additional_schemas }}
+      loop_control:
+        loop_var: "file"
+        label: "{{ file.name }}"
+      ignore_errors: true
+    - name: Ensure intial slapd.ldif file is absent
+      ansible.builtin.file:
+        path: "{{ openldap_slapd_path }}"
+        state: absent
+      ignore_errors: true

roles/openldap/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Check if 'openldap_state' is valid
+  ansible.builtin.fail:
+    msg: >-2
+      Invalid state '{{ openldap_state }}'!
+      Supported states are {{ openldap_states | join(', ') }}.
+  when: openldap_state not in openldap_states
+
+- name: Check if 'openldap_deployment_method' is valid
+  ansible.builtin.fail:
+    msg: >-2
+      Invalid state '{{ openldap_deployment_method }}'!
+      Supported states are {{ openldap_deployment_methods | join(', ') }}.
+  when: openldap_deployment_method not in openldap_deployment_methods
+
+- name: Ensure openldap deployment is prepared
+  ansible.builtin.include_tasks:
+    file: "prepare-{{ openldap_deployment_method }}.yml"
+
+- name: Ensure openldap is deployed using {{ openldap_deployment_method }}
+  ansible.builtin.include_tasks:
+    file: "deploy-{{ openldap_deployment_method }}.yml"
+
+- name: Ensure openldap is configured
+  ansible.builtin.include_tasks:
+    file: "configure.yml"

roles/openldap/tasks/prepare-docker.yml

@@ -0,0 +1,7 @@
+---
+- name: Ensure container image '{{ openldap_container_image }}' is {{ openldap_state }}
+  community.docker.docker_image:
+    name: "{{ openldap_container_image }}"
+    state: "{{ openldap_state }}"
+    source: "{{ openldap_container_image_source }}"
+    force_source: "{{ openldap_container_image_force_source }}"