Autofs schema, keep unix sock open, readme fix, rename

Dockerfile

@@ -1,59 +1,47 @@
-FROM osixia/baseimage:0.10.0
-MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.net>
+FROM osixia/baseimage:0.6.0
+MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
 
 # From Nick Stenning's work
 # https://github.com/nickstenning/docker-slapd
 
 # Default configuration: can be overridden at the docker command line
-ENV DOMAIN_NAME ldap.example.com
-ENV LDAP_DOMAIN example.com
 ENV LDAP_ADMIN_PWD toor
 ENV LDAP_ORGANISATION Example Inc.
-
-ENV WITH_MMC_AGENT false
-ENV MMC_AGENT_LOGIN mmc-docker
-ENV MMC_AGENT_PASSWORD passw0rd
+ENV LDAP_DOMAIN example.com
 
 # /!\ To store the data outside the container, 
 # mount /var/lib/ldap and /etc/ldap/slapd.d as a data volume add
 # -v /some/host/directory:/var/lib/ldap and -v /some/other/host/directory:/etc/ldap/slapd.d
 # to the run command
 
-VOLUME ["/var/lib/ldap", "/etc/ldap/slapd.d"]
-
 # Disable SSH
 # RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
 
 # Enable dnsmasq
-RUN /sbin/enable-service dnsmasq ca-authority
+RUN /sbin/enable-service dnsmasq
 
 # Use baseimage-docker's init system.
 CMD ["/sbin/my_init"]
 
-# Add Mandriva MDS repository
-RUN echo "deb http://mds.mandriva.org/pub/mds/debian wheezy main" >> /etc/apt/sources.list
-
 # Resynchronize the package index files from their sources
 RUN apt-get -y update
 
 # Install openldap (slapd) and ldap-utils
-RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --force-yes --no-install-recommends slapd ldap-utils  mmc-agent python-mmc-mail
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends slapd ldap-utils openssl
 
-# Expose ldap and mmc-agent default ports
-EXPOSE 389 7080
+# Expose ldap default port
+EXPOSE 389
 
 # Create TLS certificats directory
 RUN mkdir /etc/ldap/ssl
 
 # Add config directory 
-ADD service/slapd/assets/config /etc/ldap/config
-ADD service/mmc-agent/assets /etc/mmc/agent/assets
+RUN mkdir /etc/ldap/config
+ADD service/slapd/config /etc/ldap/config
 
 # Add slapd deamon
+RUN mkdir /etc/service/slapd
 ADD service/slapd/slapd.sh /etc/service/slapd/run
 
-# Add mmc-agent deamon
-ADD service/mmc-agent/mmc-agent.sh /etc/service/mmc-agent/run
-
 # Clear out the local repository of retrieved package files
 RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

Makefile

@@ -1,4 +1,4 @@
-NAME = osixia/openldap
+NAME = nikolaik/openldap
 VERSION = 0.9.2
 
 .PHONY: all build test tag_latest release
@@ -6,17 +6,16 @@ VERSION = 0.9.2
 all: build
 
 build:
-	docker build -t $(NAME):$(VERSION) --rm .
+	docker.io build -t $(NAME):$(VERSION) --rm .
 
 test:
 	env NAME=$(NAME) VERSION=$(VERSION) ./test.sh debug
 
 tag_latest:
-	docker tag $(NAME):$(VERSION) $(NAME):latest
+	docker.io tag $(NAME):$(VERSION) $(NAME):latest
 
 release: build test tag_latest
-	@if ! docker images $(NAME) | awk '{ print $$2 }' | grep -q -F $(VERSION); then echo "$(NAME) version $(VERSION) is not yet built. Please run 'make build'"; false; fi
-	@if ! head -n 1 CHANGELOG.md | grep -q 'release date'; then echo 'Please note the release date in Changelog.md.' && false; fi
-	docker push $(NAME)
-	@echo "*** Don't forget to run 'twgit release/hotfix finish' :)"
+	@if ! docker.io images $(NAME) | awk '{ print $$2 }' | grep -q -F $(VERSION); then echo "$(NAME) version $(VERSION) is not yet built. Please run 'make build'"; false; fi
+	docker.io push $(NAME)
+	@echo "*** Don't forget to run 'twgit release finish' :)"
 

