initial commit
All checks were successful
continuous-integration/drone/push Build is passing

This commit is contained in:
Robert Kaussow 2020-06-21 22:00:53 +02:00
commit 0f33b8945b
No known key found for this signature in database
GPG Key ID: 65362AE74AF98B61
21 changed files with 786 additions and 0 deletions

154
.drone.jsonnet Normal file
View File

@ -0,0 +1,154 @@
local PipelineLinting = {
kind: 'pipeline',
name: 'linting',
platform: {
os: 'linux',
arch: 'amd64',
},
steps: [
{
name: 'ansible-later',
image: 'xoxys/ansible-later',
commands: [
'ansible-later',
],
},
],
trigger: {
ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'],
},
};
local PipelineDeployment(scenario='centos7') = {
kind: 'pipeline',
name: 'testing-' + scenario,
platform: {
os: 'linux',
arch: 'amd64',
},
concurrency: {
limit: 1,
},
workspace: {
base: '/drone/src',
path: '${DRONE_REPO_NAME}',
},
steps: [
{
name: 'ansible-molecule',
image: 'xoxys/molecule:3',
environment: {
DO_API_KEY: { from_secret: 'do_api_key' },
MOLECULE_CUSTOM_MODULES_REPO: 'https://gitea.rknet.org/ansible/custom_modules',
MOLECULE_CUSTOM_FILTERS_REPO: 'https://gitea.rknet.org/ansible/custom_filters',
},
commands: [
'molecule test -s' + scenario,
],
},
],
depends_on: [
'linting',
],
trigger: {
ref: ['refs/heads/master', 'refs/tags/**'],
},
};
local PipelineDocumentation = {
kind: 'pipeline',
name: 'documentation',
platform: {
os: 'linux',
arch: 'amd64',
},
steps: [
{
name: 'generate',
image: 'xoxys/ansible-doctor',
environment: {
ANSIBLE_DOCTOR_LOG_LEVEL: 'INFO',
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true,
ANSIBLE_DOCTOR_EXCLUDE_FILES: 'molecule/',
ANSIBLE_DOCTOR_TEMPLATE: 'hugo-book',
ANSIBLE_DOCTOR_ROLE_NAME: '${DRONE_REPO_NAME#*.}',
ANSIBLE_DOCTOR_OUTPUT_DIR: '_docs/',
},
},
{
name: 'publish',
image: 'plugins/gh-pages',
settings: {
remote_url: 'https://gitea.rknet.org/ansible/${DRONE_REPO_NAME}',
netrc_machine: 'gitea.rknet.org',
username: { from_secret: 'gitea_username' },
password: { from_secret: 'gitea_token' },
pages_directory: '_docs/',
target_branch: 'docs',
},
when: {
ref: ['refs/heads/master'],
},
},
{
name: 'trigger',
image: 'plugins/downstream',
settings: {
server: 'https://drone.rknet.org',
token: { from_secret: 'drone_token' },
fork: true,
repositories: [
'ansible/galaxy',
],
},
when: {
ref: ['refs/heads/master'],
},
},
],
trigger: {
ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'],
},
depends_on: [
'testing-centos7',
],
};
local PipelineNotification = {
kind: 'pipeline',
name: 'notification',
platform: {
os: 'linux',
arch: 'amd64',
},
clone: {
disable: true,
},
steps: [
{
name: 'matrix',
image: 'plugins/matrix',
settings: {
homeserver: { from_secret: 'matrix_homeserver' },
roomid: { from_secret: 'matrix_roomid' },
template: 'Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}',
username: { from_secret: 'matrix_username' },
password: { from_secret: 'matrix_password' },
},
},
],
depends_on: [
'documentation',
],
trigger: {
status: ['success', 'failure'],
ref: ['refs/heads/master', 'refs/tags/**'],
},
};
[
PipelineLinting,
PipelineDeployment(scenario='centos7'),
PipelineDocumentation,
PipelineNotification,
]

