ds389_server_uri: "ldap://localhost:{{ ds389_init_slapd.port }}"

ds389_init_general: {}

ds389_init_slapd: {}

ds389_init_backend: {}

ds389_tls: {}

ds389_sasl_plain_enabled: true

ds389_allow_anonymous_binds: 'rootdse'
ds389_simple_auth_enabled: true

ds389_password_storage_scheme: "PBKDF2_SHA256"
ds389_install_examples: false
ds389_ldapi_enabled: true

ds386_plugins_dynamic_load: true

# https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html-single/administration_guide/index#listing_the_available_plug-ins
# https://possiblelossofprecision.net/?p=2534
ds389_plugins_enabled: {}

ds389_custom_schema: []

ds389_install_additional_ldif: []

# Cannot use /tmp, see https://github.com/lvps/389ds-server/issues/18
ds389_install_additional_ldif_dir: "/var/lib/dirsrv/slapd-{{ ds389_init_slapd.instance_name }}/ldif"

ds389_logging:
  audit:
    enabled: false
    logrotationtimeunit: day
    logmaxdiskspace: 400
    maxlogsize: 200
    maxlogsperdir: 7
    mode: 600
  access:
    enabled: true
    logrotationtimeunit: day
    logmaxdiskspace: 400
    maxlogsize: 200
    maxlogsperdir: 7
    mode: 600
  error:
    enabled: true
    logrotationtimeunit: day
    logmaxdiskspace: 400
    maxlogsize: 200
    maxlogsperdir: 7
    mode: 600

ds389_dna_plugin:
  gid_min: 2000
  gid_max: 2999
  uid_min: 2000
  uid_max: 2999

ds389_init_general:
  machine_name: "{{ ansible_nodename }}"

ds389_init_slapd:
  instance_name: default
  listen: 127.0.0.1
  secure_listen: 127.0.0.1
  port: 389
  root_dn: cn=Directory Manager
  root_password: "Bwmo5xqKeXDg2xkhFwhNLG1k8G9fUfS9q5FQ70I8uD"
  self_sign_cert: true
  self_sign_cert_valid_months: 4
  db_home_dir: ""
  run_dir: "/run"

ds389_init_backend:
  example.com:
    name: exampleRoot
    sample_entries: true
    suffix: dc=example,dc=com
    create_suffix_entry: true

ds389_tls:
ds389_tls:
  enabled: true
  enforced: true
  key_file: "{{ snakeoil_local_tmp_directory }}/{{ snakeoil_domain }}/{{ snakeoil_domain }}.key"
  cert_file: "{{ snakeoil_local_tmp_directory }}/{{ snakeoil_domain }}/{{ snakeoil_domain }}.pem"

ds389_plugins_enabled:
  MemberOf Plugin: true

ds389_custom_schema:
  - "98-ssh.ldif"
  - "98-telegram.ldif"

ds389_defaults_init_general:
  version: ""
  machine_name: "{{ ansible_nodename }}"

ds389_defaults_init_slapd:
  instance_name: default
  listen: 0.0.0.0
  secure_listen: 0.0.0.0
  port: 389
  root_dn: cn=Directory Manager
  root_password: "Bwmo5xqKeXDg2xkhFwhNLG1k8G9fUfS9q5FQ70I8uD"
  self_sign_cert: true
  self_sign_cert_valid_months: 4
  db_home_dir: ""
  run_dir: "/run"

ds389_defaults_init_backend:
  example.com:
    name: exampleRoot
    sample_entries: true
    suffix: dc=example,dc=com
    create_suffix_entry: true

#  - name: userRoot
#    sample_entries: true
#    suffix: dc=example,dc=com
#    create_suffix_entry: true
#    # - name: next
#    #   sample_entries: true
#    #   suffix: dc=next,dc=lan
#    #   create_suffix_entry: true

ds389_defaults_tls:
  enabled: false
  enforced: false
  #key: ""
  #cert: ""
  key_file: tls_test_local.key
  cert_file: tls_test_local_cert.pem
  files_remote: false
  # As in, "publicly trusted because it's signed by a public and recognized CA"
  validate_certs: false
  enforced_initially_binds:
  min_version: "1.2"
  # Ansible is not secure enough for a SSF of 256 for 389DS 1.4.X
  # Unfortunately we don't yet have access to dirsrv_legacy or the
  # installed version so we need to base the condition on the CentOS version
  min_ssf: 256