---

- include_vars: "{{ ansible_distribution }}_{{ ansible_distribution_version }}_{{ ansible_architecture }}.yml"
- include_vars: "{{ ansible_distribution }}.yml"
- name: install system packages apt
  apt: name={{ item }} state=installed update_cache=true
  sudo: true
  with_items: system_packages
  when: ansible_os_family == 'Debian'

- name: install system packages yum
  yum: name={{ item }} state=installed
  sudo: true
  with_items: system_packages
  when: ansible_os_family == 'RedHat'

- name: Fixed default configuration 
  lineinfile: dest=/etc/default/slapd regexp='^SLAPD_SERVICES="ldap:/// ldapi:///"' line='SLAPD_SERVICES="ldaps:/// ldap:/// ldapi:///"'
  sudo: true
  when: ansible_os_family == 'Debian'

- name: hash password
  command: /usr/sbin/slappasswd -h {SSHA} -s {{ ldapManagerPassword }}
  register: ldapManagerHash

- name: hash binddn password
  command: /usr/sbin/slappasswd -h {SSHA} -s {{ ldapBindDNPassword }}
  register: ldapBindDNHash

- name: template ssl.ldif
  template: src=ssl_ldif.j2 dest=/tmp/ssl.ldif mode=600

- name: template manager.ldif
  template: src=manager_ldif.j2 dest=/tmp/manager.ldif mode=600
  sudo: true
- name: template manager2.ldif
  template: src=manager_ldif2.j2 dest=/tmp/manager2.ldif mode=600
  sudo: true
- name: template manager3.ldif
  template: src=manager_ldif3.j2 dest=/tmp/manager3.ldif mode=600
  sudo: true

- name: template binddn.ldif
  template: src=binddn_ldif.j2 dest=/tmp/binddn.ldif mode=600
  sudo: true

- name: template root.ldif
  template: src=root_ldif.j2 dest=/tmp/root.ldif

- name: template accounts.ldif
  template: src=accounts_ldif.j2 dest=/tmp/accounts.ldif

- name: template real accounts.ldif
  template: src=real_accounts_ldif.j2 dest=/tmp/real_accounts.ldif

- name: template groups.ldif
  template: src=groups_ldif.j2 dest=/tmp/groups.ldif

- name: template acls.ldif
  template: src=acls_ldif.j2 dest=/tmp/acls.ldif

- name: template load_modules.ldif
  template: src=load_modules_ldif.j2 dest=/tmp/load_modules.ldif

- name: template ppolicy_overlay.ldif
  template: src=ppolicy_overlay_ldif.j2 dest=/tmp/ppolicy_overlay.ldif

- name: template pwpolices.ldif
  template: src=pwpolicies_ldif.j2 dest=/tmp/pwpolicies.ldif

- name: template default_ppolicy.ldif
  template: src=default_ppolicy_ldif.j2 dest=/tmp/default_ppolicy.ldif

- name: make cert dir
  file: path={{ ldapcert | dirname }} state=directory owner={{ ldapuser }} group={{ ldapgroup }}
  sudo: true

- name: make key dir
  file: path={{ ldapkey | dirname }} state=directory owner={{ ldapuser }} group={{ ldapgroup }}
  sudo: true

- name: make ca dir
  file: path={{ cacert | dirname }} state=directory owner={{ ldapuser }} group={{ ldapgroup }}
  sudo: true

# Change to remove easy-rsa and to use fixed key and certs
- name: copy fixed keys and certs from files directory
  template: src=files/{{ item.src }} dest="{{ item.dest }}" mode={{ item.mode }} owner=root group=root
  with_items: ldapCertFiles 
  sudo: true
  
- name: copy cert
  command: cp /etc/ssl/certs/server.crt {{ ldapcert }}
  sudo: true

- name: copy cacert
  command: cp /etc/ssl/certs/ca.crt {{ cacert }}
  sudo: true

- name: copy key
  command: cp /etc/ssl/private/server.key {{ ldapkey }}
  sudo: true

- name: chmod key
  file: path={{ ldapkey }} owner={{ ldapuser }} group={{ ldapgroup }} mode=600
  sudo: true

- name: enable ssl centos
  lineinfile: regexp="SLAPD_LDAPS=no" state=present line="SLAPD_LDAPS=yes" dest=/etc/sysconfig/ldap
  sudo: true
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version < '7'

- name: enable ssl centos 7
  lineinfile: regexp="^SLAPD_URLS=" state=present line="SLAPD_URLS='ldaps:/// ldapi:/// ldap:///'" dest=/etc/sysconfig/slapd
  sudo: true
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version >= '7'

- name: start ldap
  service: name=slapd state=restarted
  sudo: true

- name: check TLS config
  shell: "slapcat -b cn=config | grep 'olcTLSCertificateKeyFile: {{ ldapkey }}'"
  ignore_errors: true
  sudo: true
  register: tlsConfigured