151
.drone.yml Normal file
View File

@ -0,0 +1,151 @@
---
kind: pipeline
name: linting
platform:
os: linux
arch: amd64
steps:
- name: ansible-later
image: xoxys/ansible-later
commands:
- ansible-later
trigger:
ref:
- refs/heads/master
- refs/tags/**
- refs/pull/**
---
kind: pipeline
name: testing-centos7
platform:
os: linux
arch: amd64
concurrency:
limit: 1
workspace:
base: /drone/src
path: ${DRONE_REPO_NAME}
steps:
- name: ansible-molecule
image: xoxys/molecule:3
commands:
- molecule test -scentos7
environment:
DO_API_KEY:
from_secret: do_api_key
MOLECULE_CUSTOM_FILTERS_REPO: https://gitea.rknet.org/ansible/custom_filters
MOLECULE_CUSTOM_MODULES_REPO: https://gitea.rknet.org/ansible/custom_modules
trigger:
ref:
- refs/heads/master
- refs/tags/**
depends_on:
- linting
---
kind: pipeline
name: documentation
platform:
os: linux
arch: amd64
steps:
- name: generate
image: xoxys/ansible-doctor
environment:
ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true
ANSIBLE_DOCTOR_LOG_LEVEL: INFO
ANSIBLE_DOCTOR_OUTPUT_DIR: _docs/
ANSIBLE_DOCTOR_ROLE_NAME: ${DRONE_REPO_NAME#*.}
ANSIBLE_DOCTOR_TEMPLATE: hugo-book
- name: publish
image: plugins/gh-pages
settings:
netrc_machine: gitea.rknet.org
pages_directory: _docs/
password:
from_secret: gitea_token
remote_url: https://gitea.rknet.org/ansible/${DRONE_REPO_NAME}
target_branch: docs
username:
from_secret: gitea_username
when:
ref:
- refs/heads/master
- name: trigger
image: plugins/downstream
settings:
fork: true
repositories:
- ansible/galaxy
server: https://drone.rknet.org
token:
from_secret: drone_token
when:
ref:
- refs/heads/master
trigger:
ref:
- refs/heads/master
- refs/tags/**
- refs/pull/**
depends_on:
- testing-centos7
---
kind: pipeline
name: notification
platform:
os: linux
arch: amd64
clone:
disable: true
steps:
- name: matrix
image: plugins/matrix
settings:
homeserver:
from_secret: matrix_homeserver
password:
from_secret: matrix_password
roomid:
from_secret: matrix_roomid
template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
username:
from_secret: matrix_username
trigger:
ref:
- refs/heads/master
- refs/tags/**
status:
- success
- failure
depends_on:
- documentation
---
kind: signature
hmac: c5de5f7eb0720775f8e24d4b53420a5a2b85e90e2e1b697d3daeaf6aa314b027
...

5
.flake8 Normal file
View File

@ -0,0 +1,5 @@
[flake8]
ignore = D101, D102, D103, D105, D107, E402, W503
max-line-length = 99
inline-quotes = double
exclude = .git,.tox,__pycache__,build,dist,tests,*.pyc,*.egg-info,.cache,.eggs,env*

11
.gitignore vendored Normal file
View File

@ -0,0 +1,11 @@
# ---> Ansible
*.retry
plugins
library
# ---> Python
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

18
.later.yml Normal file
View File

@ -0,0 +1,18 @@
---
ansible:
custom_modules:
- iptables_raw
- openssl_pkcs12
- proxmox_kvm2
- ucr
- yum_versionlock
rules:
exclude_files:
- molecule/
- "LICENSE*"
- "**/*.md"
- "**/*.ini"
exclude_filter:
- LINT0009

21
LICENSE Normal file
View File

@ -0,0 +1,21 @@
MIT License
Copyright (c) 2020 Robert Kaussow <mail@geeklabor.de>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished
to do so, subject to the following conditions:
The above copyright notice and this permission notice (including the next
paragraph) shall be included in all copies or substantial portions of the
Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

16
README.md Normal file
View File

@ -0,0 +1,16 @@
# xoxys.bitwardenrs_ldap_docker
[![Build Status](https://img.shields.io/drone/build/ansible/xoxys.bitwardenrs_ldap_docker?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.bitwardenrs_ldap_docker)
[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
Role to setup a [BitwardenRS LDAP](https://gitea.rknet.org/docker/bitwarden_rs_ldap) Sync Service for [BitwardenRS](https://github.com/dani-garcia/bitwarden_rs) password safe.
You can find the full documentation at [https://galaxy.geekdocs.de](https://galaxy.geekdocs.de/roles/cloud/bitwardenrs_ldap_docker/).
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
## Maintainers and Contributors
[Robert Kaussow](https://gitea.rknet.org/xoxys)

