mirror of
https://github.com/vegardit/docker-openldap.git
synced 2026-05-21 12:14:16 +02:00
ci: improve multi-arch builds
This commit is contained in:
sebthom
parent
8b0b6c6e56
commit
63bdfc9d98
210
build-image.sh
210
build-image.sh
|
|
@ -5,40 +5,62 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-openldap
|
||||
|
||||
function curl() {
|
||||
command curl -sSfL --connect-timeout 10 --max-time 30 --retry 3 --retry-all-errors "$@"
|
||||
}
|
||||
|
||||
shared_lib="$(dirname "${BASH_SOURCE[0]}")/.shared"
|
||||
[[ -e $shared_lib ]] || curl "https://raw.githubusercontent.com/vegardit/docker-shared/v1/download.sh?_=$(date +%s)" | bash -s v1 "$shared_lib" || exit 1
|
||||
[[ -e $shared_lib ]] || curl -sSfL "https://raw.githubusercontent.com/vegardit/docker-shared/v1/download.sh?_=$(date +%s)" | bash -s v1 "$shared_lib" || exit 1
|
||||
# shellcheck disable=SC1091 # Not following: $shared_lib/lib/build-image-init.sh was not specified as input
|
||||
source "$shared_lib/lib/build-image-init.sh"
|
||||
|
||||
|
||||
#################################################
|
||||
# specify target repo and image name
|
||||
# declare image meta
|
||||
#################################################
|
||||
image_repo=${DOCKER_IMAGE_REPO:-vegardit/openldap}
|
||||
base_image_name=${DOCKER_BASE_IMAGE:-debian:bookworm-slim}
|
||||
image_name=$image_repo:latest
|
||||
base_image=${DOCKER_BASE_IMAGE:-debian:bookworm-slim}
|
||||
|
||||
platforms="linux/amd64,linux/arm64/v8,linux/arm/v7"
|
||||
|
||||
declare -A image_meta=(
|
||||
[authors]="Vegard IT GmbH (vegardit.com)"
|
||||
[title]="$image_repo"
|
||||
[description]="Opinionated docker image built for easy deployment of an OpenLDAP 2.5 server"
|
||||
[source]="$(git config --get remote.origin.url)"
|
||||
[revision]="$(git rev-parse --short HEAD)"
|
||||
[version]="$(git rev-parse --short HEAD)"
|
||||
[created]="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
|
||||
)
|
||||
|
||||
declare -a tags=()
|
||||
tags+=("latest")
|
||||
|
||||
|
||||
#################################################
|
||||
# build the image
|
||||
# decide if multi-arch build
|
||||
#################################################
|
||||
log INFO "Building docker image [$image_name]..."
|
||||
if [[ $OSTYPE == "cygwin" || $OSTYPE == "msys" ]]; then
|
||||
project_root=$(cygpath -w "$project_root")
|
||||
if [[ ${DOCKER_PUSH:-} == "true" || ${DOCKER_PUSH_GHCR:-} == "true" ]]; then
|
||||
build_multi_arch="true"
|
||||
fi
|
||||
|
||||
set -x
|
||||
|
||||
docker --version
|
||||
#################################################
|
||||
# prepare docker
|
||||
#################################################
|
||||
run_step -- docker version
|
||||
|
||||
# https://github.com/docker/buildx/#building-multi-platform-images
|
||||
run_step -- docker buildx version # ensures buildx is enabled
|
||||
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=1 # prevents "docker: 'buildx' is not a docker command."
|
||||
export DOCKER_CLI_EXPERIMENTAL=1 # prevents "docker: 'buildx' is not a docker command." in older Docker versions
|
||||
|
||||
# Register QEMU emulators for all architectures so Docker can run and build multi-arch images
|
||||
docker run --privileged --rm ghcr.io/dockerhub-mirror/tonistiigi__binfmt --install all
|
||||
if [[ ${build_multi_arch:-} == "true" ]]; then
|
||||
# Use a temporary local registry to work around Docker/Buildx/BuildKit quirks,
|
||||
# enabling us to build/test multiarch images locally before pushing.
|
||||
run_step -- start_docker_registry LOCAL_REGISTRY
|
||||
|
||||
# Register QEMU emulators so Docker can run and build multi-arch images
|
||||
run_step "Install QEMU emulators" -- \
|
||||
docker run --privileged --rm ghcr.io/dockerhub-mirror/tonistiigi__binfmt --install all
|
||||
fi
|
||||
|
||||
# https://docs.docker.com/build/buildkit/configure/#resource-limiting
|
||||
echo "
|
||||
|
|
@ -46,81 +68,119 @@ echo "
|
|||
max-parallelism = 3
|
||||
" | sudo tee /etc/buildkitd.toml
|
||||
|
||||
docker buildx version # ensures buildx is enabled
|
||||
docker buildx create --config /etc/buildkitd.toml --use # prevents: error: multiple platforms feature is currently not supported for docker driver. Please switch to a different driver (eg. "docker buildx create --use")
|
||||
trap 'docker buildx stop' EXIT
|
||||
# shellcheck disable=SC2154,SC2046 # base_layer_cache_key is referenced but not assigned / Quote this to prevent word splitting
|
||||
docker buildx build "$project_root" \
|
||||
--file "image/Dockerfile" \
|
||||
--progress=plain \
|
||||
--pull \
|
||||
--build-arg INSTALL_SUPPORT_TOOLS="${INSTALL_SUPPORT_TOOLS:-0}" \
|
||||
`# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day` \
|
||||
--build-arg BASE_LAYER_CACHE_KEY="$base_layer_cache_key" \
|
||||
--build-arg BASE_IMAGE="$base_image_name" \
|
||||
--build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
|
||||
--build-arg GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}" \
|
||||
--build-arg GIT_COMMIT_DATE="$(date -d "@$(git log -1 --format='%at')" --utc +'%Y-%m-%d %H:%M:%S UTC')" \
|
||||
--build-arg GIT_COMMIT_HASH="$(git rev-parse --short HEAD)" \
|
||||
--build-arg GIT_REPO_URL="$(git config --get remote.origin.url)" \
|
||||
$(if [[ ${ACT:-} == "true" || ${DOCKER_PUSH:-} != "true" ]]; then \
|
||||
echo -n "--load --output type=docker"; \
|
||||
else \
|
||||
echo -n "--platform linux/amd64,linux/arm64,linux/arm/v7"; \
|
||||
fi) \
|
||||
--tag "$image_name" \
|
||||
$(if [[ ${DOCKER_PUSH:-} == "true" ]]; then echo -n "--push"; fi) \
|
||||
"$@"
|
||||
set +x
|
||||
builder_name="bx-$(date +%s)-$RANDOM"
|
||||
run_step "Configure buildx builder" -- docker buildx create \
|
||||
--name "$builder_name" \
|
||||
--bootstrap \
|
||||
--config /etc/buildkitd.toml \
|
||||
--driver-opt network=host `# required for buildx to access the temporary registry` \
|
||||
--driver docker-container \
|
||||
--driver-opt image=ghcr.io/dockerhub-mirror/moby__buildkit:latest
|
||||
trap 'docker buildx rm --force "$builder_name"' EXIT
|
||||
|
||||
if [[ ${DOCKER_PUSH:-} == "true" ]]; then
|
||||
docker image pull "$image_name"
|
||||
|
||||
#################################################
|
||||
# build the image
|
||||
#################################################
|
||||
image_name=image_repo:${tags[0]}
|
||||
|
||||
build_opts=(
|
||||
--file "image/Dockerfile"
|
||||
--builder "$builder_name"
|
||||
--progress=plain
|
||||
--pull
|
||||
# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day
|
||||
--build-arg BASE_LAYER_CACHE_KEY="$base_layer_cache_key"
|
||||
--build-arg BASE_IMAGE="$base_image"
|
||||
--build-arg GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}"
