Skip to content

Commit 105e9e3

Browse files
committed
rename variables
1 parent 45fdd37 commit 105e9e3

File tree

11 files changed

+72
-65
lines changed

11 files changed

+72
-65
lines changed

CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog
22

3+
## 1.0.1
4+
- Rename environment variables
5+
6+
## 1.0.0
7+
- Use light-baseimage
8+
- Improve documentation
9+
310
## 0.10.2
411

512
- New features:

Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
NAME = osixia/openldap
2-
VERSION = 1.0.0
2+
VERSION = 1.0.1
33

44
.PHONY: all build test tag_latest release
55

README.md

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -93,30 +93,30 @@ By default TLS is enable, a certificate is created with the container hostname (
9393

9494
#### Use your own certificate
9595

96-
Add your custom certificate, private key and CA certificate in the directory **image/service/slapd/assets/ssl** adjust filename in **image/env.yaml** and rebuild the image ([see manual build](#manual-build)).
96+
Add your custom certificate, private key and CA certificate in the directory **image/service/slapd/assets/certs** adjust filename in **image/env.yaml** and rebuild the image ([see manual build](#manual-build)).
9797

98-
Or you can set your custom certificate at run time, by mouting a directory containing thoses files to **/container/service/slapd/assets/ssl** and adjust there name with the following environment variables :
98+
Or you can set your custom certificate at run time, by mouting a directory containing thoses files to **/container/service/slapd/assets/certs** and adjust there name with the following environment variables :
9999

100-
docker run -h ldap.example.org -v /path/to/certifates:/container/service/slapd/assets/ssl \
101-
-e SSL_CRT_FILENAME=my-ldap.crt \
102-
-e SSL_KEY_FILENAME=my-ldap.key \
103-
-e SSL_CA_CRT_FILENAME=the-ca.crt \
100+
docker run -h ldap.example.org -v /path/to/certifates:/container/service/slapd/assets/certs \
101+
-e LDAP_TLS_CRT_FILENAME=my-ldap.crt \
102+
-e LDAP_TLS_KEY_FILENAME=my-ldap.key \
103+
-e LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \
104104
-d osixia/openldap
105105

106106
#### Disable TLS
107-
Add -e USE_TLS=false to the run command :
107+
Add -e LDAP_PROPOSE_TLS=false to the run command :
108108

109-
docker run -e USE_TLS=false -d osixia/openldap
109+
docker run -e LDAP_PROPOSE_TLS=false -d osixia/openldap
110110

111111
### Multi master replication
112112
Quick example, with the default config.
113113

114114
#Create the first ldap server, save the container id in LDAP_CID and get its IP:
115-
LDAP_CID=$(docker run -h ldap.example.org -e USE_REPLICATION=true -d osixia/openldap)
115+
LDAP_CID=$(docker run -h ldap.example.org -e LDAP_REPLICATION=true -d osixia/openldap)
116116
LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID)
117117

118118
#Create the second ldap server, save the container id in LDAP2_CID and get its IP:
119-
LDAP2_CID=$(docker run -h ldap2.example.org -e USE_REPLICATION=true -d osixia/openldap)
119+
LDAP2_CID=$(docker run -h ldap2.example.org -e LDAP_REPLICATION=true -d osixia/openldap)
120120
LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID)
121121

122122
#Add the pair "ip hostname" to /etc/hosts on each containers,
@@ -169,16 +169,16 @@ Required and used for new ldap server only :
169169
- **LDAP_CONFIG_PASSWORD** Ldap Config password. Defaults to `config`
170170