62
defaults/main.yml Normal file
View File

@ -0,0 +1,62 @@
---
bitwardenrs_ldap_version: latest
bitwardenrs_ldap_image: "xoxys/bitwardenrs_ldap:{{ bitwardenrs_ldap_version }}"
bitwardenrs_ldap_service_directory: /var/lib/docker/services/bitwardenrs_ldap
bitwardenrs_ldap_container_name: bitwardenrs_ldap
bitwardenrs_ldap_restart_policy: always
bitwardenrs_ldap_service_stopped: False
# @var bitwardenrs_ldap_networks:example: >
# bitwardenrs_ldap_networks:
# - name: default
# # optional network driver, defaults to 'bride'
# driver: host
# @end
bitwardenrs_ldap_networks:
- name: bitwardenrs_default
external: True
bitwardenrs_ldap_networks_applied:
- bitwardenrs_default
# @var bitwardenrs_ldap_volumes:description: > Define required docker volumes.
# @end
# @var bitwardenrs_ldap_volumes:example: >
# bitwardenrs_ldap_volumes:
# # Instead of the name you could specify a path on the container host system,
# # but you also have to enable bind mount for this volume
# - name: data
# # target location inside the container
# dest: /app/data
# # enable bind mount, if false volume will be configured as named volume
# # keep in mind you MUST set bind in any case
# bind: True
# @end
bitwardenrs_ldap_volumes: []
# @var bitwardenrs_ldap_memory_limit: $ "_unset_"
# @var bitwardenrs_ldap_memory_limit:example: $ "512m"
# @var bitwardenrs_ldap_memory_reservation: $ "_unset_"
# @var bitwardenrs_ldap_memory_reservation:example: $ "256m"
# @var bitwardenrs_ldap_cpu_shares: $ "_unset_"
# @var bitwardenrs_ldap_cpu_shares:example: $ "1024"
bitwardenrs_ldap_cap_add: []
bitwardenrs_ldap_cap_drop: []
bitwardenrs_ldap_security_opt: []
# @var bitwardenrs_ldap_pids_limit: $ "_unset_"
bitwardenrs_ldap_bitwarden_url: bitwarden.example.com
bitwardenrs_ldap_bitwarden_admin_token: abc123
# @var bitwardenrs_ldap_host: $ "_unset_"
# @var bitwardenrs_ldap_scheme: $ "_unset_"
bitwardenrs_ldap_ssl: True
# @var bitwardenrs_ldap_port: $ "_unset_"
# @var bitwardenrs_ldap_bind_dn: $ "_unset_"
# @var bitwardenrs_ldap_bind_password: $ "_unset_"
# @var bitwardenrs_ldap_search_base_dn: $ "_unset_"
bitwardenrs_ldap_search_filter: "(&(objectclass=*)(uid=*))"
bitwardenrs_ldap_mail_field: "mail"
bitwardenrs_ldap_sync_interval_seconds: 60
bitwardenrs_ldap_sync_loop: True

26
meta/main.yml Normal file
View File

@ -0,0 +1,26 @@
# Standards: 0.1
---
galaxy_info:
# @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys)
author: Robert Kaussow <mail@geeklabor.de>
# @meta description: >
# [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.bitwardenrs_ldap_docker)
# [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.bitwardenrs_ldap_docker?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.bitwardenrs_ldap_docker)
# [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.bitwardenrs_ldap_docker/src/branch/master/LICENSE)
#
# Role to setup a [BitwardenRS LDAP](https://gitea.rknet.org/docker/bitwarden_rs_ldap) Sync Service
# for [BitwardenRS](https://github.com/dani-garcia/bitwarden_rs) password safe.
# @end
description: Role to setup Bitwarden passsword safe
license: MIT
min_ansible_version: 2.8
platforms:
- name: EL
versions:
- 7
galaxy_tags:
- security
- vault
- password
- save
dependencies: []

View File

@ -0,0 +1,18 @@
---
- name: Converge
hosts: all
vars:
dockerengine_packages_extra:
- epel-release
- python-pip
dockerengine_networks:
- name: bitwardenrs_default
bitwardenrs_ldap_service_stopped: True
bitwardenrs_ldap_host: ldap.example.com
bitwardenrs_ldap_bind_dn: "uid=dummy,cn=users,dc=example,dc=com"
bitwardenrs_ldap_bind_password: dummy
bitwardenrs_ldap_search_base_dn: "ou=Users,dc=example,dc=com"
roles:
- role: xoxys.docker_engine
- role: xoxys.bitwardenrs_ldap_docker