|
||||
--build-arg GIT_COMMIT_DATE="$(date -d "@$(git log -1 --format='%at')" --utc +'%Y-%m-%d %H:%M:%S UTC')"
|
||||
--build-arg INSTALL_SUPPORT_TOOLS="${INSTALL_SUPPORT_TOOLS:-0}"
|
||||
)
|
||||
|
||||
for key in "${!image_meta[@]}"; do
|
||||
build_opts+=(--build-arg "OCI_${key}=${image_meta[$key]}")
|
||||
if [[ ${build_multi_arch:-} == "true" ]]; then
|
||||
build_opts+=(--annotation "index:org.opencontainers.image.${key}=${image_meta[$key]}")
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ ${build_multi_arch:-} == "true" ]]; then
|
||||
build_opts+=(--push)
|
||||
build_opts+=(--sbom=true) # https://docs.docker.com/build/metadata/attestations/sbom/#create-sbom-attestations
|
||||
build_opts+=(--platform "$platforms")
|
||||
build_opts+=(--tag "$LOCAL_REGISTRY/$image_name")
|
||||
else
|
||||
build_opts+=(--output "type=docker,load=true")
|
||||
build_opts+=(--tag "$image_name")
|
||||
fi
|
||||
|
||||
#################################################
|
||||
# determine effective OpenLDAP version
|
||||
#################################################
|
||||
# LC_ALL=en_US.utf8 -> workaround for "grep: -P supports only unibyte and UTF-8 locales"
|
||||
ldap_version=$(docker run --rm "$image_name" dpkg -s slapd | LC_ALL=en_US.utf8 grep -oP 'Version: \K\d+\.\d+\.\d+')
|
||||
echo "ldap_version=$ldap_version"
|
||||
if [[ $OSTYPE == "cygwin" || $OSTYPE == "msys" ]]; then
|
||||
project_root=$(cygpath -w "$project_root")
|
||||
fi
|
||||
|
||||
run_step "Building docker image [$image_name]..." -- \
|
||||
docker buildx build "${build_opts[@]}" "$project_root"
|
||||
|
||||
|
||||
#################################################
|
||||
# apply tags
|
||||
# load image into local docker daemon for testing
|
||||
#################################################
|
||||
declare -a tags=()
|
||||
tags+=("$image_repo:${ldap_version}") # :2.5.12
|
||||
tags+=("$image_repo:${ldap_version%.*}.x") # :2.5.x
|
||||
tags+=("$image_repo:${ldap_version%%.*}.x") # :2.x
|
||||
|
||||
for tag in "${tags[@]}"; do
|
||||
(set -x; docker image tag "$image_name" "$tag")
|
||||
if [[ ${DOCKER_PUSH:-} == "true" ]]; then
|
||||
(set -x; docker push "$tag")
|
||||
fi
|
||||
done
|
||||
tags+=("$image_name") # :latest
|
||||
if [[ ${build_multi_arch:-} == "true" ]]; then
|
||||
run_step "Load image into local daemon for testing" @@ "
|
||||
docker pull '$LOCAL_REGISTRY/$image_name';
|
||||
docker tag '$LOCAL_REGISTRY/$image_name' '$image_name'
|
||||
"
|
||||
fi
|
||||
|
||||
|
||||
#################################################
|
||||
# perform security audit
|
||||
#################################################
|
||||
if [[ ${DOCKER_AUDIT_IMAGE:-1} == "1" ]]; then
|
||||
bash "$shared_lib/cmd/audit-image.sh" "$image_name"
|
||||
run_step "Auditing docker image [$image_name]" -- \
|
||||
bash "$shared_lib/cmd/audit-image.sh" "$image_name"
|
||||
fi
|
||||
|
||||
|
||||
#################################################
|
||||
# push image to ghcr.io
|
||||
# determine effective OpenLDAP version
|
||||
#################################################
|
||||
echo
|
||||
log INFO "Determining effective OpenLDAP version of [$image_name]..."
|
||||
# LC_ALL=en_US.utf8 -> workaround for "grep: -P supports only unibyte and UTF-8 locales"
|
||||
ldap_version=$(docker run --rm "$image_name" dpkg -s slapd | LC_ALL=en_US.utf8 grep -oP 'Version: \K\d+\.\d+\.\d+')
|
||||
echo "ldap_version=$ldap_version"
|
||||
|
||||
|
||||
#################################################
|
||||
# extend tags
|
||||
#################################################
|
||||
tags+=("${ldap_version}") # :2.5.12
|
||||
tags+=("${ldap_version%.*}.x") # :2.5.x
|
||||
tags+=("${ldap_version%%.*}.x") # :2.x
|
||||
|
||||
|
||||
#################################################
|
||||
# push image
|
||||
#################################################
|
||||
function regctl() {
|
||||
run_step "regctl ${*}" -- \
|
||||
docker run --rm \
|
||||
-u "$(id -u):$(id -g)" -e HOME -v "$HOME:$HOME" \
|
||||
-v /etc/docker/certs.d:/etc/docker/certs.d:ro \
|
||||
--network host `# required to access the temporary registry` \
|
||||
ghcr.io/regclient/regctl:latest \
|
||||
--host "reg=$LOCAL_REGISTRY,tls=disabled" \
|
||||
"${@}"
|
||||
}
|
||||
|
||||
if [[ ${DOCKER_PUSH:-} == "true" ]]; then
|
||||
for tag in "${tags[@]}"; do
|
||||
regctl image copy --referrers "$LOCAL_REGISTRY/$image_name" "docker.io/$image_repo:$tag"
|
||||
done
|
||||
fi
|
||||
if [[ ${DOCKER_PUSH_GHCR:-} == "true" ]]; then
|
||||
for tag in "${tags[@]}"; do
|
||||
set -x
|
||||
docker run --rm \
|
||||
-u "$(id -u):$(id -g)" -e HOME -v "$HOME:$HOME" \
|
||||
-v /etc/docker/certs.d:/etc/docker/certs.d:ro \
|
||||
ghcr.io/regclient/regctl:latest \
|
||||
image copy "$tag" "ghcr.io/$tag"
|
||||
set +x
|
||||
done
|
||||
for tag in "${tags[@]}"; do
|
||||
regctl image copy --referrers "$LOCAL_REGISTRY/$image_name" "ghcr.io/$image_repo:$tag"
|
||||
done
|
||||
fi
|
||||
|
|
|
|||
153
image/Dockerfile
153
image/Dockerfile
|
|
@ -10,36 +10,39 @@
|
|||
# https://hub.docker.com/_/debian/tags?name=bookworm-slim
|
||||
ARG BASE_IMAGE=debian:bookworm-slim
|
||||
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
ARG LC_ALL=C
|
||||
#############################################################
|
||||
# build pqchecker
|
||||
#############################################################
|
||||
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3006 Always tag the version of an image explicitly
|
||||
# hadolint ignore=DL3006
|
||||
FROM ${BASE_IMAGE} AS pqchecker-build
|
||||
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
ARG LC_ALL=C
|
||||
|
||||
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
|
||||
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3008 Pin versions
|
||||
# hadolint ignore=DL3008
|
||||
RUN <<EOF
|
||||
set -eux
|
||||
apt-get update
|
||||
apt-get install --no-install-recommends -y \
|
||||
build-essential \
|
||||
ca-certificates \
|
||||
git
|
||||
set -x
|
||||
apt-get update
|
||||
apt-get install --no-install-recommends -y \
|
||||
build-essential \
|
||||
ca-certificates \
|
||||
git
|
||||
|
||||
EOF
|
||||
|
||||
RUN <<EOF
|
||||
git config --global advice.detachedHead false
|
||||
git config --global core.sparseCheckout true
|
||||
git config --global init.defaultBranch main
|
||||
git config --global advice.detachedHead false
|
||||
git config --global core.sparseCheckout true
|
||||
git config --global init.defaultBranch main
|
||||
EOF
|
||||
|
||||
WORKDIR /opt/openldap-src
|
||||
RUN <<EOF
|
||||
git clone --depth 1 --branch OPENLDAP_REL_ENG_2_5 https://github.com/openldap/openldap.git .
