role slapd:

- setup ssl (WIP)
- setup replication provider (WIP)
- setup replication consumer (WIP)

ssl and replication provider seems to be ok (need to test on clean machine)

replication consumer needs more testing

tasks/main.yml

@@ -1,5 +1,6 @@
 ---
 # tasks file for /etc/ansible/roles/slapd
+
 - name: OS specific vars
   include_vars: "{{ ansible_distribution }}.yml"
 
@@ -8,6 +9,12 @@
     name: "{{ ldap_packages }}"
     state: present
 
+- name: configure client
+  template:
+    src: ldap.conf
+    dest: /etc/openldap/ldap.conf
+    mode: 0644
+
 - name: activate service
   service:
     name: "{{ ldap_service }}"
@@ -41,12 +48,6 @@
     attributes:
       dc: "{{ ldap_domain }}"
 
-- name: configure client
-  template:
-    src: ldap.conf
-    dest: /etc/openldap/ldap.conf
-    mode: 0644
-
 - name: create passwd file
   copy:
     dest: /root/.ldap.secrets
@@ -79,3 +80,47 @@
     command: "ldapadd -y /root/.ldap.secrets -xD {{ ldap_admin_dn }} -f {{ item .path}}"
     with_items: "{{ ldif_list.files }}"
   when: import_data == true
+
+- name: configure replication provider
+  include_tasks: replication_provider.yml
+  when: ldap_replication_provider
+
+- name: configure replication consumer
+  include_tasks: replication_consumer.yml
+  when: ldap_replication_consumer
+
+- name: open firewall
+  firewalld:
+    service: "{{ item }}"
+    permanent: yes
+    immediate: yes
+    state: enabled
+  loop:
+     - ldap
+     - ldaps
+
+# cannot use ldap_entry module because attr olcTLS* don't have equality matching
+# rules ...
+# instead send ldif and process ...
+
+- name: configure ssl
+  tags: ssl
+  block:
+  - name: ensure certificate and key files have correct permissions
+    file:
+      path: "{{ item }}"
+      group: ldap
+      mode: 0640
+    loop:
+    - "{{ ldap_ssl_cert_path }}"
+    - "{{ ldap_ssl_key_path }}"
+    - "{{ ldap_ssl_cacert_path }}"
+  - name: send ldif file
+    template:
+      src: ssl.ldif
+      dest: /root/Ldif/
+
+  - name: import ldif
+    command: ldapmodify  -c -Y EXTERNAL -H ldapi:/// -f /root/Ldif/ssl.ldif
+  when: ldap_have_ssl
+

tasks/replication_consumer.yml

@@ -0,0 +1,19 @@
+---
+- name: add synrepl entry
+  ldap_attr:
+    dn: olcDatabase={2}hdb,cn=config
+    name: "{{ item.name }}"
+    values: "{{ item.value }}"
+  loop:
+   - name: olcSyncRepl
+     value: |
+      rid=001
+       provider="{{ ldap_replication_provider_uri }}"
+       binddn="cn={{ ldap_replication_account }},{{ ldap_suffix }}"
+       bindmethod="simple"
+       credentials="{{ ldap_replication_password }}"
+       searchbase="{{ ldap_suffix }}"
+       type=refreshAndPersist
+       retry="10 +"
+   - name: olcUpdateRef
+     value: "{{ ldap_provider_uri }}"

tasks/replication_provider.yml

@@ -0,0 +1,45 @@
+---
+- name: create replication account
+  ldap_entry:
+    dn: "cn={{ ldap_replication_account }},{{ ldap_suffix }}"
+    objectClass: person
+    attributes:
+     sn: "{{ ldap_replication_account }}"
+     userPassword: "{{ ldap_replication_password }}"
+    params: "{{ ldap_auth }}"
+
+- name: check wether module is already loaded
+  command: ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config   objectClass=olcModuleList olcmoduleload
+  register: ldap_result
+
+- name: add syncprov overlay module
+  ldap_entry:
+    dn: cn=module,cn=config
+    objectClass: olcModuleList
+    attributes:
+      cn: module
+      olcModuleLoad: syncprov.la
+  when: '"syncprov.la" not in  ldap_result.stdout'
+
+- name: add syncprov overlay config
+  ldap_entry:
+    dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
+    objectClass: olcSyncProvConfig
+    attributes:
+      olcOverlay: syncprov
+      olcSpCheckpoint: 100 10
+      olcSpSessionLog: 200
+
+- name: configure serverid
+  ldap_attr:
+    dn: cn=config
+    name: olcServerId
+    values: "{{ ldap_replication_server_id|default(42) }}"
+
+- name: add indexes for replication
+  ldap_attr:
+    dn: olcdatabase={2}hdb,cn=config
+    name: olcDbIndex
+    values:
+    - entryUUID eq
+    - entryCSN eq