Add LDAP support

4 files changed, 99 insertions, 0 deletions

diff --git a/modules/base_installation/manifests/init.pp b/modules/base_installation/manifests/init.pp
index 65c5178..f9fdcd4 100644
--- a/modules/base_installation/manifests/init.pp
+++ b/modules/base_installation/manifests/init.pp
@@ -1,6 +1,15 @@
 class base_installation (
   Optional[String]        $grub_device      = $base_installation::params::grub_device,
+  Optional[String]        $ldap_base        = $base_installation::params::ldap_base,
+  Optional[String]        $ldap_cert_path   = $base_installation::params::ldap_cert_path,
+  Optional[String]        $ldap_cn          = $base_installation::params::ldap_cn,
+  Optional[String]        $ldap_dn          = $base_installation::params::ldap_dn,
+  Optional[String]        $ldap_server      = $base_installation::params::ldap_server,
+  Optional[String]        $ldap_uri         = $base_installation::params::ldap_uri,
   Optional[String]        $puppet_code_path = $base_installation::params::puppet_code_path,
+  Optional[String]        $puppet_conf_path = $base_installation::params::puppet_conf_path,
+  Optional[String]        $puppet_pass_seed = $base_installation::params::puppet_pass_seed,
+  Optional[String]        $puppet_ssl_path  = $base_installation::params::puppet_ssl_path,
   Optional[String]        $system_hostname  = $base_installation::params::system_hostname,
   Optional[Array[String]] $system_locales   = $base_installation::params::system_locales,
   Optional[String]        $system_timezone  = $base_installation::params::system_timezone,
@@ -15,7 +24,9 @@ class base_installation (
   contain ::base_installation::logs
   contain ::base_installation::cronie
   contain ::base_installation::ssh
+  contain ::base_installation::ldap
   contain ::base_installation::services
   contain ::base_installation::users
   contain ::base_installation::package_managers
+  contain ::base_installation::puppet
 }
diff --git a/modules/base_installation/manifests/ldap.pp b/modules/base_installation/manifests/ldap.pp
new file mode 100644
index 0000000..1825700
--- /dev/null
+++ b/modules/base_installation/manifests/ldap.pp
@@ -0,0 +1,24 @@
+class base_installation::ldap inherits base_installation {
+  ensure_packages(["openldap"])
+
+  File {
+    mode  => "0644",
+    owner => "root",
+    group => "root",
+  }
+
+  file { '/etc/openldap':
+    ensure  => directory,
+    require => Package["openldap"],
+    recurse => true,
+    purge   => true,
+    force   => true,
+  }
+
+  file { '/etc/openldap/ldap.conf':
+    ensure  => present,
+    content => template("base_installation/ldap/ldap.conf.erb"),
+    require => File['/etc/openldap'],
+  }
+
+}
diff --git a/modules/base_installation/manifests/params.pp b/modules/base_installation/manifests/params.pp
index f09f01a..c03eb1e 100644
--- a/modules/base_installation/manifests/params.pp
+++ b/modules/base_installation/manifests/params.pp
@@ -1,6 +1,15 @@
 class base_installation::params {
   $puppet_code_path = "/etc/puppetlabs/code"
+  $puppet_conf_path = "/etc/puppetlabs/puppet"
+  $puppet_pass_seed = "/etc/puppetlabs/puppet/password_seed"
+  $puppet_ssl_path  = "/etc/puppetlabs/ssl"
   $grub_device      = "/dev/sda"
+  $ldap_base        = "dc=example,dc=com"
+  $ldap_cn          = "node"
+  $ldap_dn          = "cn=node,ou=hosts,dc=example,dc=com"
+  $ldap_cert_path   = "/etc/ssl/certs/ca-certificates.crt"
+  $ldap_uri         = "ldaps://ldap.example.com"
+  $ldap_server      = "ldap.example.com"
   $system_hostname  = "example.com"
   $system_locales   = ["en_US.UTF-8"]
   $system_timezone  = "UTC"
diff --git a/modules/base_installation/manifests/puppet.pp b/modules/base_installation/manifests/puppet.pp
new file mode 100644
index 0000000..cd5697a
--- /dev/null
+++ b/modules/base_installation/manifests/puppet.pp
@@ -0,0 +1,55 @@
+class base_installation::puppet (
+  $password_seed = $base_installation::puppet_pass_seed
+) inherits base_installation {
+  File {
+    mode  => "0600",
+    owner => "root",
+    group => "root",
+  }
+
+  exec { 'generate_password_seed':
+    command     => "/usr/bin/openssl rand -base64 -out $password_seed 256",
+    creates     => $password_seed,
+    environment => "RANDFILE=/dev/null",
+  }
+
+  unless empty(find_file($password_seed)) {
+    $ldap_password = generate_password(24, $password_seed, "ldap")
+    $ssha_ldap_seed = generate_password(5, $password_seed, "ldap_seed")
+
+    package { 'gem:ruby-ldap':
+      name            => "ruby-ldap",
+      ensure          => present,
+      provider        => "gem",
+      install_options => "--no-user-install"
+    }
+
+    file { $password_seed:
+      mode => "0600",
+    }
+
+    file { $base_installation::puppet_conf_path:
+      ensure  => directory,
+      require => [Package["puppet"], Package["gem:ruby-ldap"]],
+      recurse => true,
+      purge   => true,
+      force   => true,
+    }
+
+    file { "$base_installation::puppet_conf_path/puppet.conf":
+      content => template("base_installation/puppet/puppet.conf.erb"),
+      require => File[$base_installation::puppet_conf_path],
+    }
+
+    file { "$base_installation::puppet_conf_path/host_ldap.info":
+      content => template("base_installation/puppet/host_ldap.info.erb"),
+      require => File[$base_installation::puppet_conf_path],
+      notify  => Notify_refresh["notify-ldap-password"],
+    }
+
+    notify_refresh { "notify-ldap-password":
+      message     => template("base_installation/puppet/host_ldap.info.erb"),
+      refreshonly => true
+    }
+  }
+}