|
||||
./configure
|
||||
make depend
|
||||
git clone --depth 1 --branch OPENLDAP_REL_ENG_2_5 https://github.com/openldap/openldap.git .
|
||||
./configure
|
||||
make depend
|
||||
EOF
|
||||
|
||||
WORKDIR /opt/jni-headers
|
||||
|
|
@ -47,82 +50,78 @@ WORKDIR /opt/jni-headers
|
|||
ENV JVM_DIR=/usr/lib/jvm/openjdk11
|
||||
|
||||
RUN <<EOF
|
||||
set -eux
|
||||
set -x
|
||||
|
||||
git clone --depth 1 --filter=blob:none --no-checkout --branch jdk-11-ga https://github.com/openjdk/jdk.git .
|
||||
git sparse-checkout init --cone
|
||||
git sparse-checkout set \
|
||||
src/java.base/share/native/include/jni.h \
|
||||
src/java.base/unix/native/include/jni_md.h
|
||||
git checkout
|
||||
git clone --depth 1 --filter=blob:none --no-checkout --branch jdk-11-ga https://github.com/openjdk/jdk.git .
|
||||
git sparse-checkout init --cone
|
||||
git sparse-checkout set \
|
||||
src/java.base/share/native/include/jni.h \
|
||||
src/java.base/unix/native/include/jni_md.h
|
||||
git checkout
|
||||
|
||||
mkdir -p "$JVM_DIR/include/linux"
|
||||
cp src/java.base/share/native/include/jni.h "$JVM_DIR/include/"
|
||||
cp src/java.base/unix/native/include/jni_md.h "$JVM_DIR/include/linux/"
|
||||
mkdir -p "$JVM_DIR/include/linux"
|
||||
cp src/java.base/share/native/include/jni.h "$JVM_DIR/include/"
|
||||
cp src/java.base/unix/native/include/jni_md.h "$JVM_DIR/include/linux/"
|
||||
EOF
|
||||
|
||||
WORKDIR /opt/pqchecker
|
||||
|
||||
RUN <<EOF
|
||||
set -eu
|
||||
set -eu
|
||||
|
||||
# auto-detect JAVA_HOME from wherever jni.h landed
|
||||
JNI_HDR=$(find /usr/lib/jvm -path '*/include/jni.h' -print -quit)
|
||||
if [ -z "$JNI_HDR" ]; then
|
||||
echo "ERROR: jni.h not found under /usr/lib/jvm – cannot set JAVA_HOME" >&2
|
||||
exit 1
|
||||
fi
|
||||
JAVA_HOME=$(dirname "$(dirname "$JNI_HDR")")
|
||||
echo "Detected JAVA_HOME=$JAVA_HOME"
|
||||
export JAVA_HOME
|
||||
# auto-detect JAVA_HOME from wherever jni.h landed
|
||||
JNI_HDR=$(find /usr/lib/jvm -path '*/include/jni.h' -print -quit)
|
||||
if [[ -z $JNI_HDR ]]; then
|
||||
echo "ERROR: jni.h not found under /usr/lib/jvm – cannot set JAVA_HOME" >&2
|
||||
exit 1
|
||||
fi
|
||||
JAVA_HOME=$(dirname "$(dirname "$JNI_HDR")")
|
||||
echo "Detected JAVA_HOME=$JAVA_HOME"
|
||||
export JAVA_HOME
|
||||
|
||||
set -x
|
||||
git init .
|
||||
# git remote add origin https://bitbucket.org/ameddeb/pqchecker.git
|
||||
git remote add origin https://github.com/pqchecker/pqchecker.git
|
||||
git fetch --depth 1 origin 2813c1922c4233d72066201d11b6b4ad4f61239d
|
||||
git checkout FETCH_HEAD
|
||||
set -x
|
||||
git init .
|
||||
# git remote add origin https://bitbucket.org/ameddeb/pqchecker.git
|
||||
git remote add origin https://github.com/pqchecker/pqchecker.git
|
||||
git fetch --depth 1 origin 2813c1922c4233d72066201d11b6b4ad4f61239d
|
||||
git checkout FETCH_HEAD
|
||||
|
||||
bash ./adjustdate.bash
|
||||
./configure \
|
||||
bash ./adjustdate.bash
|
||||
./configure \
|
||||
LDAPSRC=/opt/openldap-src \
|
||||
JAVAHOME="$JAVA_HOME" \
|
||||
libdir=/usr/lib/ldap \
|
||||
PARAMDIR=/etc/ldap/pqchecker
|
||||
make
|
||||
make
|
||||
|
||||
EOF
|
||||
|
||||
|
||||
#############################################################
|
||||
# build final image
|
||||
#############################################################
|
||||
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3006 Always tag the version of an image explicitly
|
||||
# hadolint ignore=DL3006
|
||||
FROM ${BASE_IMAGE} as final
|
||||
|
||||
LABEL maintainer="Vegard IT GmbH (vegardit.com)"
|
||||
|
||||
# see https://github.com/hadolint/hadolint/wiki/DL3002
|
||||
# hadolint ignore=DL3002
|
||||
USER root
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
ARG LC_ALL=C
|
||||
|
||||
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
|
||||
|
||||
ARG INSTALL_SUPPORT_TOOLS=0
|
||||
|
||||
ARG BASE_LAYER_CACHE_KEY
|
||||
|
||||
COPY --from=pqchecker-build /opt/pqchecker/src/.libs/pqchecker.so /usr/lib/ldap/pqchecker.so
|
||||
COPY --from=pqchecker-build /opt/pqchecker/pqparams.dat /etc/ldap/pqchecker/pqparams.dat
|
||||
|
||||
# see https://github.com/hadolint/hadolint/wiki/DL3008
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3008 Pin versions
|
||||
# hadolint ignore=DL3008,SC2016
|
||||
RUN --mount=type=bind,source=.shared,target=/mnt/shared <<EOF
|
||||
|
||||
/mnt/shared/cmd/debian-install-os-updates.sh
|
||||
/mnt/shared/cmd/debian-install-support-tools.sh
|
||||
|
||||
function curl() {
|
||||
command curl -sSfL --connect-timeout 10 --max-time 30 --retry 3 --retry-all-errors "$@"
|
||||
}
|
||||
|
||||
echo "#################################################"
|
||||
echo "Installing tini..."
