---

# Configuration for role 'common', shared across all servers.

os_users:

  - name: admin

    uid: 1000

    additional_groups: sudo

    authorized_keys:

      - "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

    password: '$6$/aerscJY6aevRG$ABBCymEDtk2mHW/dklre9dMEdgZNJvVHsGLCzgjGmy61FssZ.KW7ePcO2wsMGIkHcg3mZlrA4dhYh.APq9OQu0'

  - name: johndoe

    uid: 1001

    additional_groups: "office,developer"

    authorized_keys: []

    password: '$6$cJnUatae7cMz23fl$O3HE2TslnEaKaTDSZnvuDDrfqILAiuMV1wOPGVnkUQFxUu3gIWZOyO7AI1OWYkqeQMVBiezpSqYNiQy6NF6bi0'

os_groups:

  - name: office

    gid: 2000

  - name: developer

    gid: 2001

common_packages:

  - emacs23-nox

  - screen

  - debconf-utils

---

ldap_client_config:

  - comment: Set the base DN

    option: BASE

    value: dc=example,dc=com

  - comment: Set the default URI

    option: URI

    value: ldap://ldap.example.com/

  - comment: Set the default bind DN

    option: BINDDN

    value: cn=admin,dc=example,dc=com

ldap_server_config:

  domain: "example.com"

  organization: "Example Inc."

  log_level: 256

  tls_certificate: /etc/ssl/certs/ldap.example.com.pem

  tls_key: /etc/ssl/private/ldap.example.com.pem

  ssf: 128

ldap_permissions:

  - filter: '(olcSuffix=dc=example,dc=com)'

    rules:

      - >

        to *

        by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage

        by * break

      - >

        to attrs=userPassword,shadowLastChange

        by self write

        by anonymous auth

        by dn="cn=admin,dc=example,dc=com" write

        by * none

      - >

        to dn.base=""

        by * read

      - >

        to *

        by self write

        by dn="cn=admin,dc=example,dc=com" write

        by users read

        by * none

ldap_entries:

  - dn: ou=people,dc=example,dc=com

    objectClass: organizationalUnit

    ou: people

  - dn: ou=groups,dc=example,dc=com

    objectClass: organizationalUnit

    ou: groups

  - dn: uid=johndoe,ou=people,dc=example,dc=com

    objectClass:

      - inetOrgPerson

    uid: johndoe

    cn: John Doe

    sn: Doe

---

- hosts: ldap

  remote_user: ansible

  sudo: yes

  roles:

    - common

    - ldap_client

    - ldap_server

- include: ldap.yml