View File

@ -0,0 +1,87 @@
---
- name: Create
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
vars:
ssh_user: root
ssh_port: 22
keypair_name: molecule_key
keypair_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
tasks:
- name: Create local keypair
user:
name: "{{ lookup('env', 'USER') }}"
generate_ssh_key: true
ssh_key_file: "{{ keypair_path }}"
register: local_keypair
- name: Create remote keypair
digital_ocean_sshkey:
name: "{{ keypair_name }}"
ssh_pub_key: "{{ local_keypair.ssh_public_key }}"
state: present
register: remote_keypair
- name: Create molecule instance(s)
digital_ocean_droplet:
name: "{{ item.name }}"
unique_name: true
region: "{{ item.region_id }}"
image: "{{ item.image_id }}"
size: "{{ item.size_id }}"
ssh_keys: "{{ remote_keypair.data.ssh_key.id }}"
wait: true
wait_timeout: 300
state: present
register: server
loop: "{{ molecule_yml.platforms }}"
async: 7200
poll: 0
- name: Wait for instance(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config dict
set_fact:
instance_conf_dict: {
'instance': "{{ item.data.droplet.name }}",
'address': "{{ item.data.ip_address }}",
'user': "{{ ssh_user }}",
'port': "{{ ssh_port }}",
'identity_file': "{{ keypair_path }}",
'droplet_id': "{{ item.data.droplet.id }}",
'ssh_key_id': "{{ remote_keypair.data.ssh_key.id }}",
}
loop: "{{ digitalocean_jobs.results }}"
register: instance_config_dict
when: server.changed | bool
- name: Convert instance config dict to a list
set_fact:
instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"
when: server.changed | bool
- name: Dump instance config
copy:
content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool
- name: Wait for SSH
wait_for:
port: "{{ ssh_port }}"
host: "{{ item.address }}"
search_regex: SSH
delay: 10
timeout: 320
loop: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"

View File

@ -0,0 +1,54 @@
---
- name: Destroy
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
tasks:
- block:
- name: Populate instance config
set_fact:
instance_conf: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"
skip_instances: false
rescue:
- name: Populate instance config when file missing
set_fact:
instance_conf: {}
skip_instances: true
- name: Destroy molecule instance(s)
digital_ocean_droplet:
name: "{{ item.instance }}"
id: "{{ item.droplet_id }}"
state: absent
register: server
loop: "{{ instance_conf | flatten(levels=1) }}"
when: not skip_instances
async: 7200
poll: 0
- name: Wait for instance(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
- name: Delete remote keypair
digital_ocean_sshkey:
fingerprint: "{{ item.ssh_key_id }}"
state: absent
loop: "{{ instance_conf | flatten(levels=1) }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config
set_fact:
instance_conf: {}
- name: Dump instance config
copy:
content: "{{ instance_conf | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool

View File

@ -0,0 +1,20 @@
---
dependency:
name: galaxy
driver:
name: delegated
platforms:
- name: centos7-bitwardenrs-ldap
region_id: fra1
image_id: centos-7-x64
size_id: s-1vcpu-1gb
lint: |
flake8
provisioner:
name: ansible
env:
ANSIBLE_FILTER_PLUGINS: ${ANSIBLE_FILTER_PLUGINS:-./plugins/filter}
ANSIBLE_LIBRARY: ${ANSIBLE_LIBRARY:-./library}
ANSIBLE_COLLECTIONS_PATHS: ${ANSIBLE_COLLECTIONS_PATHS:-./collections}
verifier:
name: testinfra

View File

@ -0,0 +1,9 @@
---
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Install python for Ansible
raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)
become: true
changed_when: false

View File

@ -0,0 +1,5 @@
---
- src: https://gitea.rknet.org/ansible/xoxys.docker_engine.git
name: xoxys.docker_engine
scm: git
version: refactoring

View File

@ -0,0 +1,14 @@
import os
import testinfra.utils.ansible_runner
import warnings
warnings.filterwarnings("ignore", category=DeprecationWarning)
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_bitwardenrs_ldap_compose_file(host):
f = host.file('/var/lib/docker/services/bitwardenrs_ldap/docker-compose.yml')
assert f.exists

1
molecule/default Symbolic link
View File

@ -0,0 +1 @@
centos7

3
molecule/pytest.ini Normal file
View File

@ -0,0 +1,3 @@
[pytest]
filterwarnings =
ignore::DeprecationWarning

2
tasks/main.yml Normal file
View File

@ -0,0 +1,2 @@
---
- include_tasks: setup.yml

28
tasks/setup.yml Normal file
View File

@ -0,0 +1,28 @@
---
- block:
- name: Ensure service directory exists
file:
path: "{{ bitwardenrs_ldap_service_directory }}"
state: directory
mode: 0755
- name: Deploy compose file to '{{ bitwardenrs_ldap_service_directory }}'
template:
src: "services/bitwardenrs_ldap_compose.yml.j2"
dest: "{{ bitwardenrs_ldap_service_directory }}/docker-compose.yml"
owner: root
group: root
mode: 0640
validate: "docker-compose -f %s config -q"
- name: Ensure service is up and running
docker_compose:
project_src: "{{ bitwardenrs_ldap_service_directory }}"
pull: yes
remove_orphans: yes
stopped: "{{ bitwardenrs_ldap_service_stopped }}"
state: present
# temp. disable changes; breaks idempotency see https://github.com/ansible-collections/community.general/pull/547
changed_when: False
become: True
become_user: root

