bitlair/ansible
8
0
Fork 1
Code Issues Pull requests Activity Actions

ldap van revspace, nog aanpassen

Browse source
This commit is contained in:
Mark Janssen 2025-04-30 21:42:38 +02:00
parent 4870960b45
commit a74ef0de9a
Signed by: foobar
GPG key ID: D8674D8FC4F69BD2
32 changed files with 964 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

49
roles/ldapserver/files/cn={4}revspace.ldif Normal file
View file

@ -0,0 +1,49 @@
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
dn: cn={4}revspace
objectClass: olcSchemaConfig
cn: {4}revspace
olcObjectIdentifier: {0}revspaceOID 1.3.6.1.4.1.36206
olcObjectIdentifier: {1}revspaceLDAP revspaceOID:1
olcObjectIdentifier: {2}revspaceAttributeType revspaceLDAP:16
olcObjectIdentifier: {3}revspaceObjectClass revspaceLDAP:17
olcAttributeTypes: {0}( revspaceAttributeType:1 NAME 'accountBalance' DESC '
RevSpace bank account balance in eurocent' EQUALITY integerMatch SYNTAX 1.3
.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
olcAttributeTypes: {1}( revspaceAttributeType:2 NAME 'iButtonSerial' DESC 'i
Button serial' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SU
BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: {2}( revspaceAttributeType:7 NAME 'tweetEntry' DESC 'Twee
t entry' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
olcAttributeTypes: {3}( revspaceAttributeType:8 NAME 'chanmsgEntry' DESC 'An
nounce entry on irc channel' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.
115.121.1.7 )
olcAttributeTypes: {4}( revspaceAttributeType:9 NAME 'statusEntry' DESC 'Ann
ounce entry in JSON status' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.1
15.121.1.7 )
olcAttributeTypes: {5}( revspaceAttributeType:3 NAME 'articleName' DESC 'Rev
Space stock management item name' EQUALITY caseIgnoreMatch ORDERING caseIgn
oreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1
15.121.1.15 )
olcAttributeTypes: {6}( revspaceAttributeType:6 NAME 'barCode' DESC 'RevSpac
e stock management item barcode' EQUALITY caseIgnoreMatch ORDERING caseIgno
reOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
5.121.1.15 )
olcAttributeTypes: {7}( revspaceAttributeType:4 NAME 'stock' DESC 'Amount of
items in stock' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
olcAttributeTypes: {8}( revspaceAttributeType:5 NAME 'price' DESC 'Price per
item in eurocent' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
27 SINGLE-VALUE )
olcObjectClasses: {0}( revspaceObjectClass:1 NAME 'revspaceAccount' DESC 'mi
xin RevSpace account details' AUXILIARY MAY ( accountBalance $ iButtonSeria
l $ tweetEntry $ chanmsgEntry $ statusEntry ) )
olcObjectClasses: {1}( revspaceObjectClass:2 NAME 'revspaceProduct' DESC 'mi
xin RevSpace product details' STRUCTURAL MUST ( articleName $ price ) MAY (
stock $ barCode ) )
structuralObjectClass: olcSchemaConfig
entryUUID: 2d92bbae-fbff-1034-865e-79a954a03d07
creatorsName: cn=config
createTimestamp: 20150930204006Z
entryCSN: 20150930204006.374158Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20150930204006Z

