Skip to content

Commit a4c85cd

Browse files
BertrandGounyBertrandGouny
committed
new baseimage
1 parent 6ded468 commit a4c85cd

File tree

7 files changed

+62
-80
lines changed

7 files changed

+62
-80
lines changed

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -95,9 +95,9 @@ By default TLS is enable, a certificate is created with the container hostname (
9595

9696
Add your custom certificate, private key and CA certificate in the directory **image/service/slapd/assets/ssl** adjust filename in **image/env.yaml** and rebuild the image ([see manual build](#manual-build)).
9797

98-
Or you can set your custom certificate at run time, by mouting a directory containing thoses files to **/osixia/service/slapd/assets/ssl** and adjust there name with the following environment variables :
98+
Or you can set your custom certificate at run time, by mouting a directory containing thoses files to **/container/service/slapd/assets/ssl** and adjust there name with the following environment variables :
9999

100-
docker run -h ldap.example.org -v /path/to/certifates:/osixia/service/slapd/assets/ssl \
100+
docker run -h ldap.example.org -v /path/to/certifates:/container/service/slapd/assets/ssl \
101101
-e SSL_CRT_FILENAME=my-ldap.crt \
102102
-e SSL_KEY_FILENAME=my-ldap.key \
103103
-e SSL_CA_CRT_FILENAME=the-ca.crt \
@@ -129,7 +129,7 @@ That's it ! But a litle test to be sure :
129129

130130
Add a new user "billy" on the first ldap server
131131

132-
docker exec $LDAP_CID ldapadd -x -D "cn=admin,dc=example,dc=org" -w admin -f /osixia/service/slapd/assets/test/new-user.ldif -h ldap.example.org -ZZ
132+
docker exec $LDAP_CID ldapadd -x -D "cn=admin,dc=example,dc=org" -w admin -f /container/service/slapd/assets/test/new-user.ldif -h ldap.example.org -ZZ
133133

134134
Search on the second ldap server, and billy should show up !
135135

‎image/Dockerfile‎

Lines changed: 23 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,29 @@
11
FROM osixia/light-baseimage:0.1.0
22
MAINTAINER Bertrand Gouny <[email protected]>
33

4-
# Use osixia/light-baseimage's init system.
5-
CMD ["/osixia/tool/run"]
6-
7-
# Add service directory to /osixia/service
8-
ADD service /osixia/service
9-
10-
# Scripts /sbin/add-service-available
11-
# /sbin/install-service and /sbin/clean-container
12-
# are tools from osixia/light-baseimage
13-
RUN /sbin/add-service-available ssl-helper-gnutls \
14-
&& /sbin/install-service \
15-
&& /sbin/clean-container
16-
17-
# /sbin/add-service-available ssl-helper-gnutls
18-
# Add ssl-helper-gnutls, used to generate TLS default certificates
19-
20-
# /sbin/install-service
21-
# make an apt-get update
22-
# run /osixia/service/*/install.sh
23-
# link /osixia/service/*/container-start.sh to /etc/my_init.d/*
24-
# link /osixia/service/*/daemon.sh to /etc/service/*/run
25-
26-
# Files in /etc/my_init.d will be run during container start,
27-
# Files in /etc/service/*/run are the process run by the docker image
28-
29-
# /sbin/clean-container remove unnecessary files
30-
31-
# More information :
32-
# https://github.com/osixia/docker-light-baseimage
33-
4+
# Use baseimage's init system.
5+
# https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/run
6+
CMD ["/container/tool/run"]
7+
8+
# Add openldap user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
9+
RUN groupadd -r openldap && useradd -r -g openldap openldap
10+
11+
# Install OpenLDAP, ldap-utils and ssl-helper from baseimage and remove default ldap db
12+
# https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/install-service-available
13+
RUN apt-get -y update \
14+
&& /container/tool/install-service-available ssl-helper-gnutls \
15+
&& LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --force-yes --no-install-recommends \
16+
slapd ldap-utils \
17+
&& rm -rf /var/lib/ldap /etc/ldap/slapd.d
18+
19+
# Add service directory to /container/service
20+
ADD service /container/service
21+
22+
# Use baseimage install-service script and clean all
23+
# https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/install-service
24+
RUN /container/tool/install-service \
25+
&& apt-get clean \
26+
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
3427