README.md

@@ -28,6 +28,6 @@ and optionaly `dhparam.pem` this file is genereted automaticaly if not present.
                -v /data/ldap/log/:/var/log \
                -e LDAP_DOMAIN=example.com \
                -e LDAP_ORGANISATION="Example Corp." \
-               -e LDAP_ROOTPASS=toor \
+               -e LDAP_ADMIN_PWD=toor \
                -p 389:389 -d osixia/openldap
 

service/mmc-agent/assets/append_to_mail.ini

@@ -1,3 +0,0 @@
-[userdefault] 
-mailbox = /home/vmail/%uid%/ 
-mailuserquota = 204800

service/mmc-agent/assets/convert_to_ldif

@@ -1,6 +0,0 @@
-include /etc/ldap/schema/core.schema
-include /etc/ldap/schema/cosine.schema
-include /etc/ldap/schema/nis.schema
-include /etc/ldap/schema/inetorgperson.schema
-include /usr/share/doc/mmc/contrib/base/mmc.schema
-include /usr/share/doc/mmc/contrib/mail/mail.schema

service/mmc-agent/mmc-agent.sh

@@ -1,94 +0,0 @@
-#!/bin/sh
-
-# -e Exit immediately if a command exits with a non-zero status
-set -e
-
-WITH_MMC_AGENT=${WITH_MMC_AGENT}
-
-# Run mmc-agent
-if [ "$WITH_MMC_AGENT" = true ]; then
-
-  # Openldap is configured
-  if [ -e /etc/ldap/slapd.d/docker_bootstrapped ]; then
-
-    # mmc-agent is not already configured
-    if [ ! -e /etc/mmc/agent/docker_bootstrapped ]; then
-      status "configuring mmc-agent for first run"
-
-       status () {
-        echo "---> ${@}" >&2
-      }
-
-      getBaseDn () {
-        IFS="."
-        export IFS
-
-        domain=$1
-        init=1
-
-        for s in $domain; do
-          dc="dc=$s"
-          if [ "$init" -eq 1 ]; then
-            baseDn=$dc
-            init=0
-        else
-            baseDn="$baseDn,$dc" 
-          fi
-        done
-      }
-
-      DOMAIN_NAME=${DOMAIN_NAME}
-      WITH_MMC_AGENT=${WITH_MMC_AGENT}
-      LDAP_DOMAIN=${LDAP_DOMAIN}
-      LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
-      MMC_AGENT_LOGIN=${MMC_AGENT_LOGIN}
-      MMC_AGENT_PASSWORD=${MMC_AGENT_PASSWORD}
-
-      # mmc-agent config
-      sed -i -e "s/127.0.0.1/0.0.0.0/" /etc/mmc/agent/config.ini #listen on docker default network
-      sed -i -e "s/login = mmc/login = $MMC_AGENT_LOGIN/" /etc/mmc/agent/config.ini
-      sed -i -e "s/password = s3cr3t/password = $MMC_AGENT_PASSWORD/" /etc/mmc/agent/config.ini
-
-      # generate ssl certificate
-      rm /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem
-      /sbin/ssl-create-cert mmc /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem
-
-      # Get base dn from ldap domain
-      getBaseDn ${LDAP_DOMAIN}
-
-      sed -i -e "s/dc=mandriva, dc=com/$baseDn/" /etc/mmc/plugins/base.ini
-      sed -i -e "s/password = secret/password = $LDAP_ADMIN_PWD/" /etc/mmc/plugins/base.ini
-
-      mkdir /home/archives
-
-      # Mail plugin
-
-      sed -i -e 's/vDomainSupport = 0/vDomainSupport = 1/g' /etc/mmc/plugins/mail.ini
-      sed -i -e 's/vAliasesSupport = 0/vAliasesSupport = 1/g' /etc/mmc/plugins/mail.ini
-      cat /etc/mmc/agent/assets/append_to_mail.ini >> /etc/mmc/plugins/mail.ini
-
-      touch /etc/mmc/agent/docker_bootstrapped
-    else
-      status "found already-configured mmc-agent"
-    fi
-
-    # Run mmc-agent
-    exec /usr/sbin/mmc-agent -d
-
-  # wait openldap config done
-  else
-    sleep 3s
-  fi
-
-# Do nothing but needed for runit
-else 
-  sleep 1d
-fi
-
-
-
-
-
-
-
-

service/slapd/config/auto/tls.ldif

@@ -1,8 +1,5 @@
 dn: cn=config
 changetype: modify
-add: olcTLSCipherSuite
-olcTLSCipherSuite: SECURE256:-VERS-SSL3.0
--
 replace: olcTLSCACertificateFile
 olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
 -

service/slapd/config/autofs.ldif

@@ -0,0 +1,12 @@
+dn: cn=autofs,cn=schema,cn=config
+changetype: add
+objectClass: olcSchemaConfig
+cn: autofs
+olcAttributeTypes: {0}( 1.3.6.1.1.1.1.25 NAME 'automountInformation' DESC 'Inf
+ ormation used by the autofs automounter' EQUALITY caseExactIA5Match SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcObjectClasses: {0}( 1.3.6.1.1.1.1.13 NAME 'automount' DESC 'An entry in an 
+ automounter map' SUP top STRUCTURAL MUST ( cn $ automountInformation $ object
+ class ) MAY description )
+olcObjectClasses: {1}( 1.3.6.1.4.1.2312.4.2.2 NAME 'automountMap' DESC 'An gro
+ up of related automount objects' SUP top STRUCTURAL MUST ou )

service/slapd/slapd.sh

@@ -11,7 +11,6 @@ set -x
 : LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
 : LDAP_DOMAIN=${LDAP_DOMAIN}
 : LDAP_ORGANISATION=${LDAP_ORGANISATION}
-: DOMAIN_NAME=${DOMAIN_NAME}
 
 
 ############ Base config ############
@@ -36,10 +35,6 @@ EOF
 
   dpkg-reconfigure -f noninteractive slapd
 
-  # Enable access only from docker default network and localhost
-  echo "slapd: 172.17.0.0/255.255.0.0 127.0.0.1 : ALLOW" >> /etc/hosts.allow
-  echo "slapd: ALL : DENY" >> /etc/hosts.allow
-
   touch /var/lib/ldap/docker_bootstrapped
 
 else
@@ -48,76 +43,41 @@ fi
 
 
 ############ Custom config ############
-if [ ! -e /etc/ldap/slapd.d/docker_bootstrapped ]; then
+if [ ! -e /etc/ldap/config/docker_bootstrapped ]; then
   status "Custom config"
 
   slapd -h "ldapi:///" -u openldap -g openldap 
   chown -R openldap:openldap /etc/ldap 
 
-  if [ "$WITH_MMC_AGENT" = true ]; then
-
-    # Convert needed mmc ldap schema to ldif
-    mkdir -p /etc/ldap/schema/converted
-    slaptest -f /etc/mmc/agent/assets/convert_to_ldif -F /etc/ldap/schema/converted
-
-    sed -i -e 's/^dn:.*$/dn: cn=mmc,cn=schema,cn=config/; s/^cn:.*$/cn: mmc/; /^structuralObjectClass:.*$/d; /^entryUUID:.*$/d; /^creatorsName:.*$/d; /^createTimestamp:.*$/d; /^entryCSN:.*$/d; /^modifiersName:.*$/d; /^modifyTimestamp:.*$/d' /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{4\}mmc.ldif
-  
-    sed -i -e 's/^dn:.*$/dn: cn=mail,cn=schema,cn=config/; s/^cn:.*$/cn: mail/; /^structuralObjectClass:.*$/d; /^entryUUID:.*$/d; /^creatorsName:.*$/d; /^createTimestamp:.*$/d; /^entryCSN:.*$/d; /^modifiersName:.*$/d; /^modifyTimestamp:.*$/d' /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{5\}mail.ldif
-
-    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{4\}mmc.ldif -Q 
-    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{5\}mail.ldif -Q 
-
-  fi
-
   # TLS
   if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
     status "certificates found"
 
-  else
+    chmod 600 /etc/ldap/ssl/ldap.key
 
-    # generate default tls certificate
-    export SSL_SLAPD_COMMON_NAME="$DOMAIN_NAME"
-    export SSL_SLAPD_ORGANIZATION="${LDAP_ORGANISATION}"
+    # create DHParamFile if not found
+    [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
 
-    /sbin/ssl-gnutls-create-signed-cert slapd /etc/ldap/ssl/ldap.crt /etc/ldap/ssl/ldap.key
-    ln -s /etc/ssl/certs/docker_baseimage_gnutls_cacert.pem /etc/ldap/ssl/ca.crt
+    ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif -Q 
+
+    # add fake dnsmasq route to certificate cn
+    cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
+    echo "127.0.0.1	" $cn >> /etc/dhosts
 
   fi
 
-  # Fix permission on certificates
-  chown openldap:openldap -R /etc/ldap/ssl
-  chmod 600 /etc/ldap/ssl/ldap.key
-
-  # ldap client config
-  sed -i 's,TLS_CACERT.*,TLS_CACERT /etc/ldap/ssl/ca.crt,g' /etc/ldap/ldap.conf
- 
-  # create DHParamFile if not found
-  [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
-
-  ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/modify/auto/tls.ldif -Q 
-
-  # add fake dnsmasq route to certificate cn
-  cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
-  /sbin/dns-add-host 127.0.0.1 $cn
-
   # Replication
   # todo :)
 