|
||||
echo "#################################################"
|
||||
|
|
@ -150,17 +149,27 @@ RUN --mount=type=bind,source=.shared,target=/mnt/shared <<EOF
|
|||
|
||||
EOF
|
||||
|
||||
ARG BUILD_DATE
|
||||
ARG GIT_BRANCH
|
||||
ARG GIT_COMMIT_HASH
|
||||
ARG GIT_COMMIT_DATE
|
||||
ARG GIT_REPO_URL
|
||||
ARG OCI_authors
|
||||
ARG OCI_title
|
||||
ARG OCI_description
|
||||
ARG OCI_source
|
||||
ARG OCI_revision
|
||||
ARG OCI_version
|
||||
ARG OCI_created
|
||||
|
||||
ARG GIT_BRANCH
|
||||
ARG GIT_COMMIT_DATE
|
||||
|
||||
# https://github.com/opencontainers/image-spec/blob/main/annotations.md
|
||||
LABEL \
|
||||
org.label-schema.schema-version="1.0" \
|
||||
org.label-schema.build-date=$BUILD_DATE \
|
||||
org.label-schema.vcs-ref=$GIT_COMMIT_HASH \
|
||||
org.label-schema.vcs-url=$GIT_REPO_URL
|
||||
org.opencontainers.image.title="$OCI_title" \
|
||||
org.opencontainers.image.description="$OCI_description" \
|
||||
org.opencontainers.image.source="$OCI_source" \
|
||||
org.opencontainers.image.revision="$OCI_revision" \
|
||||
org.opencontainers.image.version="$OCI_version" \
|
||||
org.opencontainers.image.created="$OCI_created"
|
||||
|
||||
LABEL maintainer="$OCI_authors"
|
||||
|
||||
# Default configuration: can be overridden at the docker command line
|
||||
# see https://github.com/hadolint/hadolint/wiki/DL3044
|
||||
|
|
@ -198,15 +207,15 @@ ENV \
|
|||
LDAP_TLS_VERIFY_CLIENT='try'
|
||||
|
||||
RUN <<EOF
|
||||
|
||||
echo "#################################################"
|
||||
echo "Writing build_info..."
|
||||
echo "#################################################"
|
||||
echo "
|
||||
GIT_REPO: $GIT_REPO_URL
|
||||
cat <<EOT >/opt/build_info
|
||||
GIT_REPO: $OCI_source
|
||||
GIT_BRANCH: $GIT_BRANCH
|
||||
GIT_COMMIT: $GIT_COMMIT_HASH @ $GIT_COMMIT_DATE
|
||||
IMAGE_BUILD: $BUILD_DATE" >/opt/build_info
|
||||
GIT_COMMIT: $OCI_revision @ $GIT_COMMIT_DATE
|
||||
IMAGE_BUILD: $OCI_created
|
||||
EOT
|
||||
cat /opt/build_info
|
||||
|
||||
EOF
|
||||
|
|
|
|||
415
image/run.sh
415
image/run.sh
|
|
@ -31,10 +31,10 @@ log INFO "Timezone is $(date +"%Z %z")"
|
|||
# load custom init script if specified
|
||||
#################################################
|
||||
if [[ -f ${INIT_SH_FILE:-} ]]; then
|
||||
log INFO "Loading [$INIT_SH_FILE]..."
|
||||
log INFO "Loading [$INIT_SH_FILE]..."
|
||||
|
||||
# shellcheck disable=SC1090 # ShellCheck can't follow non-constant source
|
||||
source "$INIT_SH_FILE"
|
||||
# shellcheck disable=SC1090 # ShellCheck can't follow non-constant source
|
||||
source "$INIT_SH_FILE"
|
||||
fi
|
||||
|
||||
|
||||
|
|
@ -74,153 +74,152 @@ chown -R openldap:openldap /var/run/slapd
|
|||
# Configure LDAP server on initial container launch
|
||||
#################################################################
|
||||
function ldif() {
|
||||
log INFO "---------------------------------------"
|
||||
local action=$1 && shift
|
||||
local file=${!#}
|
||||
log INFO "Executing [ldap$action $file]..."
|
||||
# shellcheck disable=SC2094 # Make sure not to read and write the same file in the same pipeline
|
||||
local tmpfile
|
||||
tmpfile=$(mktemp --suffix=.ldif /tmp/ldif.XXXXXX)
|
||||
interpolate <"$file" >"$tmpfile"
|
||||
"ldap$action" -H ldapi:/// "${@:1:${#}-1}" -f "$tmpfile" 2>&1 | log INFO
|
||||
rm -f "$tmpfile"
|
||||
log INFO "---------------------------------------"
|
||||
local action=$1 && shift
|
||||
local file=${!#}
|
||||
log INFO "Executing [ldap$action $file]..."
|
||||
# shellcheck disable=SC2094 # Make sure not to read and write the same file in the same pipeline
|
||||
local tmpfile
|
||||
tmpfile=$(mktemp --suffix=.ldif /tmp/ldif.XXXXXX)
|
||||
interpolate <"$file" >"$tmpfile"
|
||||
"ldap$action" -H ldapi:/// "${@:1:${#}-1}" -f "$tmpfile" 2>&1 | log INFO
|
||||
rm -f "$tmpfile"
|
||||
}
|
||||
|
||||
if [ ! -e /etc/ldap/slapd.d/initialized ]; then
|
||||
log INFO "======================================="
|
||||
log INFO "Applying initial configuration"
|
||||
log INFO "======================================="
|
||||
function substr_before() {
|
||||
# shellcheck disable=SC2295 # Expansions inside ${..} need to be quoted separately, otherwise they match as patterns
|
||||
echo "${1%%${2}*}"
|
||||
}
|
||||
|
||||
log INFO "======================================="
|
||||
log INFO "Applying initial configuration"
|
||||
log INFO "======================================="
|
||||
function substr_before() {
|
||||
# shellcheck disable=SC2295 # Expansions inside ${..} need to be quoted separately, otherwise they match as patterns
|
||||
echo "${1%%${2}*}"
|
||||
}
|
||||
function str_replace() {
|
||||
IFS= read -r -d $'\0' str
|
||||
echo "${str/$1/$2}"
|
||||
}
|
||||
|
||||
function str_replace() {
|
||||
IFS= read -r -d $'\0' str
|
||||
echo "${str/$1/$2}"
|
||||
}
|
||||
# interpolate variable placeholders in env vars starting with "LDAP_INIT_"
|
||||
for name in ${!LDAP_INIT_*}; do
|
||||
declare "${name}=$(echo "${!name}" | interpolate)"
|
||||
done
|
||||
|
||||
# interpolate variable placeholders in env vars starting with "LDAP_INIT_"
|
||||
for name in ${!LDAP_INIT_*}; do
|
||||
declare "${name}=$(echo "${!name}" | interpolate)"
|
||||
done
|
||||
# pre-populate folders in case they are empty
|
||||
for folder in "/var/lib/ldap" "/etc/ldap/slapd.d"; do
|
||||
if [[ $folder -ef "${folder}_orig" ]]; then
|
||||
continue
|
||||
fi
|
||||
if [[ -z $(ls $folder) ]]; then
|
||||
log INFO "Initializing [$folder]..."