3528
# Add default env variables
3629
ADD env.yaml /etc/env.yaml

‎image/service/slapd/assets/config/tls/tls-enable.ldif‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@ replace: olcTLSCipherSuite
44
olcTLSCipherSuite: SECURE256:-VERS-SSL3.0
55
-
66
replace: olcTLSCACertificateFile
7-
olcTLSCACertificateFile: /osixia/service/slapd/assets/ssl/ca.crt
7+
olcTLSCACertificateFile: /container/service/slapd/assets/ssl/ca.crt
88
-
99
replace: olcTLSCertificateFile
10-
olcTLSCertificateFile: /osixia/service/slapd/assets/ssl/ldap.crt
10+
olcTLSCertificateFile: /container/service/slapd/assets/ssl/ldap.crt
1111
-
1212
replace: olcTLSCertificateKeyFile
13-
olcTLSCertificateKeyFile: /osixia/service/slapd/assets/ssl/ldap.key
13+
olcTLSCertificateKeyFile: /container/service/slapd/assets/ssl/ldap.key
1414
-
1515
replace: olcTLSDHParamFile
16-
olcTLSDHParamFile: /osixia/service/slapd/assets/ssl/dhparam.pem
16+
olcTLSDHParamFile: /container/service/slapd/assets/ssl/dhparam.pem
1717
-
1818
replace: olcTLSVerifyClient
1919
olcTLSVerifyClient: demand

‎image/service/slapd/assets/ssl/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
Add your ssl crt, key and ca crt here
2-
or during docker run mount a data volume with thoses files to /osixia/service/slapd/assets/ssl
2+
or during docker run mount a data volume with thoses files to /container/service/slapd/assets/ssl

‎image/service/slapd/container-start.sh‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ulimit -n 1024
1212
#fix file permissions
1313
chown -R openldap:openldap /var/lib/ldap
1414
chown -R openldap:openldap /etc/ldap
15-
chown -R openldap:openldap /osixia/service/slapd
15+
chown -R openldap:openldap /container/service/slapd
1616

1717
# container first start
1818
if [ ! -e "$FIRST_START_DONE" ]; then
@@ -44,13 +44,13 @@ if [ ! -e "$FIRST_START_DONE" ]; then
4444
local LDAP_KEY=$3
4545

4646
# check certificat and key or create it
47-
/sbin/ssl-helper "/osixia/service/slapd/assets/ssl/$LDAP_CRT" "/osixia/service/slapd/assets/ssl/$LDAP_KEY" --ca-crt=/osixia/service/slapd/assets/ssl/$CA_CRT --gnutls
47+
/sbin/ssl-helper "/container/service/slapd/assets/ssl/$LDAP_CRT" "/container/service/slapd/assets/ssl/$LDAP_KEY" --ca-crt=/container/service/slapd/assets/ssl/$CA_CRT --gnutls
4848

4949
# create DHParamFile if not found
50-
[ -f /osixia/service/slapd/assets/ssl/dhparam.pem ] || openssl dhparam -out /osixia/service/slapd/assets/ssl/dhparam.pem 2048
50+
[ -f /container/service/slapd/assets/ssl/dhparam.pem ] || openssl dhparam -out /container/service/slapd/assets/ssl/dhparam.pem 2048
5151

5252
# fix file permissions
53-
chown -R openldap:openldap /osixia/service/slapd
53+
chown -R openldap:openldap /container/service/slapd
5454
}
5555

5656

@@ -114,13 +114,13 @@ EOF
114114

115115
# convert schemas to ldif
116116
SCHEMAS=""
117-
for f in $(find /osixia/service/slapd/assets/config/bootstrap/schema -name \*.schema -type f); do
117+
for f in $(find /container/service/slapd/assets/config/bootstrap/schema -name \*.schema -type f); do
118118
SCHEMAS="$SCHEMAS ${f}"
119119
done
120-
/osixia/service/slapd/assets/schema-to-ldif.sh "$SCHEMAS"
120+
/container/service/slapd/assets/schema-to-ldif.sh "$SCHEMAS"
121121

122122
# add schemas
123-
for f in $(find /osixia/service/slapd/assets/config/bootstrap/schema -name \*.ldif -type f); do
123+
for f in $(find /container/service/slapd/assets/config/bootstrap/schema -name \*.ldif -type f); do
124124
echo "Processing file ${f}"
125125
# add schema if not already exists
126126
SCHEMA=$(basename "${f}" .ldif)
@@ -135,14 +135,14 @@ EOF
135135

