TLS ciphers to enable on the LDAP server. This should be a GnuTLS-compatible

  cipher specification that should also include what TLS protocol versions

  should be used. Value should be compatible with OpenLDAP server option

  ``olcTLSCipherSuite``. Default value allows only TLSv1.2 and strong PFS

  ciphers.

Distribution compatibility

~~~~~~~~~~~~~~~~~~~~~~~~~~

Role is compatible with the following distributions:

- Debian 11 (Bullseye)

Examples

~~~~~~~~

Here is an example configuration for setting-up LDAP server:

.. code-block:: yaml

  ---

    backup_patterns_filename: "ldap_server"

    backup_patterns:

      - "/srv/backup/slapd.bak"

galaxy_info:

  author: Branko Majic

  description: Sets-up an OpenLDAP server

  license: BSD

  min_ansible_version: 2.9

  platforms:

    - name: Debian

      versions:

        - 11

  - name: client

    box: debian/bullseye64

    memory: 512

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.11

        network_name: private_network

        type: static

  - name: parameters-mandatory-bullseye

    groups:

      - parameters-mandatory

    box: debian/bullseye64

    memory: 256

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.31

        network_name: private_network

    - name: Generate server private keys and certificates

      command:

      args:

        chdir: "tests/data/"

        creates: ".gimmecert/server/{{ item.name }}.cert.pem"

        argv:

          - "gimmecert"

          - "server"

          - "{{ item.name }}"

          - "{{ item.fqdn }}"

      with_items:

        - name: parameters-mandatory-bullseye_ldap

          fqdn: parameters-mandatory

        - name: parameters-optional-bullseye_ldap

          fqdn: parameters-optional

    - name: Set-up link to generated X.509 material

      file:

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

- name: Prepare

        state: present

    - name: Set-up /etc/hosts with entries for all servers

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: 0644

        state: present

      with_dict:

        192.168.56.31: parameters-mandatory-bullseye

        192.168.56.32: parameters-optional-bullseye

- hosts: parameters-optional

  become: true

  tasks:

    - name: Set-up the hosts file

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"