48
roles/ldapserver/files/cn={5}sudoers.ldif Normal file
View file

@ -0,0 +1,48 @@
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
dn: cn={5}sudoers
objectClass: olcSchemaConfig
cn: {5}sudoers
olcAttributeTypes: {0}( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s
) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5Substrin
gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {1}( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s
) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5Substring
sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: {2}( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Com
mand(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4
.1.1466.115.121.1.26 )
olcAttributeTypes: {3}( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(
s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466
.115.121.1.26 )
olcAttributeTypes: {4}( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Opti
ons(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466
.115.121.1.26 )
olcAttributeTypes: {5}( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'U
ser(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.
1466.115.121.1.26 )
olcAttributeTypes: {6}( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC '
Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.
1.1466.115.121.1.26 )
olcAttributeTypes: {7}( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'S
tart of time interval for which the entry is valid' EQUALITY generalizedTim
eMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.12
1.1.24 )
olcAttributeTypes: {8}( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'En
d of time interval for which the entry is valid' EQUALITY generalizedTimeMa
tch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
.24 )
olcAttributeTypes: {9}( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an i
nteger to order the sudoRole entries' EQUALITY integerMatch ORDERING intege
rOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcObjectClasses: {0}( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer
Entries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand
$ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoNotBefore
$ sudoNotAfter $ sudoOrder $ description ) )
structuralObjectClass: olcSchemaConfig
entryUUID: 3a967b84-0248-1035-954b-037a0fbd2d2a
creatorsName: cn=config
createTimestamp: 20151008203808Z
entryCSN: 20151008203808.446725Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20151008203808Z

94
roles/ldapserver/files/revspace.schema Normal file
View file

@ -0,0 +1,94 @@
#
# Author: "Koen Martens" <gmc@revspace.nl>
# Desc. : RevSpaceBank account balance field definition and
# mixin objectClass for RevSpace ldap directory
# RevSpace stock management object class and attributes
# to be replaced with assigned PEN
objectIdentifier revspaceOID 1.3.6.1.4.1.36206
# some further derived short-hands
objectIdentifier revspaceLDAP revspaceOID:1
objectIdentifier revspaceAttributeType revspaceLDAP:16
objectIdentifier revspaceObjectClass revspaceLDAP:17
# the account balance, in eurocent
#attributetype ( 1.3.6.1.1.1.1.8 NAME 'shadowWarning'
# EQUALITY integerMatch
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
attributeType ( revspaceAttributeType:1 NAME 'accountBalance'
DESC 'RevSpace bank account balance in eurocent'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
EQUALITY integerMatch
SINGLE-VALUE )
attributeType ( revspaceAttributeType:2 NAME 'iButtonSerial'
DESC 'iButton serial'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
ORDERING caseIgnoreOrderingMatch )
attributeType ( revspaceAttributeType:7 NAME 'tweetEntry'
DESC 'Tweet entry'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
EQUALITY booleanMatch )
attributeType ( revspaceAttributeType:8 NAME 'chanmsgEntry'
DESC 'Announce entry on irc channel'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
EQUALITY booleanMatch )
attributeType ( revspaceAttributeType:9 NAME 'statusEntry'
DESC 'Announce entry in JSON status'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
EQUALITY booleanMatch )
#attributeType ( revspaceAttributeType:2 NAME 'iButtonSerial'
# DESC 'iButton serial'
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.16
# EQUALITY caseIgnoreMatch
# SUBSTR caseIgnoreSubstringsMatch
# ORDERING caseIgnoreOrderingMatch )
objectclass ( revspaceObjectClass:1 NAME 'revspaceAccount'
DESC 'mixin RevSpace account details'
AUXILIARY
MAY ( accountBalance $ iButtonSerial $ tweetEntry $ chanmsgEntry $ statusEntry ) )
# RevSpace stock management (bar items)
#
attributeType ( revspaceAttributeType:3 NAME 'articleName'
DESC 'RevSpace stock management item name'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
ORDERING caseIgnoreOrderingMatch )
attributeType ( revspaceAttributeType:6 NAME 'barCode'
DESC 'RevSpace stock management item barcode'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
ORDERING caseIgnoreOrderingMatch )
attributeType ( revspaceAttributeType:4 NAME 'stock'
DESC 'Amount of items in stock'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
EQUALITY integerMatch
SINGLE-VALUE )
attributeType ( revspaceAttributeType:5 NAME 'price'
DESC 'Price per item in eurocent'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
EQUALITY integerMatch
SINGLE-VALUE )
objectclass ( revspaceObjectClass:2 NAME 'revspaceProduct'
DESC 'mixin RevSpace product details'
STRUCTURAL
MUST ( articleName $ price )
MAY ( stock $ barCode ) )

