---
- name: Exiger le mot de passe admin LDAP (Vault)
  ansible.builtin.assert:
    that:
      - serveur_openldap_admin_password | length > 0
    fail_msg: "serveur_openldap_admin_password est requis (a fournir via Ansible Vault)."

- name: Preconfigurer slapd (debconf)
  ansible.builtin.debconf:
    name: slapd
    question: "{{ item.question }}"
    vtype: "{{ item.vtype }}"
    value: "{{ item.value }}"
  loop:
    - { question: "slapd/no_configuration", vtype: "boolean", value: "false" }
    - { question: "slapd/domain", vtype: "string", value: "{{ serveur_openldap_domaine }}" }
    - { question: "shared/organization", vtype: "string", value: "{{ serveur_openldap_organisation }}" }
    - { question: "slapd/backend", vtype: "select", value: "MDB" }
    - { question: "slapd/purge_database", vtype: "boolean", value: "true" }
    - { question: "slapd/move_old_database", vtype: "boolean", value: "true" }
    - { question: "slapd/allow_ldap_v2", vtype: "boolean", value: "false" }
  loop_control:
    label: "{{ item.question }}"

- name: Preconfigurer le mot de passe admin slapd (debconf)
  ansible.builtin.debconf:
    name: slapd
    question: "{{ item }}"
    vtype: password
    value: "{{ serveur_openldap_admin_password }}"
  loop:
    - slapd/password1
    - slapd/password2
  no_log: true

- name: Installer OpenLDAP
  ansible.builtin.apt:
    name: "{{ serveur_openldap_paquets }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Activer et demarrer slapd
  ansible.builtin.systemd:
    name: "{{ serveur_openldap_service }}"
    enabled: true
    state: started

- name: Creer les unites organisationnelles de base
  community.general.ldap_entry:
    dn: "ou={{ item }},{{ serveur_openldap_base_dn }}"
    objectClass: organizationalUnit
    server_uri: "ldapi:///"
    bind_dn: "{{ serveur_openldap_admin_dn }}"
    bind_pw: "{{ serveur_openldap_admin_password }}"
  loop: "{{ serveur_openldap_ou }}"
  loop_control:
    label: "ou={{ item }}"
  no_log: true