53d53f2375
Merge branch 'bugfix/152-remove_encryption_keys_tls' of kosmos/chef into master
2020-04-30 15:50:26 +00:00
Greg Karékinian
1c920a8cb2
Remove the encryption keys after TLS cert renewal
...
This is done with awk, this was the best way I found to perform the
multi-line deletion. It deletes both the AES AND 3DES sections
The keys will be recreated on service restart
https://access.redhat.com/documentation/en-us/red_hat_directory_server/9.0/html/administration_guide/ssl-and-attr-encryption
Closes #152
2020-04-20 19:11:34 +02:00
Greg Karékinian
5e3c8066f9
Add the missing certbot command to generate the LDAP TLS cert
...
This had been done manually on barnard. This will not be executed on
barnard again since the cert exists
2020-04-20 19:10:15 +02:00
Greg Karékinian
d01c9a4d0a
Fix the name of the deploy certbot hook
2020-04-20 19:09:43 +02:00
Greg Karékinian
3ca8ab45da
Fix the invalid ACIs on initial creation
...
This is only executed on initial creation of the instance, the
production one is using these fixed ACIs, this was only an issue with
the setup
The issue was the ACI was set at the wrong level
2020-04-20 19:00:28 +02:00
Greg Karékinian
e56faab5b1
Set the ACIs on the base DN
...
Allow users to change their own password, but nothing else (no search,
no read, no write)
This will only run when setting up the 389-dirsrv instance for the first
time, this has been applied on barnard by editing the dn (see
#128 (comment) )
Closes #128
2020-02-12 16:13:45 +01:00
Greg Karékinian
a69192a863
Enable LDAP support on mediawiki
...
Users can log in using their LDAP account (in the
ou=users,dc=kosmos,dc=org group and with the wiki attribute set to
enabled)
Add an attribute for the ldap master server, so it can be overridden in
the development environment
Refs #107
2020-01-24 13:45:17 +01:00
Greg Karékinian
9828b867ba
Disable anonymous binds
...
See https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/html/Administration_Guide/configuring-special-binds.html#disabling-anonymous-binds
2019-12-20 16:46:03 +01:00
Greg Karékinian
1240ed9da8
Move the dirsrv cert generation to a certbot deploy hook
2019-12-05 15:47:10 +01:00
Greg Karékinian
0d192f536f
Add the empty nginx vhost template
2019-12-05 15:05:37 +01:00
Greg Karékinian
0dbf350540
Restart the server after importing the TLS cert
2019-12-04 17:40:27 +01:00
Greg Karékinian
4e7d453942
Move the firewall and backup recipes outside of the custom resource
...
See the comment for more details
2019-12-04 17:33:41 +01:00
Greg Karékinian
e24cd01287
Add an empty template because the nginx_certbot_site resource needs one
2019-12-04 17:33:13 +01:00
Greg Karékinian
632cb38aab
Pass an empty passphrase on the command line for the p12 cert
2019-12-04 17:32:40 +01:00
Greg Karékinian
9d9493af0d
Add a missing dependency on the kosmos-nginx cookbook
2019-12-04 17:32:03 +01:00
Greg Karékinian
dc91128eca
Use a custom resource to create a 389 Directory Server instance
...
This replaces the default recipe and will make it much easier to create
other types of instances, for example for replication
2019-11-29 14:34:52 +01:00
Greg Karékinian
9e4685a743
Initial version of the kosmos-dirsrv cookbook
...
It sets up 389 Directory Server, including a TLS cert acquired using
Let's Encrypt in production (that requires ldap.kosmos.org pointing to
the server's IP)
2019-11-15 15:41:30 +01:00
