docker commit

2026-09-12 15:46:16 +02:00
commit f96af95f53
26 changed files with 2460 additions and 0 deletions
@@ -0,0 +1,152 @@
+#!/bin/sh -e
+
+LDAP_CONF_DIR=/etc/openldap/slapd.d
+LDAP_DATA_DIR=/var/lib/openldap/openldap-data
+LDAP_URLPREFIX=ldap
+
+export LDAP_IPC_URL=ldapi://%2Frun%2Fopenldap%2Fldapi
+
+dc_str=$(echo ${LDAP_FQDN} | sed -e s:[.]:,dc=:g)
+[ -z "$LDAP_SUFFIX" ] && export LDAP_SUFFIX=dc=$dc_str
+
+# Set ulimit - See https://github.com/docker/docker/issues/8231
+ulimit -n $LDAP_ULIMIT
+
+INITIAL_START=0
+
+if [ ! -d ${LDAP_CONF_DIR} ]; then
+    INITIAL_START=1
+
+    # At first startup, create directories and configurations
+    [ -z "${LDAP_ROOTDN}" ] && LDAP_ROOTDN=cn=admin,${LDAP_SUFFIX}
+
+    if [ ! -z "$LDAP_ROOTPW" ]; then
+        LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
+           -h {PBKDF2-SHA512} -s "$LDAP_ROOTPW")
+    elif [[ -z "$LDAP_ROOTPW_HASH" && -s /run/secrets/$LDAP_ROOTPW_SECRETNAME ]]; then
+        LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
+           -h {PBKDF2-SHA512} -s "$(cat /run/secrets/$LDAP_ROOTPW_SECRETNAME)")
+    fi
+    
+    if [ -z "$LDAP_ROOTPW_HASH" ]; then
+        echo "** Secret LDAP_ROOTPW_SECRETNAME unspecified **"
+        exit 1
+    fi
+
+    export LDAP_DATA_DIR
+
+    mkdir -p -m 750 ${LDAP_CONF_DIR} /run/openldap
+
+    if [[ "$(ls -A /etc/ssl/openldap)" ]]; then
+        CA_CERT=/etc/ssl/openldap/ca_cert.pem
+        SSL_KEY=/etc/ssl/openldap/tls.key
+        SSL_CERT=/etc/ssl/openldap/tls.crt
+
+        if [[ -f ${CA_CERT} ]]; then
+            echo "TLSCACertificateFile ${CA_CERT}" >> /root/slapd.conf
+        fi
+
+        echo "TLSCertificateFile ${SSL_CERT}" >> /root/slapd.conf
+        echo "TLSCertificateKeyFile ${SSL_KEY}" >> /root/slapd.conf
+        echo "TLSCipherSuite HIGH:-SSLv2:-SSLv3" >> /root/slapd.conf
+        LDAP_URLPREFIX=ldaps
+    fi
+
+    sed -i -e "s/^#BASE.*/BASE  ${LDAP_SUFFIX}/" /etc/openldap/ldap.conf
+    export LDAP_DOMAIN=$(echo ${LDAP_FQDN} | cut -d . -f 1)
+    export LDAP_EMAIL_DOMAIN=$(echo "$LDAP_FQDN" | awk -F. '{print $(NF-1)"."$NF}')
+
+
+    if [[ -n "$LDAP_READONLY_USER_USERNAME" && -n "$LDAP_READONLY_USER_PASSWORD" ]]; then
+	echo "encrypting readonly user password..";
+	LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd \
+						    -o module-load=pw-pbkdf2.so \
+						    -h '{PBKDF2-SHA512}' \
+						    -s "$LDAP_READONLY_USER_PASSWORD")
+	
+	export LDAP_READONLY_USER_PASSWORD_ENCRYPTED
+    else
+	mv /root/ldif/20-readonly-user.ldif /root/ldif/20-readonly-user.ldif.unused
+    fi
+
+    # Database structure
+    TMP=$(mktemp)
+    for file in $(find /root/ldif -type f) /root/slapd.conf; do
+        cat "${file}" | envsubst > $TMP
+        mv $TMP "${file}"
+    done
+
+    cp /root/slapd.conf /etc/openldap/slapd.conf
+
+    slaptest -f /etc/openldap/slapd.conf -F ${LDAP_CONF_DIR} -n0
+
+    # Load LDIF base schemas with slapadd
+    if [ ! -s ${LDAP_DATA_DIR}/data.mdb ]; then
+
+	for file in $(find /root/ldif -maxdepth 1 -name '00-*.ldif' -type f | sort); do
+            echo "Loading ${file}"
+            slapadd -F "${LDAP_CONF_DIR}" -l "${file}" -n1
+	done
+	    
+        if [[ -f /root/ldif/20-readonly-user.ldif ]]; then
+            echo "Loading readonly LDAP user"
+            slapadd -F "${LDAP_CONF_DIR}" -l /root/ldif/20-readonly-user.ldif -n1
+        fi
+
+    fi
+fi
+
+touch /var/log/slapd-audit.log
+
+mkdir -p -m 750 /run/openldap
+
+chown -R ldap:ldap ${LDAP_CONF_DIR} ${LDAP_DATA_DIR} /run/openldap \
+  /var/log/slapd-audit.log
+
+tail -f -n0 /var/log/slapd-audit.log |
+    sed "s/^${LDAP_PWD_ATTRIBUTE}::.*/${LDAP_PWD_ATTRIBUTE}:: --redacted--/" &
+
+# Load ldif files to cn=config, password policies and optional data with ldapadd   
+(
+    if [[ "${INITIAL_START}" = "1" ]]; then
+        sleep 10
+
+        echo 'Loading server additional config'
+	for file in $(find /root/ldif -maxdepth 1 -name '01-*.ldif' -type f | sort); do
+	    echo "Loading ${file}"
+	    envsubst < "${file}" | \
+            ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
+	done
+	
+        echo 'Loading password policy'
+        envsubst < /root/ldif/10-passwordDefaultPolicy.ldif | \
+            ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
+
+        if [[ -d /etc/openldap/prepopulate ]]; then
+
+            for file in `find /etc/openldap/prepopulate`; do
+                echo "Loading optional file: ${file}"
+                envsubst < "${file}" | \
+                    ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
+            done
+        fi
+    fi
+
+    echo 'Setting user passwords'
+
+    PW_FILE=$(find /run/secrets/$LDAP_USERPW_SECRETNAME -type f | head -1)
+
+    if [[ ! -z "${PW_FILE}" && -s "${PW_FILE}" ]]; then
+        awk -F : -v dnattr=${LDAP_DN_ATTR} \
+          -v suffix=,${LDAP_OU}${LDAP_SUFFIX} \
+          -v pwdattr=${LDAP_PWD_ATTRIBUTE} \
+          '{ print "dn: " dnattr "=" $1 suffix "\n" \
+          "changetype: modify\n" \
+          "replace: " pwdattr "\n" \
+          pwdattr ": " $2 "\n" }' <${PW_FILE} | \
+        ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
+    fi
+) &
+
+exec slapd -h "${LDAP_URLPREFIX}:/// ${LDAP_IPC_URL}" \
+      -F ${LDAP_CONF_DIR} -u ldap -g ldap -d "${LDAP_LOG_LEVEL}"