-  # Add config
-  for f in $(find /etc/ldap/config/add -maxdepth 1 -name \*.ldif -type f); do
-    status "Processing file ${f}"
-    ldapadd -Y EXTERNAL -H ldapi:/// -f $f -Q 
-  done
-
-  # Modify config 
-  for f in $(find /etc/ldap/config/modify -maxdepth 1 -name \*.ldif -type f); do
+  # Other config files
+  for f in $(find /etc/ldap/config -maxdepth 1 -name \*.ldif -type f); do
     status "Processing file ${f}"
     ldapmodify -Y EXTERNAL -H ldapi:/// -f $f -Q 
   done
 
   kill -INT `cat /run/slapd/slapd.pid`
 
-  touch /etc/ldap/slapd.d/docker_bootstrapped
+ touch /etc/ldap/config/docker_bootstrapped
 
 else
   status "found already-configured slapd"
@@ -126,4 +86,4 @@ fi
 status "starting slapd on default port 389"
 set -x
 
-exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1
+exec /usr/sbin/slapd -h "ldap:/// ldapi:///" -u openldap -g openldap -d -1

test/config-repository

@@ -1,4 +1,4 @@
-testImage=osixia/openldap:latest
+testImage=nikolaik/openldap:latest
 testContainer=openldap-repository-test-container
 testDir=/osixia-repository-test-docker-openldap
 

test/db.sh

@@ -12,12 +12,10 @@ mkdir $testDir/config
 
 runOptions="-e LDAP_DOMAIN=otherdomain.com -v $testDir/db:/var/lib/ldap -v $testDir/config:/etc/ldap/slapd.d"
 . $dir/tools/run-container.sh
-sleep 30
 $dir/tools/delete-container.sh
 
 runOptions="-v $testDir/db:/var/lib/ldap -v $testDir/config:/etc/ldap/slapd.d"
 . $dir/tools/run-container.sh
-sleep 30
 echo "ldapsearch -x -h $IP -b dc=otherdomain,dc=com"
 ldapsearch -x -h $IP -b dc=otherdomain,dc=com
 

test/simple.sh

@@ -4,7 +4,6 @@ dir=$(dirname $0)
 . $dir/tools/run-container.sh
 
 echo "ldapsearch -x -h $IP -b dc=example,dc=com"
-sleep 30
 ldapsearch -x -h $IP -b dc=example,dc=com
 
 $dir/tools/delete-container.sh

test/tls.sh

@@ -4,7 +4,6 @@ dir=$(dirname $0)
 . $dir/tls/run.sh
 
 echo "ldapsearch -x -h $certCN -b dc=example,dc=com -ZZ"
-sleep 30
 ldapsearch -x -h $certCN -b dc=example,dc=com -ZZ
 
 . $dir/tls/end.sh

test/tools/build-container.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
 
-docker build -t $testImage .
-#docker build --no-cache=true -t $testImage .
+docker.io build -t $testImage .
+#docker.io build --no-cache=true -t $testImage .
 

test/tools/delete-container.sh

@@ -1,9 +1,9 @@
 #!/bin/sh
 
 # remove test container
-res=$(docker ps -a | grep -c "$testContainer")
+res=$(docker.io ps -a | grep -c "$testContainer")
 
 if [ $res -ne 0 ]; then
-  docker stop $testContainer
-  docker rm $testContainer
+  docker.io stop $testContainer
+  docker.io rm $testContainer
 fi

test/tools/delete-image.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 
 # remove test image
-res=$(docker images | grep -c "$testImage")
+res=$(docker.io images | grep -c "$testImage")
 
 if [ $res -ne 0 ]; then
-  docker rmi $testImage
+  docker.io rmi $testImage
 fi

test/tools/run-container.sh

@@ -1,11 +1,11 @@
 #!/bin/sh
 
-echo "docker run --name $testContainer $runOptions -d $testImage $runCommand /sbin/my_init --enable-insecure-key"
-ID=`docker run --name $testContainer $runOptions -d $testImage $runCommand /sbin/my_init --enable-insecure-key`
+echo "docker.io run --name $testContainer $runOptions -d $testImage $runCommand"
+ID=`docker.io run --name $testContainer $runOptions -d $testImage $runCommand`
 sleep 10
 
 echo " --> Obtaining IP"
-IP=`docker inspect -f "{{ .NetworkSettings.IPAddress }}" $ID`
+IP=`docker.io inspect -f "{{ .NetworkSettings.IPAddress }}" $ID`
 if [ "$IP" = "" ]; then
 	abort "Unable to obtain container IP"
 	exit 1