.. _rolereference:

Role Reference

==============

Common parameters

-----------------

A number of common parameters are used by all of the roles during

deployment. This section lists such parameters.

**tls_private_key_dir** (string, optional if paths to private keys for all roles are explicitly specified)

  Path to directory on Ansible host that contains the private keys used by

  services deployed by various roles. When TLS key path is not explicitly

  defined in a role, this is the directory where the TLS key will be looked-up

  during Ansible run. Expected filename pattern is ``FQDN_SERVICE.key`` (for

  example, ``mail.example.com_smtp.key`` or ``xmpp.example.com_xmpp.key``).

**tls_certificate_dir** (string, optional if paths to certificate files for all roles are explicitly specified)

  Path to directory on Ansible host that contains the X.509 certificate files

  used by services deployed by various roles. When X.509 certificate path is not

  explicitly defined in a role, this is the directory where the X.509

  certificate will be looked-up during Ansible run. Expected filename pattern is

  attribute will update corresponding group as well.

* Creates a basic directory structure used by most of the other roles.

* Creates a basic directory structure used by the mail server role.

* Creates login entries for services that need to consume LDAP directory data in

  some way.

* Creates user-supplied groups in LDAP.

* Configures permissions.

* Creates LDAP entries.

* Configures firewall to allow incoming connections to the LDAP server.

* Sets the LDAP server administrator's password.

Parameters

~~~~~~~~~~

**ldap_admin_password** (string, mandatory)

  Password for the default administrator account of LDAP server (the

  ``cn=admin,DOMAIN`` entry/user).

**ldap_entries** (list, optional, ``[]``)

  List of entries that should be kept in the LDAP directory. Each item is a

  dictionary describing a single LDAP entry, with all of its attributes

  listed. The keys in this dictionary should be the attribute names. The values

  should be either strings, for setting a single attribute value, or a list of

---

ldap_entries: []

ldap_server_domain: "{{ ansible_domain }}"

# Internal value, base DN.

ldap_server_int_basedn: "{{ ldap_server_domain | regex_replace('\\.', ',dc=') | regex_replace('^', 'dc=') }}"

ldap_server_organization: "Private"

ldap_server_log_level: 256

ldap_server_tls_certificate: "{{ tls_certificate_dir }}/{{ ansible_fqdn }}_ldap.pem"

ldap_server_tls_key: "{{ tls_private_key_dir }}/{{ ansible_fqdn }}_ldap.key"

ldap_server_ssf: 128

ldap_server_consumers: []

ldap_server_groups: []

ldap_permissions:

---

dependencies:

  command: ldapwhoami -D "cn=admin,{{ ldap_server_int_basedn }}" -x -y /root/.ldap_admin_password

  register: ldap_admin_password_check

  changed_when: ldap_admin_password_check.rc != 0

  failed_when: False

- name: Update LDAP admin password

  command: ldappasswd -Y EXTERNAL -H ldapi:/// "cn=admin,{{ ldap_server_int_basedn }}" -T /root/.ldap_admin_password

  when: ldap_admin_password_check.rc != 0

- name: Remove temporary file with LDAP admin password

  file: path="/root/.ldap_admin_password" state=absent

  changed_when: False

  - comment: Set the base DN

    option: BASE

    value: "{{ testsite_ldap_base }}"

  - comment: Set the default URI

    option: URI

    value: ldap://ldap.{{ testsite_domain }}/

  - comment: Set the LDAP TLS truststore

    option: TLS_CACERT

    value: /etc/ssl/certs/ca.pem

  - comment: Enforce TLS

    option: TLS_REQCERT

    value: demand

---

local_mail_aliases:

  root: "root john.doe@{{ testsite_domain }}"

smtp_relay_host: mail.{{ testsite_domain }}

smtp_relay_truststore: /etc/ssl/certs/ca.pem

backup_clients:

  - server: web.{{ testsite_domain }}

    public_key: "{{ lookup('file', inventory_dir + '/ssh/web.' + testsite_domain + '.pub') }}"

    ip: 10.32.64.18

  - server: mail.{{ testsite_domain }}

    public_key: "{{ lookup('file', inventory_dir + '/ssh/mail.' + testsite_domain + '.pub') }}"

    ip: 10.32.64.15

backup_host_ssh_private_keys:

  dsa: "{{ lookup('file', inventory_dir + '/ssh/backup_server_dsa_key') }}"

  rsa: "{{ lookup('file', inventory_dir + '/ssh/backup_server_rsa_key') }}"

  ed25519: "{{ lookup('file', inventory_dir + '/ssh/backup_server_ed25519_key') }}"

  ecdsa: "{{ lookup('file', inventory_dir + '/ssh/backup_server_ecdsa_key') }}"

smtp_relay_host: mail.{{ testsite_domain }}

smtp_relay_truststore: /etc/ssl/certs/ca.pem

https_tls_key: "{{ inventory_dir }}/tls/web.{{ testsite_domain }}_https.key"

https_tls_certificate: "{{ inventory_dir }}/tls/web.{{ testsite_domain }}_https.pem"

web_default_title: "Welcome to Example Inc."

web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."

db_root_password: "root"