container-openldap/services/openldap-bootstrap/assets/scripts

Bootstrap Scripts

Shell scripts that prepare environment variables and LDIF files for the OpenLDAP bootstrap process. Each script supports two operations:

• env – exports variables needed by LDIF templates (passwords, computed values, etc.)
• ldif – copies and renders LDIF templates from ../ldif/ into the bootstrap working directory

Scripts are executed in numeric order. Most are feature-gated by an environment variable and skip themselves when their feature is disabled.

Scripts

Script	Trigger	Description
00-base.sh	always	Core bootstrap: root passwords, modules, schemas and base LDIF files, including global request limits
05-data-tree.sh	OPENLDAP_BOOTSTRAP_DATA_TREE=true	Creates the users, groups and services OUs
10-tls.sh	OPENLDAP_BOOTSTRAP_TLS=true	Applies TLS certificate and protocol configuration
15-tls-required.sh	OPENLDAP_BOOTSTRAP_TLS_REQUIRED=true	Enforces minimum 128-bit SSF (warns if TLS is not also enabled)
20-database-readonly.sh	OPENLDAP_BOOTSTRAP_DATA_READONLY=true	Creates a read-only service account for the data database and hides password history when ppolicy is enabled
23-database-admin.sh	OPENLDAP_BOOTSTRAP_DATA_ADMIN=true	Creates a scoped users/groups administrator, protecting services, password hashes/history and configuration
25-database-management.sh	OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT=true	Creates one account below the services branch, reading users/groups and resetting user passwords with configurable hidden attributes and no other write permissions
30-monitor-readonly.sh	OPENLDAP_BOOTSTRAP_MONITOR_READONLY=true	Creates a read-only service account for the monitor database
35-auditlog.sh	OPENLDAP_BOOTSTRAP_AUDITLOG=true	Configures file-based auditing on the data database
40-refint.sh	OPENLDAP_BOOTSTRAP_REFINT=true	Configures the referential integrity overlay and optional replacement DN
45-refint-nothing.sh	OPENLDAP_BOOTSTRAP_REFINT=true and OPENLDAP_BOOTSTRAP_REFINT_NOTHING_DN non-empty	Creates the passwordless replacement role
50-ppolicy.sh	OPENLDAP_BOOTSTRAP_PPOLICY=true	Configures password policy and validates inactivity and progressive lockout prerequisites
60-unique.sh	OPENLDAP_BOOTSTRAP_UNIQUE=true	Configures the unique attributes overlay
70-memberof.sh	OPENLDAP_BOOTSTRAP_MEMBEROF=true	Configures the memberof overlay
80-replication.sh	OPENLDAP_BOOTSTRAP_REPLICATION=true	Sets up multi-provider syncrepl replication (requires 2 to 9 hosts)
90-custom.sh	always	Applies user-provided custom LDIF files from the custom/ directories

Helpers

Utility functions shared across the bootstrap scripts.

helpers/common.sh

Function	Description
check_args	Validates that a script was called with the expected operation (env/ldif) and argument count
prepare_env_file	Appends exported variable assignments (safely shell-quoted) to an env file
prepare_ldif_files	Copies sources to a temporary writable directory (dereferencing symlinks), renders templates via container envsubst templates, then copies the resulting .ldif and .ldif.optional files (sorted) to the output directory. Feature scripts activate optional fragments with mv; the helper does not select them. Sources can be mounted read-only. The function removes its working copy on success; the bootstrap's global EXIT trap cleans up on failure.
get_dn_attr	Extracts the value of a named attribute from a DN string (e.g. cn from cn=admin,dc=example,dc=com)

helpers/password.sh

Function	Description
generate_password	Generates a random password using openldap-ctl password generate
hash_password	Hashes a plaintext password using openldap-ctl password hash
ensure_hashed_password	Returns the input unchanged if already hashed; otherwise generates and hashes a new password and logs that a random one was created

Adding a new feature

1. Create a numbered script (e.g. 55-myfeature.sh) that accepts env and ldif arguments.
2. Guard execution with the appropriate environment variable check.
3. Add LDIF templates under matching feature directories in ../ldif/config/ and/or ../ldif/data/: 55-myfeature.sh loads myfeature/, with filenames such as NN-myfeature-description.ldif.template. Name conditional templates .ldif.optional.template and activate their rendered .ldif.optional files with mv in the feature script when needed. Unactivated fragments are ignored during final assembly.
4. Source helpers/common.sh and helpers/password.sh as needed.