configure-ldap-secure.yml

---
- name: Configure OpenLDAP with local CA certificate
  hosts: localhost
  connection: local
  become: true

  tasks:
  - name: Loading subject info
    include_vars:
      file: subject-info.yml

  - name: Creating directory
    file:
      path: /etc/ldap/tls
      state: directory

  - name: Copying intermediate and root certificates
    shell:
      cmd: cat /etc/ssl/certs/{{ ansible_domain }}.crt /etc/ssl/certs/{{ ansible_domain }}_CA.crt /etc/ldap/tls/ca-certificates.crt

  - name: Setting ownership on intermediate / root bundle
    file:
      path: /etc/ldap/tls/ca-certificates.crt
      owner: openldap
      group: openldap

  - name: Generating a private key
    openssl_privatekey:
      path: "/etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.key"
      type: RSA
      size: 2048
      owner: openldap
      group: openldap

  - name: Generating a CSR
    openssl_csr:
      path: "/etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.csr"
      privatekey_path: "/etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.key"
      country_name: "{{ country }}"
      state_or_province_name: "{{ state_or_province }}"
      locality_name: "{{ locality }}"
      organization_name: "{{ organization }}"
      email_address: "root@{{ ansible_hostname }}.{{ ansible_domain }}"
      common_name: "ldap.{{ ansible_hostname }}.{{ ansible_domain }}"
      # A subject alternative name is automatically added using common_name
      owner: openldap
      group: openldap

  - name: Signing the certificate
    openssl_certificate:
      path: "/etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.crt"
      csr_path: "/etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.csr"
      ownca_path: "/etc/ssl/certs/{{ ansible_domain }}.crt"
      ownca_privatekey_path: "/etc/ssl/private/{{ ansible_domain }}.key"
      provider: ownca
      owner: openldap
      group: openldap
      
  - name: Creating LDIF file
    copy:
      dest: /etc/ldap/tls/import.ldif
      content: |
        dn: cn=config
        changetype: modify
        replace: olcTLSCACertificateFile
        olcTLSCACertificateFile: /etc/ldap/tls/ca-certificates.crt
        -
        replace: olcTLSCertificateKeyFile
        olcTLSCertificateKeyFile: /etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.key
        -
        replace: olcTLSCertificateFile
        olcTLSCertificateFile: /etc/ldap/tls/ldap.{{ ansible_hostname }}.{{ ansible_domain }}.crt
      owner: openldap
      group: openldap

  - name: Importing TLS configuration
    shell:
      cmd: ldapmodify -Y EXTERNAL -H ldapi:/// -f import.ldif
      chdir: /etc/ldap/tls/