171171
TLS options :
172-
- **USE_TLS**: Add openldap TLS capabilities. Defaults to `true`
173-
- **SSL_CRT_FILENAME**: Ldap ssl certificate filename. Defaults to `ldap.crt`
174-
- **SSL_KEY_FILENAME**: Ldap ssl certificate private key filename. Defaults to `ldap.key`
175-
- **SSL_CA_CRT_FILENAME**: Ldap ssl CA certificate filename. Defaults to `ca.crt`
172+
- **LDAP_PROPOSE_TLS**: Add openldap TLS capabilities. Defaults to `true`
173+
- **LDAP_TLS_CRT_FILENAME**: Ldap ssl certificate filename. Defaults to `ldap.crt`
174+
- **LDAP_TLS_KEY_FILENAME**: Ldap ssl certificate private key filename. Defaults to `ldap.key`
175+
- **LDAP_TLS_CA_CRT_FILENAME**: Ldap ssl CA certificate filename. Defaults to `ca.crt`
176176

177177
Replication options :
178-
- **USE_REPLICATION**: Add openldap replication capabilities. Defaults to `false`
179-
- **REPLICATION_CONFIG_SYNCPROV**: olcSyncRepl options used for the config database. Without **rid** and **provider** which are automaticaly added based on REPLICATION_HOSTS. Defaults to `binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical`
180-
- **REPLICATION_HDB_SYNCPROV**: olcSyncRepl options used for the HDB database. Without **rid** and **provider** which are automaticaly added based on REPLICATION_HOSTS. Defaults to `binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical`
181-
- **REPLICATION_HOSTS**: list of replication hosts, must contains the current container hostname set by -h on docker run command. Defaults to `['ldap://ldap.example.org', 'ldap://ldap2.example.org']`
178+
- **LDAP_REPLICATION**: Add openldap replication capabilities. Defaults to `false`
179+
- **LDAP_REPLICATION_CONFIG_SYNCPROV**: olcSyncRepl options used for the config database. Without **rid** and **provider** which are automaticaly added based on LDAP_REPLICATION_HOSTS. Defaults to `binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical`
180+
- **LDAP_REPLICATION_HDB_SYNCPROV**: olcSyncRepl options used for the HDB database. Without **rid** and **provider** which are automaticaly added based on LDAP_REPLICATION_HOSTS. Defaults to `binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical`
181+
- **LDAP_REPLICATION_HOSTS**: list of replication hosts, must contains the current container hostname set by -h on docker run command. Defaults to `['ldap://ldap.example.org', 'ldap://ldap2.example.org']`
182182

183183
### Set environment variables at run time :
184184

image/env.yaml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,21 @@ LDAP_CONFIG_PASSWORD: config
66
#See table 5.1 in http://www.openldap.org/doc/admin24/slapdconf2.html for the available log levels.
77
LDAP_LOG_LEVEL: 256
88

9-
USE_TLS: true
10-
SSL_CRT_FILENAME: ldap.crt
11-
SSL_KEY_FILENAME: ldap.key
12-
SSL_CA_CRT_FILENAME: ca.crt
9+
LDAP_PROPOSE_TLS: true
10+
LDAP_TLS_CRT_FILENAME: ldap.crt
11+
LDAP_TLS_KEY_FILENAME: ldap.key
12+
LDAP_TLS_CA_CRT_FILENAME: ca.crt
1313

1414

15-
USE_REPLICATION: false
15+
LDAP_REPLICATION: false
1616
# variables $BASE_DN, $LDAP_ADMIN_PASSWORD, $LDAP_CONFIG_PASSWORD
1717
# are automaticaly replaced at run time
1818

1919
# if you want to add replication to an existing ldap
20-
# adapt REPLICATION_CONFIG_SYNCPROV and REPLICATION_HDB_SYNCPROV to your configuration
20+
# adapt LDAP_REPLICATION_CONFIG_SYNCPROV and LDAP_REPLICATION_HDB_SYNCPROV to your configuration
2121
# avoid using $BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD variables
22-
REPLICATION_CONFIG_SYNCPROV: binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical
23-
REPLICATION_HDB_SYNCPROV: binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical
24-
REPLICATION_HOSTS:
22+
LDAP_REPLICATION_CONFIG_SYNCPROV: binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical
23+
LDAP_REPLICATION_HDB_SYNCPROV: binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical
24+
LDAP_REPLICATION_HOSTS:
2525
- ldap://ldap.example.org # The order must be the same on all ldap servers
2626
- ldap://ldap2.example.org
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Add your tls server certificate, key and the CA certificate (if any) here
2+
or during docker run mount a data volume with thoses files to /container/service/slapd/assets/certs
File renamed without changes.