View File

@ -0,0 +1,81 @@
#jinja2:lstrip_blocks: True
{{ ansible_managed | comment }}
version: "2.4"
services:
bitwardenrs_ldap:
container_name: {{ bitwardenrs_ldap_container_name }}
image: {{ bitwardenrs_ldap_image }}
restart: {{ bitwardenrs_ldap_restart_policy }}
{% if bitwardenrs_ldap_volumes | default([]) %}
volumes:
{% for volume in bitwardenrs_ldap_volumes %}
- "{{ volume.name }}:{{ volume.dest }}"
{% endfor %}
{% endif %}
{% if bitwardenrs_ldap_networks_applied | default([]) %}
networks:
{% for network in bitwardenrs_ldap_networks_applied %}
- {{ network }}
{% endfor %}
{% endif %}
environment:
- BITWARDENRS_LDAP_BITWARDEN_URL={{ bitwardenrs_ldap_bitwarden_url }}
- BITWARDENRS_LDAP_BITWARDEN_ADMIN_TOKEN={{ bitwardenrs_ldap_bitwarden_admin_token }}
- BITWARDENRS_LDAP_HOST={{ bitwardenrs_ldap_host }}
{% if bitwardenrs_ldap_scheme is defined and bitwardenrs_ldap_scheme %}
- BITWARDENRS_LDAP_SCHEME={{ bitwardenrs_ldap_scheme }}
{% endif %}
- BITWARDENRS_LDAP_SSL={{ bitwardenrs_ldap_ssl }}
{% if bitwardenrs_ldap_port is defined and bitwardenrs_ldap_port %}
- BITWARDENRS_LDAP_PORT={{ bitwardenrs_ldap_port }}
{% endif %}
- BITWARDENRS_LDAP_BIND_DN={{ bitwardenrs_ldap_bind_dn }}
- BITWARDENRS_LDAP_BIND_PASSWORD={{ bitwardenrs_ldap_bind_password }}
- BITWARDENRS_LDAP_SEARCH_BASE_DN={{ bitwardenrs_ldap_search_base_dn }}
- BITWARDENRS_LDAP_SEARCH_FILTER={{ bitwardenrs_ldap_search_filter }}
- BITWARDENRS_LDAP_MAIL_FIELD={{ bitwardenrs_ldap_mail_field }}
- BITWARDENRS_LDAP_SYNC_INTERVAL_SECONDS={{ bitwardenrs_ldap_sync_interval_seconds }}
- BITWARDENRS_LDAP_SYNC_LOOP={{ bitwardenrs_ldap_sync_loop }}
{% if bitwardenrs_ldap_memory_limit is defined %}
mem_limit: {{ bitwardenrs_ldap_memory_limit }}
{% endif %}
{% if bitwardenrs_ldap_memory_reservation is defined %}
mem_reservation: {{ bitwardenrs_ldap_memory_reservation }}
{% endif %}
{% if bitwardenrs_ldap_cpu_shares is defined %}
cpu_shares: {{ bitwardenrs_ldap_cpu_shares }}
{% endif %}
{% if not bitwardenrs_ldap_cap_add | length == 0 %}
cap_add:
{% for item in bitwardenrs_ldap_cap_add %}
- {{ item }}
{% endfor %}
{% endif %}
{% if not bitwardenrs_ldap_cap_drop | length == 0 %}
cap_drop:
{% for item in bitwardenrs_ldap_cap_drop %}
- {{ item }}
{% endfor %}
{% endif %}
{% if not bitwardenrs_ldap_security_opt | length == 0 %}
security_opt:
{% for item in bitwardenrs_ldap_security_opt %}
- {{ item }}
{% endfor %}
{% endif %}
{% if bitwardenrs_ldap_pids_limit is defined %}
pids_limit: {{ bitwardenrs_ldap_pids_limit }}
{% endif %}
{% if bitwardenrs_ldap_networks | default([]) | length > 0 %}
networks:
{% for network in bitwardenrs_ldap_networks %}
{{ network.name }}:
{% if network.external | default(False) | bool %}
external: true
{% else %}
driver: {{ network.backend | default("bridge") }}
{% endif %}
{% endfor %}
{% endif %}