125 lines
4.1 KiB
YAML
125 lines
4.1 KiB
YAML
---
|
|
|
|
- name: olcTLSCACertificateFile configured (cn=config)
|
|
ldap_attr:
|
|
dn: "cn=config"
|
|
name: olcTLSCACertificateFile
|
|
values: "{{ openldap_confdir }}/sasl2/fullchain.pem"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: olcTLSCACertificateFile configured (cn=config)
|
|
ldap_attr:
|
|
dn: "cn=config"
|
|
name: olcTLSCertificateKeyFile
|
|
values: "{{ openldap_confdir }}/sasl2/privkey.pem"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: olcTLSCertificateFile configured (cn=config)
|
|
ldap_attr:
|
|
dn: "cn=config"
|
|
name: olcTLSCertificateFile
|
|
values: "{{ openldap_confdir }}/sasl2/cert.pem"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: olcTLSProtocolMin configured (cn=config)
|
|
ldap_attr:
|
|
dn: "cn=config"
|
|
name: olcTLSProtocolMin
|
|
values: "3.3"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: olcSecurity configured (cn=config)
|
|
ldap_attr:
|
|
dn: "cn=config"
|
|
name: olcSecurity
|
|
values: "tls=1"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: TLS required (olcDatabase={-1}frontend,cn=config)
|
|
ldap_attr:
|
|
dn: "olcDatabase={-1}frontend,cn=config"
|
|
name: olcSecurity
|
|
values: "tls=1"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: TLS required (olcDatabase={0}config,cn=config)
|
|
ldap_attr:
|
|
dn: "olcDatabase={0}config,cn=config"
|
|
name: olcSecurity
|
|
values: "tls=1"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
- name: TLS required (olcDatabase={1}mdb,cn=config)
|
|
ldap_attr:
|
|
dn: "olcDatabase={1}mdb,cn=config"
|
|
name: olcSecurity
|
|
values: "tls=1"
|
|
state: exact
|
|
start_tls: yes
|
|
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
|
|
bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
notify: "restart slapd"
|
|
|
|
#- name: olcTLSCipherSuite configured (cn=config)
|
|
# ldap_attr:
|
|
# dn: "cn=config"
|
|
# name: olcTLSCipherSuite
|
|
# #values: "ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!EXP:!SSLV2:!eNULL"
|
|
# values: "ALL:!NULL"
|
|
# # values: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
|
# state: exact
|
|
# start_tls: yes
|
|
# bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
# bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
# notify: "restart slapd"
|
|
#
|
|
#- name: olcTLSDHParamFile configured (cn=config)
|
|
# ldap_attr:
|
|
# dn: "cn=config"
|
|
# name: olcTLSDHParamFile
|
|
# values: "{{ openldap_confdir }}/sasl2/slapd.dh.params"
|
|
# state: exact
|
|
# start_tls: yes
|
|
# bind_dn: "{{ ldap_config_admin_user_dn }}"
|
|
# bind_pw: "{{ ldap_config_admin_user_password }}"
|
|
# notify: "restart slapd"
|
|
|
|
- name: Force all notified handlers to run at this point, not waiting for normal sync points
|
|
meta: flush_handlers
|