image/service/slapd/assets/config/replication/replication-enable.ldif

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ olcModuleLoad: syncprov
88
dn: cn=config
99
changeType: modify
1010
add: olcServerID
11-
{{ REPLICATION_HOSTS }}
11+
{{ LDAP_REPLICATION_HOSTS }}
1212

1313
# Add syncprov on config
1414
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
@@ -21,7 +21,7 @@ olcOverlay: syncprov
2121
dn: olcDatabase={0}config,cn=config
2222
changetype: modify
2323
add: olcSyncRepl
24-
{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}
24+
{{ LDAP_REPLICATION_HOSTS_CONFIG_SYNC_REPL }}
2525
-
2626
add: olcMirrorMode
2727
olcMirrorMode: TRUE
@@ -37,7 +37,7 @@ olcOverlay: syncprov
3737
dn: olcDatabase={1}hdb,cn=config
3838
changetype: modify
3939
add: olcSyncRepl
40-
{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}
40+
{{ LDAP_REPLICATION_HOSTS_HDB_SYNC_REPL }}
4141
-
4242
add: olcMirrorMode
4343
olcMirrorMode: TRUE

image/service/slapd/assets/config/tls/tls-enable.ldif

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@ replace: olcTLSCipherSuite
44
olcTLSCipherSuite: SECURE256:-VERS-SSL3.0
55
-
66
replace: olcTLSCACertificateFile
7-
olcTLSCACertificateFile: /container/service/slapd/assets/ssl/ca.crt
7+
olcTLSCACertificateFile: /container/service/slapd/assets/certs/ca.crt
88
-
99
replace: olcTLSCertificateFile
10-
olcTLSCertificateFile: /container/service/slapd/assets/ssl/ldap.crt
10+
olcTLSCertificateFile: /container/service/slapd/assets/certs/ldap.crt
1111
-
1212
replace: olcTLSCertificateKeyFile
13-
olcTLSCertificateKeyFile: /container/service/slapd/assets/ssl/ldap.key
13+
olcTLSCertificateKeyFile: /container/service/slapd/assets/certs/ldap.key
1414
-
1515
replace: olcTLSDHParamFile
16-
olcTLSDHParamFile: /container/service/slapd/assets/ssl/dhparam.pem
16+
olcTLSDHParamFile: /container/service/slapd/assets/certs/dhparam.pem
1717
-
1818
replace: olcTLSVerifyClient
1919
olcTLSVerifyClient: demand

image/service/slapd/assets/ssl/README.md

Lines changed: 0 additions & 2 deletions
This file was deleted.

image/service/slapd/container-start.sh

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,10 @@ if [ ! -e "$FIRST_START_DONE" ]; then
4444
local LDAP_KEY=$3
4545

4646
# check certificat and key or create it
47-
/sbin/ssl-helper "/container/service/slapd/assets/ssl/$LDAP_CRT" "/container/service/slapd/assets/ssl/$LDAP_KEY" --ca-crt=/container/service/slapd/assets/ssl/$CA_CRT --gnutls
47+
/sbin/ssl-helper "/container/service/slapd/assets/certs/$LDAP_CRT" "/container/service/slapd/assets/certs/$LDAP_KEY" --ca-crt=/container/service/slapd/assets/certs/$CA_CRT --gnutls
4848

4949
# create DHParamFile if not found
50-
[ -f /container/service/slapd/assets/ssl/dhparam.pem ] || openssl dhparam -out /container/service/slapd/assets/ssl/dhparam.pem 2048
50+
[ -f /container/service/slapd/assets/certs/dhparam.pem ] || openssl dhparam -out /container/service/slapd/assets/certs/dhparam.pem 2048
5151