- name: check Manager config
  shell: "slapcat -b cn=config | grep 'olcRootDN: {{ ldapManager }}'"
  ignore_errors: true
  sudo: true
  register: managerConfigured

# slapcat does a line wrap at character 78. Don't attempt to match on {{ ldapManager }} as it will cross two lines
- name: check ACL config
  shell: "slapcat -b cn=config | grep 'olcAccess:' | grep 'cn=Manager'"
  ignore_errors: true
  sudo: true
  register: aclConfigured


- name: check real Accounts config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapAccountBase }} -x -H ldap://localhost objectClass=*"
  ignore_errors: true
  register: realAccountsConfigured
  when: ldapAccountBase is defined

- name: check Groups config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapGroupBase }} -x -H ldap://localhost objectClass=*"
  ignore_errors: true
  register: groupsConfigured

- name: check binddn config
  shell: "ldapsearch -D {{ ldapBindDN }} -w {{ ldapBindDNPassword }} -b {{ ldapDomain }} -x -H ldap://localhost objectClass=dcObject"
  ignore_errors: true
  register: binddnConfigured

- name: Initialise cosine and ppolicy
  shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/{{ item }}.ldif -D cn=config
  with_items:
   - ppolicy
   - cosine
   - nis
   - inetorgperson
  ignore_errors: true
  sudo: true
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version >= '7'

- name: initialise server ssl
  shell: ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/ssl.ldif -D cn=config 
  sudo: true
  when: tlsConfigured|failed

- name: check DIT config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapBase }} -x -H ldap://localhost objectClass=dcObject"
  ignore_errors: true
  register: ditConfigured

- name: check Accounts config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapUserBase }} -x -H ldap://localhost objectClass=*"
  ignore_errors: true
  register: accountsConfigured

- name: initialise server manager
  shell:  ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/manager.ldif -D cn=config
  sudo: true
  when: managerConfigured|failed

- name: initialise server manager
  shell: ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/manager2.ldif -D cn=config 
  sudo: true
  ignore_errors: true
  when: managerConfigured|failed
- name: initialise server manager
  shell: ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/manager3.ldif -D cn=config 
  sudo: true
  when: managerConfigured|failed

- name: initialise server acls
  shell: ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/acls.ldif -D cn=config
  sudo: true
  when: aclConfigured|failed

- name: add DIT root
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/root.ldif
  when: ditConfigured|failed

- name: add Accounts OU
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/accounts.ldif
  when: accountsConfigured|failed

- name: add real Accounts OU
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/real_accounts.ldif
  when: realAccountsConfigured is defined and realAccountsConfigured|failed

- name: add Groups OU
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/groups.ldif
  when: groupsConfigured|failed

- name: add binddn
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/binddn.ldif
  sudo: true
  when: binddnConfigured|failed
      
- name: check ppolicy module loaded
  shell: slapcat -b cn=config | grep "olcModuleLoad. {.*}ppolicy"
  sudo: true
  ignore_errors: true
  register: ppolicyModuleLoaded

- name: load ppolicy module
  shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/load_modules.ldif -D cn=config 
  sudo: true
  when: ppolicyModuleLoaded|failed

- name: check ppolicy overlay config
  shell: "slapcat -b cn=config | grep 'dn: olcOverlay=ppolicy,olcDatabase={.*}.db,cn=config'"
  ignore_errors: true
  sudo: true
  register: ppolicyOverlayConfigured

- name: add ppolicy overlay
  shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/ppolicy_overlay.ldif -D cn=config 
  sudo: true
  when: ppolicyOverlayConfigured|failed

- name: check pwpolicies config
  shell: ldapsearch -D cn=binddn,ou=Accounts,{{ ldapDomain }} -w {{ ldapBindDNPassword }} -b ou=pwpolicies,{{ ldapDomain }} objectClass=*
  ignore_errors: true
  register: pwpoliciesConfigured

- name: add pwpolicies
  shell: ldapadd -x -D cn=Manager,{{ ldapDomain }} -w {{ ldapManagerPassword }} -f /tmp/pwpolicies.ldif
  when: pwpoliciesConfigured|failed

- name: check defaultPwpolicy config
  shell: ldapsearch -D cn=binddn,ou=Accounts,{{ ldapDomain }} -w {{ ldapBindDNPassword }} -b cn=default,ou=pwpolicies,{{ ldapDomain }} objectClass=*
  ignore_errors: true
  register: defaultPpolicyConfigured

- name: add defaultPwpolicy
  shell: ldapadd -x -D cn=Manager,{{ ldapDomain }} -w {{ ldapManagerPassword }} -f /tmp/default_ppolicy.ldif
  when: defaultPpolicyConfigured|failed