|
||||
cp -r --preserve=all ${folder}_orig/. $folder
|
||||
fi
|
||||
done
|
||||
|
||||
# pre-populate folders in case they are empty
|
||||
for folder in "/var/lib/ldap" "/etc/ldap/slapd.d"; do
|
||||
if [[ $folder -ef "${folder}_orig" ]]; then
|
||||
continue
|
||||
fi
|
||||
if [[ -z $(ls $folder) ]]; then
|
||||
log INFO "Initializing [$folder]..."
|
||||
cp -r --preserve=all ${folder}_orig/. $folder
|
||||
fi
|
||||
done
|
||||
if [[ -z ${LDAP_INIT_ROOT_USER_DN:-} ]]; then
|
||||
log ERROR "LDAP_INIT_ROOT_USER_DN variable is not set!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z ${LDAP_INIT_ROOT_USER_DN:-} ]]; then
|
||||
log ERROR "LDAP_INIT_ROOT_USER_DN variable is not set!"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -z ${LDAP_INIT_ROOT_USER_PW:-} ]]; then
|
||||
log ERROR "LDAP_INIT_ROOT_USER_PW variable is not set!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z ${LDAP_INIT_ROOT_USER_PW:-} ]]; then
|
||||
log ERROR "LDAP_INIT_ROOT_USER_PW variable is not set!"
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck disable=SC2034 # LDAP_INIT_ROOT_USER_PW_HASHED appears unused
|
||||
LDAP_INIT_ROOT_USER_PW_HASHED=$(slappasswd -s "${LDAP_INIT_ROOT_USER_PW}")
|
||||
# LDAP_INIT_ROOT_USER_PW_HASHED is referenced in /opt/ldifs/init_mdb_acls.ldif
|
||||
|
||||
# shellcheck disable=SC2034 # LDAP_INIT_ROOT_USER_PW_HASHED appears unused
|
||||
LDAP_INIT_ROOT_USER_PW_HASHED=$(slappasswd -s "${LDAP_INIT_ROOT_USER_PW}")
|
||||
# LDAP_INIT_ROOT_USER_PW_HASHED is referenced in /opt/ldifs/init_mdb_acls.ldif
|
||||
if [[ ${LDAP_INIT_RFC2307BIS_SCHEMA:-} == 1 ]]; then
|
||||
log INFO "Replacing NIS (RFC2307) schema with RFC2307bis schema..."
|
||||
|
||||
if [[ ${LDAP_INIT_RFC2307BIS_SCHEMA:-} == 1 ]]; then
|
||||
log INFO "Replacing NIS (RFC2307) schema with RFC2307bis schema..."
|
||||
log INFO "Exporting initial slapd config..."
|
||||
initial_sldapd_config=$(slapcat -n0)
|
||||
|
||||
log INFO "Exporting initial slapd config..."
|
||||
initial_sldapd_config=$(slapcat -n0)
|
||||
log INFO "Delete initial slapd config..."
|
||||
find /etc/ldap/slapd.d/ -type f -delete
|
||||
|
||||
log INFO "Delete initial slapd config..."
|
||||
find /etc/ldap/slapd.d/ -type f -delete
|
||||
log INFO "Create modified sldapd config file..."
|
||||
{
|
||||
# create ldif file where "{2}nis,cn=schema,cn=config" schema is replaced by "{2}rfc2307bis,cn=schema,cn=config"
|
||||
# 1. add all schema entries before "dn: cn={2}nis,cn=schema,cn=config" from initial config to new config file
|
||||
echo "${initial_sldapd_config%%dn: cn=\{2\}nis,cn=schema,cn=config*}"
|
||||
# 2. add "dn: cn={2}rfc2307bis,cn=schema,cn=config" entry
|
||||
sed 's/rfc2307bis/{2}rfc2307bis/g' /opt/ldifs/schema_rfc2307bis02.ldif
|
||||
echo # add empty new line
|
||||
# 3. add entry "dn: cn={3}inetorgperson,cn=schema,cn=config" and following entries from initial config to new config file
|
||||
echo "dn: cn={3}inetorgperson,cn=schema,cn=config${initial_sldapd_config#*dn: cn=\{3\}inetorgperson,cn=schema,cn=config}"
|
||||
} >/tmp/config.ldif
|
||||
|
||||
log INFO "Create modified sldapd config file..."
|
||||
{
|
||||
# create ldif file where "{2}nis,cn=schema,cn=config" schema is replaced by "{2}rfc2307bis,cn=schema,cn=config"
|
||||
# 1. add all schema entries before "dn: cn={2}nis,cn=schema,cn=config" from initial config to new config file
|
||||
echo "${initial_sldapd_config%%dn: cn=\{2\}nis,cn=schema,cn=config*}"
|
||||
# 2. add "dn: cn={2}rfc2307bis,cn=schema,cn=config" entry
|
||||
sed 's/rfc2307bis/{2}rfc2307bis/g' /opt/ldifs/schema_rfc2307bis02.ldif
|
||||
echo # add empty new line
|
||||
# 3. add entry "dn: cn={3}inetorgperson,cn=schema,cn=config" and following entries from initial config to new config file
|
||||
echo "dn: cn={3}inetorgperson,cn=schema,cn=config${initial_sldapd_config#*dn: cn=\{3\}inetorgperson,cn=schema,cn=config}"
|
||||
} >/tmp/config.ldif
|
||||
log INFO "Register modified slapd config with RFC2307bis schema..."
|
||||
slapadd -F /etc/ldap/slapd.d -n 0 -l /tmp/config.ldif | log INFO
|
||||
chown openldap:openldap -R /etc/ldap/slapd.d
|
||||
fi
|
||||
|
||||
log INFO "Register modified slapd config with RFC2307bis schema..."