1
roles/ldapserver/files/ssl/cacert.pem Symbolic link
View file

@ -0,0 +1 @@
../../../../certs/lets-encrypt-x1.pem

1
roles/ldapserver/files/ssl/server-cert.pem Symbolic link
View file

@ -0,0 +1 @@
../../../../certs/ldap/ldap.space.revspace.nl.cert

1
roles/ldapserver/files/ssl/server-key.pem Symbolic link
View file

@ -0,0 +1 @@
../../../../certs/ldap/space.revspace.nl.key

77
roles/ldapserver/files/sudoers.ldif Normal file
View file

@ -0,0 +1,77 @@
dn: cn=sudoers,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: sudoers
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.1
NAME 'sudoUser'
DESC 'User(s) who may run sudo'
EQUALITY caseExactIA5Match
SUBSTR caseExactIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.2
NAME 'sudoHost'
DESC 'Host(s) who may run sudo'
EQUALITY caseExactIA5Match
SUBSTR caseExactIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.3
NAME 'sudoCommand'
DESC 'Command(s) to be executed by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.4
NAME 'sudoRunAs'
DESC 'User(s) impersonated by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.5
NAME 'sudoOption'
DESC 'Options(s) followed by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.6
NAME 'sudoRunAsUser'
DESC 'User(s) impersonated by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.7
NAME 'sudoRunAsGroup'
DESC 'Group(s) impersonated by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.8
NAME 'sudoNotBefore'
DESC 'Start of time interval for which the entry is valid'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.9
NAME 'sudoNotAfter'
DESC 'End of time interval for which the entry is valid'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.10
NAME 'sudoOrder'
DESC 'an integer to order the sudoRole entries'
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcObjectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
DESC 'Sudoer Entries'
MUST ( cn )
MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudoNotAfter $
sudoOrder $ description )
)

73
roles/ldapserver/files/sudoers.schema Normal file
View file

@ -0,0 +1,73 @@
attributetype ( 1.3.6.1.4.1.15953.9.1.1
NAME 'sudoUser'
DESC 'User(s) who may run sudo'
EQUALITY caseExactIA5Match
SUBSTR caseExactIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.2
NAME 'sudoHost'
DESC 'Host(s) who may run sudo'
EQUALITY caseExactIA5Match
SUBSTR caseExactIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.3
NAME 'sudoCommand'
DESC 'Command(s) to be executed by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.4
NAME 'sudoRunAs'
DESC 'User(s) impersonated by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.5
NAME 'sudoOption'
DESC 'Options(s) followed by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.6
NAME 'sudoRunAsUser'
DESC 'User(s) impersonated by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.7
NAME 'sudoRunAsGroup'
DESC 'Group(s) impersonated by sudo'
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributetype ( 1.3.6.1.4.1.15953.9.1.8
NAME 'sudoNotBefore'
DESC 'Start of time interval for which the entry is valid'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
attributetype ( 1.3.6.1.4.1.15953.9.1.9
NAME 'sudoNotAfter'
DESC 'End of time interval for which the entry is valid'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
attributeTypes ( 1.3.6.1.4.1.15953.9.1.10
NAME 'sudoOrder'
DESC 'an integer to order the sudoRole entries'
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
DESC 'Sudoer Entries'
MUST ( cn )
MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudoNotAfter $
sudoOrder $ description )
)

