--- # This will deploy OpenLDAP and FusionDirectory on the mailserver - name: Prepate /etc/hosts lineinfile: path: /etc/hosts insertafter: '^127.0.1.1 ' line: "{{ item }}" with_items: - "127.0.2.1 mail.{{ domain }} mail" - "127.0.3.1 auth.{{ domain }} auth" - name: Setup OpenLDAP and Dependencies apt: name: "{{ item }}" state: present update_cache: yes with_items: - ldap-utils - gnutls-bin - ca-certificates - python-ldap - python3-ldap - name: debconf configuration for slapd debconf: name: slapd question: "{{ item.question }}" value: "{{ item.value }}" vtype: "{{ item.vtype }}" with_items: - { question: slapd/no_configuration, value: False, vtype: boolean } - { question: slapd/domain, value: "{{ domain }}", vtype: string } - { question: shared/organization, value: "{{ organization }}", vtype: string } - { question: slapd/password1, value: "{{ ldap_admin_pass }}", vtype: password } - { question: slapd/password2, value: "{{ ldap_admin_pass }}", vtype: password } - { question: slapd/backend, value: MDB, vtype: select } - { question: slapd/purge_database, value: False, vtype: boolean } - { question: slapd/move_old_database, value: True, vtype: boolean } no_log: True - name: install slapd apt: name: slapd state: present - name: Create the ROOT CA store file: path: /srv/CA state: directory - name: Generate the CA Certificate template template: src: templates/ca-cert.tmpl.j2 dest: /srv/CA/ca-cert.tmpl - name: Generate the ROOT CA private key command: | certtool --generate-privkey \ --outfile {{ domain }}-rootCA.key args: chdir: /srv/CA creates: "/srv/CA/{{ domain }}-rootCA.key" - name: Generate the ROOT CA Certificate command: | certtool --generate-self-signed \ --template ca-cert.tmpl \ --load-privkey {{ domain }}-rootCA.key \ --outfile {{ domain }}-rootCA.crt args: chdir: /srv/CA creates: "/srv/CA/{{ domain }}-rootCA.crt" - name: Add our ROOT CA as trusted copy: remote_src: yes src: "/srv/CA/{{ domain }}-rootCA.crt" dest: /usr/local/share/ca-certificates/ notify: - Update CA Certificates - name: Create the LDAP TLS store file: path: /etc/ldap/ssl owner: openldap group: openldap state: directory - name: Generate the LDAP Certificate template template: src: templates/ldap-cert.tmpl.j2 dest: /srv/CA/ldap-cert.tmpl - name: Generate the LDAP private key command: | certtool --generate-privkey \ --outfile {{ domain }}.key args: chdir: /etc/ldap/ssl creates: "/etc/ldap/ssl/{{ domain }}.key" - name: Generate the LDAP Certificate command: | certtool --generate-certificate \ --template /srv/CA/ldap-cert.tmpl \ --load-privkey {{ domain }}.key \ --outfile {{ domain }}.crt \ --load-ca-privkey /srv/CA/{{ domain }}-rootCA.key --load-ca-certificate /srv/CA/{{ domain }}-rootCA.crt args: chdir: /etc/ldap/ssl creates: "/etc/ldap/ssl/{{ domain }}.crt" - name: Set the correct ownership on the LDAP cert/key pair file: path: "/etc/ldap/ssl/{{ item }}" owner: openldap group: openldap with_items: - "{{ domain }}.key" - "{{ domain }}.crt" - name: Create the custom_ldifs store file: path: /etc/ldap/custom_ldifs owner: openldap group: openldap state: directory - name: Create the olcSSL.ldif file (LDAP TLS Configuration) template: src: templates/olcSSL.ldif.j2 dest: /etc/ldap/custom_ldifs/olcSSL.ldif owner: openldap group: openldap notify: - Apply olcSSL.ldif - Restart slapd - name: Add an apt key by id from a keyserver apt_key: keyserver: keys.gnupg.net id: A94DE63F2EDB5F0DC0785EBBD744D55EACDA69FF - name: Add the Fusiondirectory repo apt_repository: repo: "{{ item }}" state: present with_items: - 'deb http://repos.fusiondirectory.org/fusiondirectory-current/debian-jessie jessie main' - 'deb http://repos.fusiondirectory.org/fusiondirectory-extra/debian-jessie jessie main' - name: Install FusionDirectory, dependencies and plugins apt: name: "{{ item }}" update_cache: yes state: present with_items: - apache2 - libapache2-mod-php - php-ldap - php-intl - php-pear - php-mbstring - fusiondirectory - fusiondirectory-schema - fusiondirectory-plugin-ldapdump - fusiondirectory-plugin-ldapmanager - fusiondirectory-plugin-dsa - fusiondirectory-plugin-dsa-schema - fusiondirectory-plugin-systems - fusiondirectory-plugin-systems-schema notify: - Apply FusionDirectory Schema - Apply FusionDirectory Plugins Schema - name: Calculate FusionDirectory Configuration hash stat: path: /var/cache/fusiondirectory/class.cache get_md5: yes register: fd_config_hash - name: Generate the Initial FusionDirectory configuration template: src: templates/fd-init-config.ldif.j2 dest: /etc/ldap/custom_ldifs/fd-init-config.ldif notify: - Initialize FusionDirectory Configuration - name: Migrate FusionDirectory Object Classes template: src: templates/fd-migrate-object-classes.ldif.j2 dest: /etc/ldap/custom_ldifs/fd-migrate-object-classes.ldif notify: - Migrate Object Classes - name: Create an empty ldap.conf file file: path: /etc/ldap/ldap.conf state: touch notify: - Generate FusionDirectory SuperUser and OUs - name: Set FusionDirectory SuperUser Password command: | true notify: - Set SuperUser Password no_log: True - name: Migrate FusionDirectory Defaults ACLs template: src: templates/fd-migrate-default-acl.ldif.j2 dest: /etc/ldap/custom_ldifs/fd-migrate-default-acl.ldif notify: - Migrate Default ACLs - name: Fix Permissions for the FusionDirectory Configuration template: src: templates/fusiondirectory.conf.j2 dest: /etc/fusiondirectory/fusiondirectory.conf notify: - Fix FusionDirectory Configuration Permisions - name: Apply FusionDirectory Service Accounts ACL template: src: templates/fd-service_accounts_acl.ldif.j2 dest: /etc/ldap/custom_ldifs/fd-service_accounts_acl.ldif notify: - Apply Service Accounts ACL - name: Create a .well-known directory file: path: /var/www/html/.well-known state: directory owner: www-data group: www-data - name: Deploy the Apache VirtualHosts for FusionDirectory template: src: "templates/fd-vhost{{ item }}.j2" dest: "/etc/apache2/sites-available/{{domain}}{{ item }}" with_items: - ".conf" - "-ssl.conf" notify: - Enable the Apache HTTP VirtualHost - Disable the Default Apache VirtualHost - Restart Apache