|
||||
slapadd -F /etc/ldap/slapd.d -n 0 -l /tmp/config.ldif | log INFO
|
||||
chown openldap:openldap -R /etc/ldap/slapd.d
|
||||
fi
|
||||
/etc/init.d/slapd start 2>&1 | log INFO
|
||||
# await ldap server start
|
||||
for _ in {1..8}; do
|
||||
if ldapwhoami -H ldapi:/// | log INFO; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
/etc/init.d/slapd start 2>&1 | log INFO
|
||||
# await ldap server start
|
||||
for _ in {1..8}; do
|
||||
if ldapwhoami -H ldapi:/// | log INFO; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
ldif add -Y EXTERNAL /opt/ldifs/schema_sudo.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/schema_ldapPublicKey.ldif
|
||||
|
||||
ldif add -Y EXTERNAL /opt/ldifs/schema_sudo.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/schema_ldapPublicKey.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_frontend.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/init_module_memberof.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_mdb.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_mdb_acls.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_mdb_indexes.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/init_module_unique.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/init_module_ppolicy.ldif
|
||||
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_frontend.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/init_module_memberof.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_mdb.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_mdb_acls.ldif
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_mdb_indexes.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/init_module_unique.ldif
|
||||
ldif add -Y EXTERNAL /opt/ldifs/init_module_ppolicy.ldif
|
||||
if [[ ${LDAP_INIT_ALLOW_CONFIG_ACCESS:-false} == true ]]; then
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_config_admin_access.ldif
|
||||
fi
|
||||
|
||||
if [[ ${LDAP_INIT_ALLOW_CONFIG_ACCESS:-false} == true ]]; then
|
||||
ldif modify -Y EXTERNAL /opt/ldifs/init_config_admin_access.ldif
|
||||
fi
|
||||
|
||||
# calculate LDAP_INIT_ORG_COMPUTED_ATTRS variable, referenced in init_org_tree.ldif
|
||||
if [[ -z ${LDAP_INIT_ORG_ATTR_O:-} ]] && [[ ${LDAP_INIT_ORG_DN:-} =~ [oO]=([^,]*) ]]; then
|
||||
# derive 'o:' from LDAP_INIT_ORG_DN if LDAP_INIT_ORG_ATTR_O is unset and "O=..." is present
|
||||
# e.g. LDAP_INIT_ORG_DN="O=example.com" -> "o: example.com"
|
||||
# e.g. LDAP_INIT_ORG_DN="O=Example,DC=example,DC=com" -> "o: Example"
|
||||
LDAP_INIT_ORG_ATTR_O=${BASH_REMATCH[1]}
|
||||
fi
|
||||
if [[ $LDAP_INIT_ORG_DN =~ [dD][cC]=([^,]*) ]]; then
|
||||
LDAP_INIT_ORG_ATTR_DC=${BASH_REMATCH[1]}
|
||||
# derive 'o:' from LDAP_INIT_ORG_DN if LDAP_INIT_ORG_ATTR_O is unset and "DC=..." is present
|
||||
if [[ -z ${LDAP_INIT_ORG_ATTR_O:-} ]]; then
|
||||
# e.g. LDAP_INIT_ORG_DN="DC=example,DC=com" -> "o: example.com"
|
||||
LDAP_INIT_ORG_ATTR_O=$(echo "$LDAP_INIT_ORG_DN" | grep -ioP 'DC=\K[^,]+' | paste -sd '.')
|
||||
fi
|
||||
# shellcheck disable=SC2034 # LDAP_INIT_ORG_COMPUTED_ATTRS appears unused
|
||||
LDAP_INIT_ORG_COMPUTED_ATTRS="objectClass: dcObject
|
||||
# calculate LDAP_INIT_ORG_COMPUTED_ATTRS variable, referenced in init_org_tree.ldif
|
||||
if [[ -z ${LDAP_INIT_ORG_ATTR_O:-} ]] && [[ ${LDAP_INIT_ORG_DN:-} =~ [oO]=([^,]*) ]]; then
|
||||
# derive 'o:' from LDAP_INIT_ORG_DN if LDAP_INIT_ORG_ATTR_O is unset and "O=..." is present
|
||||
# e.g. LDAP_INIT_ORG_DN="O=example.com" -> "o: example.com"
|
||||
# e.g. LDAP_INIT_ORG_DN="O=Example,DC=example,DC=com" -> "o: Example"
|
||||
LDAP_INIT_ORG_ATTR_O=${BASH_REMATCH[1]}
|
||||
fi
|
||||
if [[ $LDAP_INIT_ORG_DN =~ [dD][cC]=([^,]*) ]]; then
|
||||
LDAP_INIT_ORG_ATTR_DC=${BASH_REMATCH[1]}
|
||||
# derive 'o:' from LDAP_INIT_ORG_DN if LDAP_INIT_ORG_ATTR_O is unset and "DC=..." is present
|
||||
if [[ -z ${LDAP_INIT_ORG_ATTR_O:-} ]]; then
|
||||
# e.g. LDAP_INIT_ORG_DN="DC=example,DC=com" -> "o: example.com"
|
||||
LDAP_INIT_ORG_ATTR_O=$(echo "$LDAP_INIT_ORG_DN" | grep -ioP 'DC=\K[^,]+' | paste -sd '.')
|
||||
fi
|
||||
# shellcheck disable=SC2034 # LDAP_INIT_ORG_COMPUTED_ATTRS appears unused
|
||||
LDAP_INIT_ORG_COMPUTED_ATTRS="objectClass: dcObject
|
||||
o: $LDAP_INIT_ORG_ATTR_O
|
||||
dc: $LDAP_INIT_ORG_ATTR_DC"
|
||||
elif [[ -n ${LDAP_INIT_ORG_ATTR_O:-} ]]; then
|
||||
# shellcheck disable=SC2034 # LDAP_INIT_ORG_COMPUTED_ATTRS appears unused
|
||||
LDAP_INIT_ORG_COMPUTED_ATTRS="o: $LDAP_INIT_ORG_ATTR_O"
|
||||
else
|
||||
log ERROR "Unable to derive required 'o' attribute of objectClass 'organization' from LDAP_INIT_ORG_DN='$LDAP_INIT_ORG_DN'"
|
||||
exit 1
|
||||
fi
|
||||
elif [[ -n ${LDAP_INIT_ORG_ATTR_O:-} ]]; then
|
||||
# shellcheck disable=SC2034 # LDAP_INIT_ORG_COMPUTED_ATTRS appears unused
|
||||
LDAP_INIT_ORG_COMPUTED_ATTRS="o: $LDAP_INIT_ORG_ATTR_O"
|
||||
else
|
||||
log ERROR "Unable to derive required 'o' attribute of objectClass 'organization' from LDAP_INIT_ORG_DN='$LDAP_INIT_ORG_DN'"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_tree.ldif
|
||||
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_ppolicy.ldif
|
||||
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_entries.ldif
|
||||
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_tree.ldif
|
||||
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_ppolicy.ldif
|
||||
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_entries.ldif
|
||||
|
||||
log INFO "---------------------------------------"
|
||||
log INFO "---------------------------------------"
|
||||
|
||||
echo "1" >/etc/ldap/slapd.d/initialized
|
||||
rm -f /tmp/*.ldif
|
||||
echo "1" >/etc/ldap/slapd.d/initialized
|
||||
rm -f /tmp/*.ldif
|
||||
|
||||
log INFO "Creating LDAP backup at [$LDAP_BACKUP_FILE]..."
|
||||
slapcat -n 1 -l "$LDAP_BACKUP_FILE" || true
|
||||
log INFO "Creating LDAP backup at [$LDAP_BACKUP_FILE]..."