136136
# set config password
137137
CONFIG_PASSWORD_ENCRYPTED=$(slappasswd -s $LDAP_CONFIG_PASSWORD)
138-
sed -i "s|{{ CONFIG_PASSWORD_ENCRYPTED }}|$CONFIG_PASSWORD_ENCRYPTED|g" /osixia/service/slapd/assets/config/bootstrap/ldif/01-config-password.ldif
138+
sed -i "s|{{ CONFIG_PASSWORD_ENCRYPTED }}|$CONFIG_PASSWORD_ENCRYPTED|g" /container/service/slapd/assets/config/bootstrap/ldif/01-config-password.ldif
139139

140140
# adapt security config file
141141
get_base_dn
142-
sed -i "s|dc=example,dc=org|$BASE_DN|g" /osixia/service/slapd/assets/config/bootstrap/ldif/02-security.ldif
142+
sed -i "s|dc=example,dc=org|$BASE_DN|g" /container/service/slapd/assets/config/bootstrap/ldif/02-security.ldif
143143

144144
# process config files
145-
for f in $(find /osixia/service/slapd/assets/config/bootstrap/ldif -name \*.ldif -type f | sort); do
145+
for f in $(find /container/service/slapd/assets/config/bootstrap/ldif -name \*.ldif -type f | sort); do
146146
echo "Processing file ${f}"
147147
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $f
148148
done
@@ -157,11 +157,11 @@ EOF
157157
check_tls_files $SSL_CA_CRT_FILENAME $SSL_CRT_FILENAME $SSL_KEY_FILENAME
158158

159159
# adapt tls ldif
160-
sed -i "s,/osixia/service/slapd/assets/ssl/ca.crt,/osixia/service/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /osixia/service/slapd/assets/config/tls/tls-enable.ldif
161-
sed -i "s,/osixia/service/slapd/assets/ssl/ldap.crt,/osixia/service/slapd/assets/ssl/${SSL_CRT_FILENAME},g" /osixia/service/slapd/assets/config/tls/tls-enable.ldif
162-
sed -i "s,/osixia/service/slapd/assets/ssl/ldap.key,/osixia/service/slapd/assets/ssl/${SSL_KEY_FILENAME},g" /osixia/service/slapd/assets/config/tls/tls-enable.ldif
160+
sed -i "s,/container/service/slapd/assets/ssl/ca.crt,/container/service/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
161+
sed -i "s,/container/service/slapd/assets/ssl/ldap.crt,/container/service/slapd/assets/ssl/${SSL_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
162+
sed -i "s,/container/service/slapd/assets/ssl/ldap.key,/container/service/slapd/assets/ssl/${SSL_KEY_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
163163

164-
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f /osixia/service/slapd/assets/config/tls/tls-enable.ldif
164+
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/tls/tls-enable.ldif
165165

166166
[[ -f "$WAS_STARTED_WITH_TLS" ]] && rm -f "$WAS_STARTED_WITH_TLS"
167167
touch $WAS_STARTED_WITH_TLS
@@ -171,20 +171,20 @@ EOF
171171
chmod +x $WAS_STARTED_WITH_TLS
172172

173173
# ldap client config
174-
sed -i "s,TLS_CACERT.*,TLS_CACERT /osixia/service/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /etc/ldap/ldap.conf
174+
sed -i "s,TLS_CACERT.*,TLS_CACERT /container/service/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /etc/ldap/ldap.conf
175175
echo "TLS_REQCERT demand" >> /etc/ldap/ldap.conf
176176

177177
[[ -f "$HOME/.ldaprc" ]] && rm -f $HOME/.ldaprc
178178
touch $HOME/.ldaprc
179-
echo "TLS_CERT /osixia/service/slapd/assets/ssl/${SSL_CRT_FILENAME}" >> $HOME/.ldaprc
180-
echo "TLS_KEY /osixia/service/slapd/assets/ssl/${SSL_KEY_FILENAME}" >> $HOME/.ldaprc
179+
echo "TLS_CERT /container/service/slapd/assets/ssl/${SSL_CRT_FILENAME}" >> $HOME/.ldaprc
180+
echo "TLS_KEY /container/service/slapd/assets/ssl/${SSL_KEY_FILENAME}" >> $HOME/.ldaprc
181181

182182
else
183183

184184
echo "Don't use TLS"
185185

186186
[[ -f "$WAS_STARTED_WITH_TLS" ]] && rm -f "$WAS_STARTED_WITH_TLS"
187-
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/service/slapd/assets/config/tls/tls-disable.ldif || true
187+
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/tls/tls-disable.ldif || true
188188

189189
fi
190190

@@ -205,31 +205,31 @@ EOF
205205
#host var contain a variable name, we access to the variable value
206206
host=${!host}
207207

