---
# LDAP Debug to logfile
# Hint: View log level:
# ldapsearch -H ldapi:/// -Y EXTERNAL -b "cn=config" -LLL -Q | grep olcLogLevel:

#cat << EOF | ldapmodify -Y EXTERNAL -H ldapi:/// -Q
#dn: cn=config
#changeType: modify
#replace: olcLogLevel
#olcLogLevel: stats
#EOF
## ldap will log to local.4 per default - put this in seperate logfile
#echo "local4.* /var/log/slapd.log" >> /etc/rsyslog.d/51-slapd.conf
#systemctl restart rsyslog.service

# install rsyslog to allow conventional logging
# starting with debian 12 rsyslog will no longer be installed
- name: install rsyslog
  tags: ldap
  become: true
  ansible.builtin.package:
    name:
    - rsyslog
    state: present

# ldap will log to local.4 per default - put this in seperate logfile
- name: ldap-debug create new logging channel local4
  tags: ldap
  become: true
  ansible.builtin.copy:
    content: |
      local4.* /var/log/slapd.log
      local4.* stop
    dest: '/etc/rsyslog.d/51-slapd.conf'
  notify: restart rsyslog.service

- name: ldap-debug logrotate
  tags: ldap
  become: true
  ansible.builtin.copy:
    content: |
      /var/log/slapd.log {
        daily
        missingok
        rotate 12
        compress
        delaycompress
        copytruncate
        notifempty
        minsize 5M
      }
    dest: '/etc/logrotate.d/slapd-debug'
  notify: restart logrotate.service

- name: ldap-debug reload services now
  meta: flush_handlers

# set log level in LDAP
- name: ldap-debug create debug ldif
  tags: ldap
  become: true
  ansible.builtin.copy:
    content: |
      dn: cn=config
      changeType: modify
      replace: olcLogLevel
      # for LogLevels see https://www.openldap.org/doc/admin24/slapdconf2.html
      # be very verbose olcLogLevel: stats ACL sync
      olcLogLevel: sync
    dest: /tmp/ldap-debug.ldif

- name: ldap-debug import debug ldif
  tags: ldap
  become: true
  shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/ldap-debug.ldif
  ignore_errors: true