|
||||
slapcat -n 1 -l "$LDAP_BACKUP_FILE" || true
|
||||
|
||||
/etc/init.d/slapd stop | log INFO
|
||||
sleep 3
|
||||
/etc/init.d/slapd stop | log INFO
|
||||
sleep 3
|
||||
fi
|
||||
|
||||
echo "$LDAP_PPOLICY_PQCHECKER_RULE" >/etc/ldap/pqchecker/pqparams.dat
|
||||
|
|
@ -231,54 +230,54 @@ echo "$LDAP_PPOLICY_PQCHECKER_RULE" >/etc/ldap/pqchecker/pqparams.dat
|
|||
#################################################################
|
||||
|
||||
case "${LDAP_TLS_ENABLED:-}" in
|
||||
true|false) ;;
|
||||
auto) [[ -f $LDAP_TLS_CERT_FILE && -f $LDAP_TLS_KEY_FILE ]] && LDAP_TLS_ENABLED=true || LDAP_TLS_ENABLED=false ;;
|
||||
*) log ERROR "LDAP_TLS_ENABLED must be auto|true|false"; exit 1 ;;
|
||||
true|false) ;;
|
||||
auto) [[ -f $LDAP_TLS_CERT_FILE && -f $LDAP_TLS_KEY_FILE ]] && LDAP_TLS_ENABLED=true || LDAP_TLS_ENABLED=false ;;
|
||||
*) log ERROR "LDAP_TLS_ENABLED must be auto|true|false"; exit 1 ;;
|
||||
esac
|
||||
|
||||
SLAPD_EXTRA_URLS=""
|
||||
|
||||
if [[ $LDAP_TLS_ENABLED == true ]]; then
|
||||
log INFO "======================================="
|
||||
log INFO "Enabling TLS support..."
|
||||
log INFO "======================================="
|
||||
log INFO "======================================="
|
||||
log INFO "Enabling TLS support..."
|
||||
log INFO "======================================="
|
||||
|
||||
if ! [[ "$LDAP_TLS_SSF" =~ ^[0-9]+$ ]] || (( LDAP_TLS_SSF < 0 || LDAP_TLS_SSF > 256 )); then
|
||||
log ERROR "LDAP_TLS_SSF must be an integer between 0 and 256 (got '$LDAP_TLS_SSF')"
|
||||
exit 1
|
||||
fi
|
||||
if ! [[ "$LDAP_TLS_SSF" =~ ^[0-9]+$ ]] || (( LDAP_TLS_SSF < 0 || LDAP_TLS_SSF > 256 )); then
|
||||
log ERROR "LDAP_TLS_SSF must be an integer between 0 and 256 (got '$LDAP_TLS_SSF')"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case "${LDAP_LDAPS_ENABLED:-}" in
|
||||
true|false) log INFO "LDAPS enabled (port 636): $LDAP_LDAPS_ENABLED";;
|
||||
*) log ERROR "LDAP_LDAPS_ENABLED must be true|false"; exit 1 ;;
|
||||
esac
|
||||
case "${LDAP_LDAPS_ENABLED:-}" in
|
||||
true|false) log INFO "LDAPS enabled (port 636): $LDAP_LDAPS_ENABLED";;
|
||||
*) log ERROR "LDAP_LDAPS_ENABLED must be true|false"; exit 1 ;;
|
||||
esac
|
||||
|
||||
case "${LDAP_TLS_VERIFY_CLIENT:-}" in
|
||||
never|allow|try|demand) log INFO "TLS_VERIFY_CLIENT: $LDAP_TLS_VERIFY_CLIENT";;
|
||||
*) log ERROR "LDAP_LDAPS_ENABLED must be true|false"; exit 1 ;;
|
||||
esac
|
||||
case "${LDAP_TLS_VERIFY_CLIENT:-}" in
|
||||
never|allow|try|demand) log INFO "TLS_VERIFY_CLIENT: $LDAP_TLS_VERIFY_CLIENT";;
|
||||
*) log ERROR "LDAP_LDAPS_ENABLED must be true|false"; exit 1 ;;
|
||||
esac
|
||||
|
||||
|
||||
if [[ ! -f ${LDAP_TLS_KEY_FILE:-} ]]; then
|
||||
log ERROR "TLS requested but LDAP_TLS_KEY_FILE [${LDAP_TLS_KEY_FILE:-}] not accessible"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f ${LDAP_TLS_CERT_FILE:-} ]]; then
|
||||
log ERROR "TLS requested but LDAP_TLS_CERT_FILE [${LDAP_TLS_CERT_FILE:-}] not accessible"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f ${LDAP_TLS_KEY_FILE:-} ]]; then
|
||||
log ERROR "TLS requested but LDAP_TLS_KEY_FILE [${LDAP_TLS_KEY_FILE:-}] not accessible"
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f ${LDAP_TLS_CERT_FILE:-} ]]; then
|
||||
log ERROR "TLS requested but LDAP_TLS_CERT_FILE [${LDAP_TLS_CERT_FILE:-}] not accessible"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
install -d -o openldap -g openldap -m 0755 /etc/ldap/certs
|
||||
install -o openldap -g openldap -m 0600 "$LDAP_TLS_KEY_FILE" /etc/ldap/certs/server.key
|
||||
install -o openldap -g openldap -m 0644 "$LDAP_TLS_CERT_FILE" /etc/ldap/certs/server.crt
|
||||
install -d -o openldap -g openldap -m 0755 /etc/ldap/certs
|
||||
install -o openldap -g openldap -m 0600 "$LDAP_TLS_KEY_FILE" /etc/ldap/certs/server.key
|
||||
install -o openldap -g openldap -m 0644 "$LDAP_TLS_CERT_FILE" /etc/ldap/certs/server.crt
|
||||
|
||||
if [[ -f ${LDAP_TLS_CA_FILE:-} ]]; then
|
||||
install -d -o openldap -g openldap -m 0755 /etc/ldap/certs
|
||||
install -o openldap -g openldap -m 0644 "$LDAP_TLS_CA_FILE" /etc/ldap/certs/ca.crt
|
||||
fi
|
||||
if [[ -f ${LDAP_TLS_CA_FILE:-} ]]; then
|
||||
install -d -o openldap -g openldap -m 0755 /etc/ldap/certs
|
||||
install -o openldap -g openldap -m 0644 "$LDAP_TLS_CA_FILE" /etc/ldap/certs/ca.crt
|
||||
fi
|
||||
|
||||
# configure TLS key material
|
||||
cat >/tmp/tls.ldif <<EOF
|
||||
# configure TLS key material
|
||||
cat >/tmp/tls.ldif <<EOF
|
||||
dn: cn=config
|
||||
changetype: modify
|
||||
replace: olcTLSCertificateFile
|
||||
|
|
@ -287,40 +286,40 @@ olcTLSCertificateFile: /etc/ldap/certs/server.crt
|
|||
replace: olcTLSCertificateKeyFile
|
||||
olcTLSCertificateKeyFile: /etc/ldap/certs/server.key
|
||||
EOF
|
||||
if [[ -f /etc/ldap/certs/ca.crt ]]; then
|
||||
cat >>/tmp/tls.ldif <<EOF
|
||||
if [[ -f /etc/ldap/certs/ca.crt ]]; then
|
||||
cat >>/tmp/tls.ldif <<EOF
|
||||
-
|
||||
replace: olcTLSCACertificateFile
|
||||
olcTLSCACertificateFile: /etc/ldap/certs/ca.crt
|
||||
EOF
|
||||
fi
|
||||
fi
|
||||
|
||||
# client-cert policy
|
||||
cat >>/tmp/tls.ldif <<EOF
|
||||
# client-cert policy
|
||||
cat >>/tmp/tls.ldif <<EOF
|
||||
-
|
||||
replace: olcTLSVerifyClient
|
||||
olcTLSVerifyClient: ${LDAP_TLS_VERIFY_CLIENT:-try}
|
||||
EOF
|
||||
|
||||
# Minimum Security Strength Factor enforcement
|
||||
if [[ $LDAP_TLS_SSF == 0 ]]; then
|
||||
cat >>/tmp/tls.ldif <<EOF
|
||||
# Minimum Security Strength Factor enforcement
|
||||
if [[ $LDAP_TLS_SSF == 0 ]]; then
|
||||
cat >>/tmp/tls.ldif <<EOF
|
||||
-
|
||||
replace: olcSecurity
|
||||
olcSecurity: ssf=$LDAP_TLS_SSF
|
||||
EOF
|
||||
fi
|
||||
|
||||
# ldaps:// listener
|
||||
if [[ $LDAP_LDAPS_ENABLED == true ]]; then
|
||||
SLAPD_EXTRA_URLS=" ldaps:///"
|
||||
fi
|
||||
# ldaps:// listener
|
||||
if [[ $LDAP_LDAPS_ENABLED == true ]]; then
|
||||
SLAPD_EXTRA_URLS=" ldaps:///"
|
||||
fi
|
||||
|
||||
else
|
||||
log INFO "======================================="
|
||||
log INFO "Ensuring TLS support is disabled..."