4
roles/ldapserver/handlers/main.yaml Normal file
View file

@ -0,0 +1,4 @@
---
- name: Restart slapd
service: name=slapd state=restarted

99
roles/ldapserver/tasks/main.yaml Normal file
View file

@ -0,0 +1,99 @@
---
- name: Configure debconf items for slapd
debconf:
name: slapd
question: "slapd/{{ item.q }}"
value: "{{ item.v }}"
vtype: "{{ item.t }}"
with_items:
- { q: 'domain', v: "{{ slapd_domain }}", t: 'string' }
- { q: 'backend', v: "MDB", t: 'select' }
notify:
- Restart slapd
- name: Configure debconf items for slapd (passwords)
debconf:
name: slapd
question: "slapd/{{ item.q }}"
value: "{{ item.v }}"
vtype: "{{ item.t }}"
with_items:
- { q: 'password1', v: "{{ slapd_admin_pass }}", t: 'password' }
- { q: 'password2', v: "{{ slapd_admin_pass }}", t: 'password' }
changed_when: false
no_log: "{{ filter_logs|default('true') }}"
- name: Install required software
apt:
pkg:
- slapd
- ldap-utils
state: present
- name: Set ldap OLC password
lineinfile:
dest: "/etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif"
line: "olcRootPW: {{ slapd_config_pass }}"
insertafter: "^modifyTimeStamp:"
regexp: "^olcRootPW"
notify:
- Restart slapd
- name: Copy revspace schema and olcConfig
copy:
src: "{{ item.src }}"
dest: "/etc/ldap/{{ item.dst }}"
owner: "openldap"
group: "openldap"
mode: "0644"
with_items:
- { src: "revspace.schema", dst: "schema/revspace.schema" }
- { src: "sudoers.schema", dst: "schema/sudoers.schema" }
- { src: "cn={4}revspace.ldif", dst: "slapd.d/cn=config/cn=schema/cn={4}revspace.ldif" }
- { src: "cn={5}sudoers.ldif", dst: "slapd.d/cn=config/cn=schema/cn={5}sudoers.ldif" }
notify:
- Restart slapd
#- name: Create directory for certificates
# file: path={{ slapd_certpath }} state=directory owner=openldap group=openldap mode=0700
#
#- name: Copy TLS files
# copy: src=ssl/{{ item }} dest={{ slapd_certpath }}/{{ item }} owner=openldap group=openldap mode=0400
# with_items:
# - cacert.pem
# - server-key.pem
# - server-cert.pem
- name: Template olc edits
template:
src: "{{ item }}.j2"
dest: "/etc/ldap/{{ item }}.ldif"
owner: "openldap"
group: "openldap"
mode: "0600"
with_items:
- olcAccess
- olcSSL
register: olcedits
notify:
- Restart slapd
- name: Update olcConfig
command: "ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/{{ item }}.ldif"
with_items:
- olcAccess
- olcSSL
when: olcedits is changed
ignore_errors: true
changed_when: false
notify:
- Restart slapd
- name: Enable SSL listener
lineinfile:
dest: "/etc/default/slapd"
line: "SLAPD_SERVICES=\"ldap:/// ldaps:/// ldapi:///\""
regexp: "^SLAPD_SERVICES"
notify:
- Restart slapd

8
roles/ldapserver/templates/olcAccess.j2 Normal file
View file

@ -0,0 +1,8 @@
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {1}to attrs=loginShell,gecos
by dn="cn=admin,{{slapd_root}}" write
by self write
by * read

15
roles/ldapserver/templates/olcSSL.j2 Normal file
View file

@ -0,0 +1,15 @@
# {{ansible_managed }}
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: {{slapd_certpath}}/fullchain.pem
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: {{slapd_certpath}}/privkey.pem
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: {{slapd_certpath}}/cert.pem
-
replace: olcTLSCipherSuite
olcTLSCipherSuite: {{slapd_cipher_suite}}

1
roles/ldapserver/vars/.gitignore vendored Normal file
View file

@ -0,0 +1 @@
secret.yaml

9
roles/ldapserver/vars/main.yaml Normal file
View file

@ -0,0 +1,9 @@
---
slapd_config_pass: "{{ lookup('passwordstore', 'revspace/ldap/config') }}"
slapd_admin_pass: "{{ lookup('passwordstore', 'revspace/ldap/admin') }}"
slapd_domain: "space.revspace.nl"
slapd_root: "dc=space,dc=revspace,dc=nl"
slapd_certpath: "/etc/dehydrated/certs/ldap.space.revspace.nl/"
slapd_cipher_suite: "SECURE256:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC"