🍽 Fork YunoHost — snapshot mangé par la machine à tsoins
Upstream: https://github.com/YunoHost/yunohost @ 3a5f8bac8301c450897b96cbd43a4c7d3ba750fb But (José) : transformer tout le code en bions + ploxions du xerboxion. La carte de digestion vit au labo : /yunohost-digest.json
This commit is contained in:
machine-a-tsoins
199
hooks/conf_regen/06-slapd
Executable file
199
hooks/conf_regen/06-slapd
Executable file
@@ -0,0 +1,199 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Copyright (c) 2024 YunoHost Contributors
|
||||
#
|
||||
# This file is part of YunoHost (see https://yunohost.org)
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Affero General Public License as
|
||||
# published by the Free Software Foundation, either version 3 of the
|
||||
# License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Affero General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Affero General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
# Exit hook on subcommand error or unset variable
|
||||
set -eu
|
||||
|
||||
tmp_backup_dir_file="/root/slapd-backup-dir.txt"
|
||||
|
||||
config="/usr/share/yunohost/conf/slapd/config.ldif"
|
||||
db_init="/usr/share/yunohost/conf/slapd/db_init.ldif"
|
||||
|
||||
do_init_regen() {
|
||||
|
||||
do_pre_regen ""
|
||||
|
||||
# Drop current existing slapd data
|
||||
|
||||
rm -rf /var/backups/*.ldapdb
|
||||
rm -rf /var/backups/slapd-*
|
||||
|
||||
debconf-set-selections << EOF
|
||||
slapd slapd/password1 password yunohost
|
||||
slapd slapd/password2 password yunohost
|
||||
slapd slapd/domain string yunohost.org
|
||||
slapd shared/organization string yunohost.org
|
||||
slapd slapd/allow_ldap_v2 boolean false
|
||||
slapd slapd/invalid_config boolean true
|
||||
slapd slapd/backend select MDB
|
||||
slapd slapd/move_old_database boolean true
|
||||
slapd slapd/no_configuration boolean false
|
||||
slapd slapd/purge_database boolean false
|
||||
EOF
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive dpkg-reconfigure slapd -u
|
||||
|
||||
# Enforce permissions
|
||||
chown -R openldap:openldap /etc/ldap/schema/
|
||||
usermod -aG ssl-cert openldap
|
||||
|
||||
# (Re-)init data according to default ldap entries
|
||||
echo ' Initializing LDAP with YunoHost DB structure'
|
||||
|
||||
rm -rf /etc/ldap/slapd.d
|
||||
mkdir -p /etc/ldap/slapd.d
|
||||
slapadd -F /etc/ldap/slapd.d -b cn=config -l "$config" 2>&1 \
|
||||
| grep -v "none elapsed\|Closing DB" || true
|
||||
chown -R openldap: /etc/ldap/slapd.d
|
||||
|
||||
rm -rf /var/lib/ldap
|
||||
mkdir -p /var/lib/ldap
|
||||
slapadd -F /etc/ldap/slapd.d -b dc=yunohost,dc=org -l "$db_init" 2>&1 \
|
||||
| grep -v "none elapsed\|Closing DB" || true
|
||||
chown -R openldap: /var/lib/ldap
|
||||
|
||||
nscd -i group || true
|
||||
nscd -i passwd || true
|
||||
|
||||
systemctl restart slapd
|
||||
}
|
||||
|
||||
_regenerate_slapd_conf() {
|
||||
|
||||
# Validate the new slapd config
|
||||
# To do so, we have to use the .ldif to generate the config directory
|
||||
# so we use a temporary directory slapd_new.d
|
||||
rm -Rf /etc/ldap/slapd_new.d
|
||||
mkdir /etc/ldap/slapd_new.d
|
||||
slapadd -b cn=config -l "$config" -F /etc/ldap/slapd_new.d/ 2>&1 \
|
||||
| grep -v "none elapsed\|Closing DB" || true
|
||||
# Actual validation (-Q is for quiet, -u is for dry-run)
|
||||
slaptest -Q -u -F /etc/ldap/slapd_new.d
|
||||
|
||||
# "Commit" / apply the new config (meaning we delete the old one and replace
|
||||
# it with the new one)
|
||||
rm -Rf /etc/ldap/slapd.d
|
||||
mv /etc/ldap/slapd_new.d /etc/ldap/slapd.d
|
||||
|
||||
chown -R openldap:openldap /etc/ldap/slapd.d/
|
||||
}
|
||||
|
||||
do_pre_regen() {
|
||||
pending_dir=$1
|
||||
|
||||
# remove temporary backup file
|
||||
rm -f "$tmp_backup_dir_file"
|
||||
|
||||
# Define if we need to migrate from hdb to mdb
|
||||
if [ -e /etc/ldap/slapd.conf ]; then
|
||||
curr_backend=$(grep '^database' /etc/ldap/slapd.conf 2> /dev/null | awk '{print $2}')
|
||||
if [ "$curr_backend" != 'mdb' ] && [ -n "$curr_backend" ]; then
|
||||
backup_dir="/var/backups/dc=yunohost,dc=org-${curr_backend}-$(date +%s)"
|
||||
mkdir -p "$backup_dir"
|
||||
slapcat -b dc=yunohost,dc=org -l "${backup_dir}/dc=yunohost-dc=org.ldif"
|
||||
echo "$backup_dir" > "$tmp_backup_dir_file"
|
||||
fi
|
||||
fi
|
||||
|
||||
# create needed directories
|
||||
ldap_dir="${pending_dir}/etc/ldap"
|
||||
schema_dir="${ldap_dir}/schema"
|
||||
mkdir -p "$ldap_dir" "$schema_dir"
|
||||
|
||||
cd /usr/share/yunohost/conf/slapd
|
||||
|
||||
# copy configuration files
|
||||
cp -a ldap.conf "$ldap_dir"
|
||||
cp -a sudo.ldif mailserver.ldif permission.ldif "$schema_dir"
|
||||
|
||||
mkdir -p "$pending_dir/etc/systemd/system/slapd.service.d/"
|
||||
cp systemd-override.conf "$pending_dir/etc/systemd/system/slapd.service.d/ynh-override.conf"
|
||||
|
||||
install -D -m 644 slapd.default "${pending_dir}/etc/default/slapd"
|
||||
}
|
||||
|
||||
do_post_regen() {
|
||||
regen_conf_files=$1
|
||||
|
||||
# fix some permissions
|
||||
echo "Enforce permissions on ldap/slapd directories and certs ..."
|
||||
# penldap user should be in the ssl-cert group to let it access the certificate for TLS
|
||||
usermod -aG ssl-cert openldap
|
||||
chown -R openldap:openldap /etc/ldap/schema/
|
||||
chown -R openldap:openldap /etc/ldap/slapd.d/
|
||||
|
||||
# Fix weird scenarios where /etc/sudo-ldap.conf doesn't exists (yet is supposed to be
|
||||
# created by the sudo-ldap package) : https://github.com/YunoHost/issues/issues/2091
|
||||
if [ ! -e /etc/sudo-ldap.conf ]; then
|
||||
ln -s /etc/ldap/ldap.conf /etc/sudo-ldap.conf
|
||||
fi
|
||||
|
||||
# If we changed the systemd ynh-override conf
|
||||
if echo "$regen_conf_files" | sed 's/,/\n/g' | grep -q "^/etc/systemd/system/slapd.service.d/ynh-override.conf$"; then
|
||||
systemctl daemon-reload
|
||||
systemctl restart slapd
|
||||
sleep 3
|
||||
fi
|
||||
|
||||
# For some reason, old setups don't have the admins group defined...
|
||||
if ! slapcat -H "ldap:///cn=admins,ou=groups,dc=yunohost,dc=org" | grep -q 'cn=admins,ou=groups,dc=yunohost,dc=org'; then
|
||||
slapadd -F /etc/ldap/slapd.d -b dc=yunohost,dc=org <<< \
|
||||
"dn: cn=admins,ou=groups,dc=yunohost,dc=org
|
||||
cn: admins
|
||||
gidNumber: 4001
|
||||
memberUid: admin
|
||||
objectClass: posixGroup
|
||||
objectClass: top"
|
||||
chown -R openldap: /var/lib/ldap
|
||||
systemctl restart slapd
|
||||
nscd -i group
|
||||
fi
|
||||
|
||||
if [ -z "$regen_conf_files" ] && [ "$FORCE" == "false" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# regenerate LDAP config directory from slapd.conf
|
||||
echo "Regenerate LDAP config directory from config.ldif"
|
||||
_regenerate_slapd_conf
|
||||
|
||||
# If there's a backup, re-import its data
|
||||
if [ -f "$tmp_backup_dir_file" ]; then
|
||||
backup_dir=$(cat "$tmp_backup_dir_file")
|
||||
if [[ -n "$backup_dir" && -f "${backup_dir}/dc=yunohost-dc=org.ldif" ]]; then
|
||||
# regenerate LDAP config directory and import database as root
|
||||
echo "Import the database using slapadd"
|
||||
slapadd -F /etc/ldap/slapd.d -b dc=yunohost,dc=org -l "${backup_dir}/dc=yunohost-dc=org.ldif"
|
||||
chown -R openldap:openldap /var/lib/ldap 2>&1
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Running slapdindex"
|
||||
su openldap -s "/bin/bash" -c "/usr/sbin/slapindex"
|
||||
|
||||
echo "Reloading slapd"
|
||||
systemctl force-reload slapd
|
||||
}
|
||||
|
||||
if [[ "$1" == _regenerate_slapd_conf ]]; then
|
||||
_regenerate_slapd_conf
|
||||
else
|
||||
"do_$1_regen" "$(echo "${*:2}" | xargs)"
|
||||
fi
|
||||
Reference in New Issue
Block a user