208-
sed -i "s|{{ REPLICATION_HOSTS }}|olcServerID: $i ${host}\n{{ REPLICATION_HOSTS }}|g" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
209-
sed -i "s|{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|olcSyncRepl: rid=00$i provider=${host} ${REPLICATION_CONFIG_SYNCPROV}\n{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
210-
sed -i "s|{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|olcSyncRepl: rid=10$i provider=${host} ${REPLICATION_HDB_SYNCPROV}\n{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
208+
sed -i "s|{{ REPLICATION_HOSTS }}|olcServerID: $i ${host}\n{{ REPLICATION_HOSTS }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
209+
sed -i "s|{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|olcSyncRepl: rid=00$i provider=${host} ${REPLICATION_CONFIG_SYNCPROV}\n{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
210+
sed -i "s|{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|olcSyncRepl: rid=10$i provider=${host} ${REPLICATION_HDB_SYNCPROV}\n{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
211211

212212
((i++))
213213
done
214214

215215
get_base_dn
216-
sed -i "s|\$BASE_DN|$BASE_DN|g" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
217-
sed -i "s|\$LDAP_ADMIN_PASSWORD|$LDAP_ADMIN_PASSWORD|g" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
218-
sed -i "s|\$LDAP_CONFIG_PASSWORD|$LDAP_CONFIG_PASSWORD|g" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
216+
sed -i "s|\$BASE_DN|$BASE_DN|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
217+
sed -i "s|\$LDAP_ADMIN_PASSWORD|$LDAP_ADMIN_PASSWORD|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
218+
sed -i "s|\$LDAP_CONFIG_PASSWORD|$LDAP_CONFIG_PASSWORD|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
219219

220-
sed -i "/{{ REPLICATION_HOSTS }}/d" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
221-
sed -i "/{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}/d" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
222-
sed -i "/{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}/d" /osixia/service/slapd/assets/config/replication/replication-enable.ldif
220+
sed -i "/{{ REPLICATION_HOSTS }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
221+
sed -i "/{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
222+
sed -i "/{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}/d" /container/service/slapd/assets/config/replication/replication-enable.ldif
223223

224-
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/service/slapd/assets/config/replication/replication-enable.ldif
224+
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/replication/replication-enable.ldif
225225
touch $WAS_STARTED_WITH_REPLICATION
226226
fi
227227

228228
else
229229

230230
echo "Don't use replication"
231231
[[ -f "$WAS_STARTED_WITH_REPLICATION" ]] && rm -f "$WAS_STARTED_WITH_REPLICATION"
232-
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/service/slapd/assets/config/replication/replication-disable.ldif || true
232+
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/replication/replication-disable.ldif || true
233233

234234
rm -f $WAS_STARTED_WITH_REPLICATION
235235

‎image/service/slapd/install.sh‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎test/test.bats‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ load test_helper
3232

3333
@test "ldapsearch new database with strict TLS and custom ca/crt" {
3434

35-
run_image -h ldap.osixia.net -v $BATS_TEST_DIRNAME/ssl:/osixia/service/slapd/assets/ssl -e SSL_CRT_FILENAME=ldap-test.crt -e SSL_KEY_FILENAME=ldap-test.key -e SSL_CA_CRT_FILENAME=ca-test.crt
35+
run_image -h ldap.osixia.net -v $BATS_TEST_DIRNAME/ssl:/container/service/slapd/assets/ssl -e SSL_CRT_FILENAME=ldap-test.crt -e SSL_KEY_FILENAME=ldap-test.key -e SSL_CA_CRT_FILENAME=ca-test.crt
3636
wait_service slapd
3737
run docker exec $CONTAINER_ID ldapsearch -x -h ldap.osixia.net -b dc=example,dc=org -ZZ -D "cn=admin,dc=example,dc=org" -w admin
3838
clear_container
@@ -79,7 +79,7 @@ load test_helper
7979
wait_service_by_cid $LDAP_REPL_CID slapd
8080

8181
# add user on ldap2.example.org
82-
docker exec $LDAP_REPL_CID ldapadd -x -D "cn=admin,dc=example,dc=org" -w admin -f /osixia/service/slapd/assets/test/new-user.ldif -h ldap2.example.org -ZZ
82+
docker exec $LDAP_REPL_CID ldapadd -x -D "cn=admin,dc=example,dc=org" -w admin -f /container/service/slapd/assets/test/new-user.ldif -h ldap2.example.org -ZZ
8383

8484
sleep 5
8585

0 commit comments

Comments
 (0)