---

- include_vars: "{{ hostvars[ansible_hostname]['ansible_distribution'] }}_{{ hostvars[ansible_hostname]['ansible_distribution_version'] }}_{{ ansible_architecture }}.yml"

- name: install system packages apt
  apt: name={{ item }} state=installed update_cache=true
  sudo: true
  with_items: system_packages
  when: ansible_os_family == 'Debian'

- name: install system packages yum
  yum: name={{ item }} state=installed
  sudo: true
  with_items: system_packages
  when: ansible_os_family == 'RedHat'

- name: hash password
  command: /usr/sbin/slappasswd -h {SSHA} -s {{ ldapManagerPassword }}
  register: ldapManagerHash

- name: hash binddn password
  command: /usr/sbin/slappasswd -h {SSHA} -s {{ ldapBindDNPassword }}
  register: ldapBindDNHash

- name: template ssl.ldif
  template: src=ssl_ldif.j2 dest=/tmp/ssl.ldif mode=600

- name: template manager.ldif
  template: src=manager_ldif.j2 dest=/tmp/manager.ldif mode=600
  sudo: true

- name: template binddn.ldif
  template: src=binddn_ldif.j2 dest=/tmp/binddn.ldif mode=600
  sudo: true

- name: template root.ldif
  template: src=root_ldif.j2 dest=/tmp/root.ldif

- name: template accounts.ldif
  template: src=accounts_ldif.j2 dest=/tmp/accounts.ldif

- name: template groups.ldif
  template: src=groups_ldif.j2 dest=/tmp/groups.ldif

- name: template acls.ldif
  template: src=acls_ldif.j2 dest=/tmp/acls.ldif

- name: template ppolicy_moduleload.ldif
  template: src=ppolicy_moduleload_ldif.j2 dest=/tmp/ppolicy_moduleload.ldif

- name: template ppolicy_overlay.ldif
  template: src=ppolicy_overlay_ldif.j2 dest=/tmp/ppolicy_overlay.ldif

- name: template pwpolices.ldif
  template: src=pwpolicies_ldif.j2 dest=/tmp/pwpolicies.ldif

- name: template default_ppolicy.ldif
  template: src=default_ppolicy_ldif.j2 dest=/tmp/default_ppolicy.ldif


- name: copy cert
  command: cp /etc/ssl/certs/server.crt /etc/openldap/certs/ldapcert.pem
  sudo: true

- name: copy cacert
  command: cp /etc/ssl/certs/ca.crt /etc/openldap/certs/cacert.pem
  sudo: true

- name: copy key
  command: cp /etc/ssl/private/server.key /etc/openldap/certs/ldapkey.pem
  sudo: true

- name: chmod key
  file: path=/etc/openldap/certs/ldapkey.pem owner={{ ldapuser }} group={{ ldapgroup }} mode=600
  sudo: true

- name: enable ssl centos
  lineinfile: regexp="SLAPD_LDAPS=no" state=present line="SLAPD_LDAPS=yes" dest=/etc/sysconfig/ldap
  sudo: true
  when: ansible_os_family == 'RedHat'

- name: start ldap
  service: name=slapd state=restarted
  sudo: true

- name: check TLS config
  shell: "slapcat -b cn=config | grep 'olcTLSCertificateKeyFile: /etc/openldap/certs/ldapkey.pem'"
  ignore_errors: true
  sudo: true
  register: tlsConfigured

- name: check Manager config
  shell: "slapcat -b cn=config | grep 'olcRootDN: {{ ldapManager }}'"
  ignore_errors: true
  sudo: true
  register: managerConfigured

# slapcat does a line wrap at character 78. Don't attempt to match on {{ ldapManager }} as it will cross two lines
- name: check ACL config
  shell: "slapcat -b cn=config | grep 'olcAccess:' | grep 'cn=Manager'"
  ignore_errors: true
  sudo: true
  register: aclConfigured


- name: check DIT config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapBase }} -x -H ldap://localhost objectClass=dcObject"
  ignore_errors: true
  register: ditConfigured

- name: check Accounts config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapUserBase }} -x -H ldap://localhost objectClass=*"
  ignore_errors: true
  register: accountsConfigured

- name: check Groups config
  shell: "ldapsearch -D {{ ldapManager }} -w {{ ldapManagerPassword }} -b {{ ldapGroupBase }} -x -H ldap://localhost objectClass=*"
  ignore_errors: true
  register: groupsConfigured

- name: check binddn config
  shell: "ldapsearch -D {{ ldapBindDN }} -w {{ ldapBindDNPassword }} -b {{ ldapDomain }} -x -H ldap://localhost objectClass=dcObject"
  ignore_errors: true
  register: binddnConfigured


- name: initialise server ssl
  shell: ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/ssl.ldif -D cn=config 
  sudo: true
  when: tlsConfigured|failed

- name: initialise server manager
  shell:  ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/manager.ldif -D cn=config 
  sudo: true
  when: managerConfigured|failed

- name: initialise server acls
  shell:  ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/acls.ldif -D cn=config
  sudo: true
  when: aclConfigured|failed

- name: add DIT root
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/root.ldif
  when: ditConfigured|failed

- name: add Accounts OU
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/accounts.ldif
  when: accountsConfigured|failed

- name: add Groups OU
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/groups.ldif
  when: groupsConfigured|failed

- name: add binddn
  shell: ldapadd -x -D {{ ldapManager }} -w {{ ldapManagerPassword }} -x -H ldap://localhost -f /tmp/binddn.ldif
  sudo: true
  when: binddnConfigured|failed