5252
# fix file permissions
5353
chown -R openldap:openldap /container/service/slapd
@@ -97,7 +97,7 @@ EOF
9797

9898
. $WAS_STARTED_WITH_TLS
9999

100-
check_tls_files $PREVIOUS_SSL_CA_CRT_FILENAME $PREVIOUS_SSL_CRT_FILENAME $PREVIOUS_SSL_KEY_FILENAME
100+
check_tls_files $PREVIOUS_LDAP_TLS_CA_CRT_FILENAME $PREVIOUS_LDAP_TLS_CRT_FILENAME $PREVIOUS_LDAP_TLS_KEY_FILENAME
101101
fi
102102
fi
103103

@@ -150,34 +150,34 @@ EOF
150150
fi
151151

152152
# TLS config
153-
if [ "${USE_TLS,,}" == "true" ]; then
153+
if [ "${LDAP_PROPOSE_TLS,,}" == "true" ]; then
154154

155155
echo "Use TLS"
156156

157-
check_tls_files $SSL_CA_CRT_FILENAME $SSL_CRT_FILENAME $SSL_KEY_FILENAME
157+
check_tls_files $LDAP_TLS_CA_CRT_FILENAME $LDAP_TLS_CRT_FILENAME $LDAP_TLS_KEY_FILENAME
158158

159159
# adapt tls ldif
160-
sed -i "s,/container/service/slapd/assets/ssl/ca.crt,/container/service/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
161-
sed -i "s,/container/service/slapd/assets/ssl/ldap.crt,/container/service/slapd/assets/ssl/${SSL_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
162-
sed -i "s,/container/service/slapd/assets/ssl/ldap.key,/container/service/slapd/assets/ssl/${SSL_KEY_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
160+
sed -i "s,/container/service/slapd/assets/certs/ca.crt,/container/service/slapd/assets/certs/${LDAP_TLS_CA_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
161+
sed -i "s,/container/service/slapd/assets/certs/ldap.crt,/container/service/slapd/assets/certs/${LDAP_TLS_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
162+
sed -i "s,/container/service/slapd/assets/certs/ldap.key,/container/service/slapd/assets/certs/${LDAP_TLS_KEY_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
163163

164164
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/tls/tls-enable.ldif
165165

166166
[[ -f "$WAS_STARTED_WITH_TLS" ]] && rm -f "$WAS_STARTED_WITH_TLS"
167167
touch $WAS_STARTED_WITH_TLS
168-
echo "export PREVIOUS_SSL_CA_CRT_FILENAME=${SSL_CA_CRT_FILENAME}" >> $WAS_STARTED_WITH_TLS
169-
echo "export PREVIOUS_SSL_CRT_FILENAME=${SSL_CRT_FILENAME}" >> $WAS_STARTED_WITH_TLS
170-
echo "export PREVIOUS_SSL_KEY_FILENAME=${SSL_KEY_FILENAME}" >> $WAS_STARTED_WITH_TLS
168+
echo "export PREVIOUS_LDAP_TLS_CA_CRT_FILENAME=${LDAP_TLS_CA_CRT_FILENAME}" >> $WAS_STARTED_WITH_TLS
169+
echo "export PREVIOUS_LDAP_TLS_CRT_FILENAME=${LDAP_TLS_CRT_FILENAME}" >> $WAS_STARTED_WITH_TLS
170+
echo "export PREVIOUS_LDAP_TLS_KEY_FILENAME=${LDAP_TLS_KEY_FILENAME}" >> $WAS_STARTED_WITH_TLS
171171
chmod +x $WAS_STARTED_WITH_TLS
172172

173173
# ldap client config
174-
sed -i "s,TLS_CACERT.*,TLS_CACERT /container/service/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /etc/ldap/ldap.conf
174+
sed -i "s,TLS_CACERT.*,TLS_CACERT /container/service/slapd/assets/certs/${LDAP_TLS_CA_CRT_FILENAME},g" /etc/ldap/ldap.conf
175175
echo "TLS_REQCERT demand" >> /etc/ldap/ldap.conf
176176

