This commit is contained in:
Michael Grote 2024-06-05 18:44:57 +02:00
parent f33ba3c932
commit e99d5d98c0
3 changed files with 97 additions and 0 deletions

View file

@ -0,0 +1,34 @@
---
# die Variablen kommen aus
# - https://docs.gitea.com/administration/command-line
# - https://github.com/lldap/lldap/blob/main/example_configs/gitea.md
# und
# den jeweiligen group/host-Vars!
- name: Check if Admin-User exists
no_log: true
become_user: gitea
become: true
ansible.builtin.command: |
forgejo admin user list \
--config "{{ gitea_configuration_path }}/gitea.ini"
register: check
changed_when: false
- name: Ensure Admin-User exists # noqa no-changed-when no-jinja-when
#no_log: true
become_user: gitea
become: true
ansible.builtin.command: |
forgejo admin user create \
--config "{{ gitea_configuration_path }}/gitea.ini" \
--username "{{ gitea_admin_user }}" \
--password "{{ gitea_admin_user_pass }}" \
--email "{{ gitea_admin_user }}@mgrote.net" \
--admin
when: 'not "{{ gitea_admin_user }}@mgrote.net" in check.stdout'
- name: Show existing users
ansible.builtin.debug:
msg: "{{ check.stdout_lines }}"
...

View file

@ -0,0 +1,56 @@
---
# die Variablen kommen aus
# - https://docs.gitea.com/administration/command-line
# - https://github.com/lldap/lldap/blob/main/example_configs/gitea.md
# und
# den jeweiligen group/host-Vars!
- name: Ensure LDAP config is set up
no_log: true
become_user: gitea
become: true
ansible.builtin.command: |
forgejo admin auth add-ldap \
--config "{{ gitea_configuration_path }}/gitea.ini" \
--name "lldap" \
--security-protocol "unencrypted" \
--host "{{ gitea_ldap_host }}" \
--port "3890" \
--bind-dn "uid={{ gitea_ldap_bind_user }},ou=people,{{ gitea_ldap_base_path }}" \
--bind-password "{{ gitea_ldap_bind_pass }}" \
--user-search-base "ou=people,{{ gitea_ldap_base_path }}" \
--user-filter "(&(memberof=cn=gitea,ou=groups,{{ gitea_ldap_base_path }})(|(uid=%[1]s)(mail=%[1]s)))" \
--username-attribute "uid" \
--email-attribute "mail" \
--firstname-attribute "givenName" \
--surname-attribute "sn" \
--avatar-attribute "jpegPhoto" \
--synchronize-users
register: setup
ignore_errors: true
failed_when: 'not "Command error: login source already exists [name: lldap]" in setup.stderr' # fail Task wenn LDAP schon konfiguriert ist
changed_when: "setup.rc == 0" # chnaged nur wenn Task rc 0 hat, sollte nur beim ersten lauf vorkommen; ungetestet
- name: Modify LDAP config
no_log: true
become_user: gitea
become: true
ansible.builtin.command: |
forgejo admin auth update-ldap \
--config "{{ gitea_configuration_path }}/gitea.ini" \
--id "1" \
--security-protocol "unencrypted" \
--host "{{ gitea_ldap_host }}" \
--port "3890" \
--bind-dn "uid={{ gitea_ldap_bind_user }},ou=people,{{ gitea_ldap_base_path }}" \
--bind-password "{{ gitea_ldap_bind_pass }}" \
--user-search-base "ou=people,{{ gitea_ldap_base_path }}" \
--user-filter "(&(memberof=cn=gitea,ou=groups,{{ gitea_ldap_base_path }})(|(uid=%[1]s)(mail=%[1]s)))" \
--username-attribute "uid" \
--email-attribute "mail" \
--firstname-attribute "givenName" \
--surname-attribute "sn" \
--avatar-attribute "jpegPhoto" \
--synchronize-users
when: '"Command error: login source already exists [name: lldap]" in setup.stderr' # führe nur aus wenn erster Task fehlgeschlagen ist
changed_when: false # keine idee wie ich changed feststellen kann
...

View file

@ -0,0 +1,7 @@
---
- name: Include LDAP tasks
ansible.builtin.include_tasks: ldap.yml
- name: Include User tasks
ansible.builtin.include_tasks: admin.yml
...