openldap-ctl restore --force deleted existing config and data before
loading the backup: a failing slapadd left OpenLDAP stopped with empty or
partial databases. Existing data is now moved to a hidden
.restore-previous directory in the same volume, removed when the restore
succeeds, and put back otherwise. OpenLDAP is restarted in both cases if
it was running. A leftover .restore-previous directory from an
interrupted restore blocks the next restore.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The replication password was not quoted in olcSyncRepl: a password with
spaces made the bootstrap fail. The default sync repl template now quotes
credentials. slapd can not store an escaped double quote followed by a
space in olcSyncRepl, so passwords with double quotes are rejected with an
explicit error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
openldap-ctl backup --clean removed every file older than N days in the
backup directory, including manual and pre-upgrade backups. It now only
removes backup files, and --clean-prefix limits it to backups starting
with a prefix.
Cron backups are named openldap-cron-<date>-<version> and cleaned with
--clean-prefix openldap-cron-.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update the base image to osixia/baseimage:alpine-2.0.0 and build the
CI/CD tool with osixia/dagger-build (Go 1.26.9).
- Add Dagger integration tests: default bootstrap, alternative schemas,
all compatible modules and schemas with every bootstrap feature on a
3-node replicated cluster with TLS required, backup/restore, simulated
upgrade and upgrade from previous releases.
- Fix bootstrap failing with "Argument list too long" with large schemas:
load them with LDIF include: lines, fail on missing schemas.
- Default OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY to 1 so
pwdMinLength is enforced.
- Align the CI workflow with osixia/container-baseimage and add Dependabot.
- Document available schemas and modules and their incompatibilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A stripped trailing space before a folded line merged
"caseExactIA5Match" and "SYNTAX" in mailStorageDirectory, making
slapadd reject the schema during bootstrap. Regenerated with
openldap-ctl schema2ldif.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Verify that the backup files exist and are valid gzip archives before
stopping OpenLDAP or deleting existing data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first file of each prefix group was not stripped, so a trailing
empty line there split the entry completed by the following files.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The RETURN traps overwrote each other and left the generated config
LDIF in /tmp. Use a single temporary directory removed by an EXIT trap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fail with an explicit error when the suffix does not start with dc=
(the root entry was created with an empty dc) and when more than 9
replication hosts are set (the generated rid would exceed 999).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without access to the entry pseudo-attribute the ACL rule had no
effect. Also allow objectClass, ou, o and dc so searches and tree
browsing work.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The password was expanded before eval and parsed again as shell code,
so spaces, $ or ; changed the hashed value or ran extra commands.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
version_lt kept the whole version as a single array element, so the
arithmetic comparison failed and the function always returned false.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the Postfix Book schema in .schema and cn=config LDIF formats, document its incompatibility with virtualMail, and improve debug output and validation during schema conversion and file moves. Update the base image to osixia/baseimage:alpine-2.0.0-rc3 and document the changes for 2.6.15-beta.