177177
[[ -f "$HOME/.ldaprc" ]] && rm -f $HOME/.ldaprc
178178
touch $HOME/.ldaprc
179-
echo "TLS_CERT /container/service/slapd/assets/ssl/${SSL_CRT_FILENAME}" >> $HOME/.ldaprc
180-
echo "TLS_KEY /container/service/slapd/assets/ssl/${SSL_KEY_FILENAME}" >> $HOME/.ldaprc
179+
echo "TLS_CERT /container/service/slapd/assets/certs/${LDAP_TLS_CRT_FILENAME}" >> $HOME/.ldaprc
180+
echo "TLS_KEY /container/service/slapd/assets/certs/${LDAP_TLS_KEY_FILENAME}" >> $HOME/.ldaprc
181181

182182
else
183183

@@ -190,24 +190,24 @@ EOF
190190

191191

192192
# replication config
193-
if [ "${USE_REPLICATION,,}" == "true" ]; then
193+
if [ "${LDAP_REPLICATION,,}" == "true" ]; then
194194

195195
if [ -e "$WAS_STARTED_WITH_REPLICATION" ]; then
196196
echo "Replication already set"
197197
else
198198
echo "Use replication"
199199

200-
REPLICATION_HOSTS=($REPLICATION_HOSTS)
200+
LDAP_REPLICATION_HOSTS=($LDAP_REPLICATION_HOSTS)
201201
i=1
202-
for host in "${REPLICATION_HOSTS[@]}"
202+
for host in "${LDAP_REPLICATION_HOSTS[@]}"
203203
do
204204

205205
#host var contain a variable name, we access to the variable value
206206
host=${!host}
207207

208-
sed -i "s|{{ REPLICATION_HOSTS }}|olcServerID: $i ${host}\n{{ REPLICATION_HOSTS }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
209-
sed -i "s|{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|olcSyncRepl: rid=00$i provider=${host} ${REPLICATION_CONFIG_SYNCPROV}\n{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
210-
sed -i "s|{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|olcSyncRepl: rid=10$i provider=${host} ${REPLICATION_HDB_SYNCPROV}\n{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
208+
sed -i "s|{{ LDAP_REPLICATION_HOSTS }}|olcServerID: $i ${host}\n{{ LDAP_REPLICATION_HOSTS }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
209+
sed -i "s|{{ LDAP_REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|olcSyncRepl: rid=00$i provider=${host} ${LDAP_REPLICATION_CONFIG_SYNCPROV}\n{{ LDAP_REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
210+
sed -i "s|{{ LDAP_REPLICATION_HOSTS_HDB_SYNC_REPL }}|olcSyncRepl: rid=10$i provider=${host} ${LDAP_REPLICATION_HDB_SYNCPROV}\n{{ LDAP_REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
211211

212212
((i++))
213213
done
@@ -217,9 +217,9 @@ EOF
217217
sed -i "s|\$LDAP_ADMIN_PASSWORD|$LDAP_ADMIN_PASSWORD|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
218218
sed -i "s|\$LDAP_CONFIG_PASSWORD|$LDAP_CONFIG_PASSWORD|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
219219

220-
sed -i "/{{ REPLICATION_HOSTS }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
221-
sed -i "/{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
222-
sed -i "/{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
220+
sed -i "/{{ LDAP_REPLICATION_HOSTS }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
221+
sed -i "/{{ LDAP_REPLICATION_HOSTS_CONFIG_SYNC_REPL }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
222+
sed -i "/{{ LDAP_REPLICATION_HOSTS_HDB_SYNC_REPL }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
223223

224224
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/replication/replication-enable.ldif
225225
touch $WAS_STARTED_WITH_REPLICATION

0 commit comments

Comments
 (0)