From 20112fea63bd47a1ffdf452191d7002893f2df85 Mon Sep 17 00:00:00 2001 From: SebClem Date: Wed, 19 Apr 2023 16:45:51 +0200 Subject: [PATCH] init --- defaults/main.yml | 1 + handlers/main.yml | 5 ++++ tasks/main.yml | 54 ++++++++++++++++++++++++++++++++++ templates/lldap-config.toml.j2 | 14 +++++++++ templates/lldap.service.j2 | 22 ++++++++++++++ vars/main.yml | 9 ++++++ 6 files changed, 105 insertions(+) create mode 100644 templates/lldap-config.toml.j2 create mode 100644 templates/lldap.service.j2 diff --git a/defaults/main.yml b/defaults/main.yml index b9f11b7..d7ed630 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,2 +1,3 @@ --- # defaults file for ${REPO_NAME_TITLE} +lldap_version: "v0.4.2" diff --git a/handlers/main.yml b/handlers/main.yml index 6857e99..e1dac75 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -1,2 +1,7 @@ --- # handlers file for Ansible-Lldap-Role + +- name: Restart lldap + ansible.builtin.systemd: + name: lldap + state: restarted diff --git a/tasks/main.yml b/tasks/main.yml index 1395358..8274390 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,2 +1,56 @@ --- # tasks file for Ansible-Lldap-Role + +- name: Download lldap + ansible.builtin.unarchive: + src: "{{ lldap_dowload_url }}" + dest: "{{ lldap_install_dir }}" + remote_src: true + extra_opts: + - --strip-components=1 + +- name: Create lldap user + ansible.builtin.user: + name: "{{ lldap_run_user }}" + system: true + shell: /bin/bash + home: "/var/lib/lldap" + create_home: true + +- name: Add lldap service file + ansible.builtin.template: + src: lldap.service.j2 + dest: /etc/systemd/system/lldap.service + mode: "644" + +- name: Ensure lldap data dir exist + ansible.builtin.file: + path: "{{ lldap_data_dir }}" + owner: "{{ lldap_run_user }}" + group: "{{ lldap_run_group }}" + mode: "750" + state: directory + +- name: Ensure lldap config dir exist + ansible.builtin.file: + path: "{{ lldap_config_dir }}" + owner: "root" + group: "{{ lldap_run_group }}" + mode: "770" + state: directory + +- name: Update lldap config + ansible.builtin.template: + src: lldap-config.toml.j2 + dest: "{{ lldap_config_dir }}/lldap-config.toml" + owner: "root" + group: "{{ lldap_run_group }}" + mode: "640" + notify: Restart lldap + +- name: Enable and start lldap service + ansible.builtin.systemd: + name: lldap + daemon_reload: true + enabled: true + state: started diff --git a/templates/lldap-config.toml.j2 b/templates/lldap-config.toml.j2 new file mode 100644 index 0000000..52ea0e0 --- /dev/null +++ b/templates/lldap-config.toml.j2 @@ -0,0 +1,14 @@ +{{ ansible_managed | comment }} + +{% for key, value in gitea_config %} +{% if value is string %} +{{ key }}={{ value }} +{% else %} + +[{{ key }}] +{% for entry, entry_value in value %} +{{ entry }} = {{ entry_value }} +{% endfor %} + +{% endif %} +{% endfor %} \ No newline at end of file diff --git a/templates/lldap.service.j2 b/templates/lldap.service.j2 new file mode 100644 index 0000000..51ca014 --- /dev/null +++ b/templates/lldap.service.j2 @@ -0,0 +1,22 @@ +[Unit] +Description=LLDAP +Documentation=https://github.com/lldap/lldap + +# Only sqlite +After=network.target + +[Service] +# The user/group LLDAP is run under. The working directory (see below) should allow write and read access to this user/group. +User={{ lldap_run_user }} +Group={{ lldap_run_group }} +UMask=027 + +# The location of the compiled binary +ExecStart={{ lldap_install_dir }}/lldap run --config-file {{ lldap_config_dir }}/lldap-config.toml + +# Only allow writes to the following directory and set it to the working directory (user and password data are stored here). +WorkingDirectory={{ lldap_data_dir }} +ReadWriteDirectories={{ lldap_data_dir }} + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/vars/main.yml b/vars/main.yml index af3467f..5c74d1a 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -1,2 +1,11 @@ --- # vars file for Ansible-Lldap-Role + +lldap_download_filename: "amd64-lldap.tar.gz" +lldap_dowload_url: "https://github.com/lldap/lldap/releases/download/{{ lldap_version }}/{{ lldap_download_filename }}" +lldap_run_user: "lldap" +lldap_run_group: "{{ lldap_run_user }}" + +lldap_config_dir: "/etc/lldap" +lldap_data_dir: "/var/lib/lldap" +lldap_install_dir: "/opt/lldap"