|
||||
log INFO "======================================="
|
||||
cat >/tmp/tls.ldif <<EOF
|
||||
log INFO "======================================="
|
||||
log INFO "Ensuring TLS support is disabled..."
|
||||
log INFO "======================================="
|
||||
cat >/tmp/tls.ldif <<EOF
|
||||
dn: cn=config
|
||||
changetype: modify
|
||||
delete: olcTLSCertificateFile
|
||||
|
|
@ -340,10 +339,10 @@ fi
|
|||
/etc/init.d/slapd start 2>&1 | log INFO
|
||||
# await ldap server start
|
||||
for _ in {1..8}; do
|
||||
if ldapwhoami -H ldapi:/// | log INFO; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
if ldapwhoami -H ldapi:/// | log INFO; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
ldif modify -Y EXTERNAL /tmp/tls.ldif
|
||||
rm -f /tmp/tls.ldif
|
||||
|
|
@ -356,34 +355,34 @@ sleep 3
|
|||
#################################################################
|
||||
if [[ -n ${LDAP_BACKUP_TIME:-} ]]; then
|
||||
|
||||
if [[ -z ${LDAP_BACKUP_FILE:-} ]]; then
|
||||
log ERROR "LDAP_BACKUP_FILE variable is not set!"
|
||||
exit 1
|
||||
fi
|
||||
if [[ -z ${LDAP_BACKUP_FILE:-} ]]; then
|
||||
log ERROR "LDAP_BACKUP_FILE variable is not set!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log INFO "======================================="
|
||||
log INFO "Configuring LDAP backup task to run daily: time=[${LDAP_BACKUP_TIME}] file=[$LDAP_BACKUP_FILE]..."
|
||||
log INFO "======================================="
|
||||
if [[ ! $LDAP_BACKUP_TIME =~ ^([01][0-9]|2[0-3]):[0-5][0-9]$ ]]; then
|
||||
log ERROR "The configured value [$LDAP_BACKUP_TIME] for LDAP_BACKUP_TIME is not in the expected 24-hour format [hh:mm]!"
|
||||
exit 1
|
||||
fi
|
||||
log INFO "======================================="
|
||||
log INFO "Configuring LDAP backup task to run daily: time=[${LDAP_BACKUP_TIME}] file=[$LDAP_BACKUP_FILE]..."
|
||||
log INFO "======================================="
|
||||
if [[ ! $LDAP_BACKUP_TIME =~ ^([01][0-9]|2[0-3]):[0-5][0-9]$ ]]; then
|
||||
log ERROR "The configured value [$LDAP_BACKUP_TIME] for LDAP_BACKUP_TIME is not in the expected 24-hour format [hh:mm]!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# testing if LDAP_BACKUP_FILE is writeable
|
||||
touch "$LDAP_BACKUP_FILE"
|
||||
# testing if LDAP_BACKUP_FILE is writeable
|
||||
touch "$LDAP_BACKUP_FILE"
|
||||
|
||||
function backup_ldap() {
|
||||
while true; do
|
||||
while [[ ${LDAP_BACKUP_TIME} != "$(date +%H:%M)" ]]; do
|
||||
sleep 10s
|
||||
done
|
||||
log INFO "Creating periodic LDAP backup at [$LDAP_BACKUP_FILE]..."
|
||||
slapcat -n 1 -l "$LDAP_BACKUP_FILE" || true
|
||||
sleep 23h
|
||||
function backup_ldap() {
|
||||
while true; do
|
||||
while [[ ${LDAP_BACKUP_TIME} != "$(date +%H:%M)" ]]; do
|
||||
sleep 10s
|
||||
done
|
||||
}
|
||||
log INFO "Creating periodic LDAP backup at [$LDAP_BACKUP_FILE]..."
|
||||
slapcat -n 1 -l "$LDAP_BACKUP_FILE" || true
|
||||
sleep 23h
|
||||
done
|
||||
}
|
||||
|
||||
backup_ldap &
|
||||
backup_ldap &
|
||||
fi
|
||||
|
||||
|
||||
|
|
@ -397,12 +396,12 @@ log INFO "***************************************"
|
|||
# build an array of “-d <level>” for each level in LDAP_LOG_LEVELS
|
||||
log_opts=()
|
||||
for lvl in ${LDAP_LOG_LEVELS:-}; do
|
||||
log_opts+=("-d" "$lvl")
|
||||
log_opts+=("-d" "$lvl")
|
||||
done
|
||||
|
||||
exec /usr/sbin/slapd \
|
||||
"${log_opts[@]}" \
|
||||
-h "ldap:/// ldapi:///$SLAPD_EXTRA_URLS" \
|
||||
-u openldap \
|
||||
-g openldap \
|
||||
-F /etc/ldap/slapd.d 2>&1 | log INFO
|
||||
"${log_opts[@]}" \
|
||||
-h "ldap:/// ldapi:///$SLAPD_EXTRA_URLS" \
|
||||
-u openldap \
|
||||
-g openldap \
|
||||
-F /etc/ldap/slapd.d 2>&1 | log INFO
|
||||
|
|
|
|||
Loading…
Reference in a new issue