d

group_vars/git.yml

@@ -137,6 +137,8 @@ gitea_fail2ban_jail_action: "iptables-allports"
 
 ### mgrote_gitea_setup
 gitea_ldap_host: "ldap.mgrote.net"
-gitea_ldap_bind_pass: "{{ lookup('keepass', 'lldap_ldap_user_pass', 'password') }}"
+gitea_ldap_base_path: "dc=mgrote,dc=net"
+gitea_ldap_bind_user: "forgejo_bind_user"
+gitea_ldap_bind_pass: "{{ lookup('keepass', 'lldap_forgejo_bind_user', 'password') }}"
 gitea_admin_user: "fadmin"
 gitea_admin_user_pass: "{{ lookup('keepass', 'forgejo_admin_user_pass', 'password') }}"

roles/mgrote_gitea_setup/tasks/ldap.yml

@@ -15,10 +15,10 @@
       --security-protocol "unencrypted" \
       --host "{{ gitea_ldap_host }}" \
       --port "3890" \
-      --bind-dn "uid=ladmin,ou=people,dc=mgrote,dc=net" \
+      --bind-dn "uid={{ gitea_ldap_bind_user }},ou=people,{{ gitea_ldap_base_path }}" \
       --bind-password "{{ gitea_ldap_bind_pass }}" \
-      --user-search-base "ou=people,dc=mgrote,dc=net" \
-      --user-filter "(&(memberof=cn=gitea,ou=groups,dc=mgrote,dc=net)(|(uid=%[1]s)(mail=%[1]s)))" \
+      --user-search-base "ou=people,{{ gitea_ldap_base_path }}" \
+      --user-filter "(&(memberof=cn=gitea,ou=groups,{{ gitea_ldap_base_path }})(|(uid=%[1]s)(mail=%[1]s)))" \
       --username-attribute "uid" \
       --email-attribute "mail" \
       --firstname-attribute "givenName" \
@@ -41,10 +41,10 @@
       --security-protocol "unencrypted" \
       --host "{{ gitea_ldap_host }}" \
       --port "3890" \
-      --bind-dn "uid=ladmin,ou=people,dc=mgrote,dc=net" \
+      --bind-dn "uid={{ gitea_ldap_bind_user }},ou=people,{{ gitea_ldap_base_path }}" \
       --bind-password "{{ gitea_ldap_bind_pass }}" \
-      --user-search-base "ou=people,dc=mgrote,dc=net" \
-      --user-filter "(&(memberof=cn=gitea,ou=groups,dc=mgrote,dc=net)(|(uid=%[1]s)(mail=%[1]s)))" \
+      --user-search-base "ou=people,{{ gitea_ldap_base_path }}" \
+      --user-filter "(&(memberof=cn=gitea,ou=groups,{{ gitea_ldap_base_path }})(|(uid=%[1]s)(mail=%[1]s)))" \
       --username-attribute "uid" \
       --email-attribute "mail" \
       --firstname-attribute "givenName" \