# Global config:
dn: cn=config
objectClass: olcGlobal
cn: config
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
olcPidFile: /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
olcArgsFile: /var/run/slapd/slapd.args
# Read slapd.conf(5) for possible values
olcLogLevel: none
# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
olcToolThreads: 1
olcTLSCACertificateFile: /etc/ssl/certs/slapd-ca.crt
olcTLSCertificateFile: /etc/ssl/certs/slapd-server.crt
olcTLSCertificateKeyFile: /etc/ssl/certs/slapd-server.key
olcLocalSSF: 128
olcSecurity: ssf=128
olcSizeLimit: unlimited
olcAuthzRegexp: uid=([^,]*),cn=gssapi,cn=auth ldap:///ou=People,<%= @suffix %>??one?(uid=$1)

dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
# The maximum number of entries that is returned for a search operation
olcSizeLimit: unlimited
# Allow unlimited access to local connection from the local root user
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to dn.base="cn=subschema" by * read

# Config db settings
dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
# Allow unlimited access to local connection from the local root user
olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break

# Load schemas
<%= @schemas %>

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}back_mdb
olcModuleLoad: {1}dynlist
olcModuleLoad: {2}unique
olcModuleLoad: {3}ppolicy
olcModuleLoad: {4}syncprov
olcModuleLoad: {5}memberof
olcModuleLoad: {6}valsort
olcModuleLoad: {7}auditlog
olcModuleLoad: {8}refint
olcModuleLoad: {9}constraint
olcModuleLoad: {10}accesslog
olcModuleLoad: {11}deref
olcModuleLoad: {12}lastbind

dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: <%= @suffix %>
olcRootDN: uid=admin,<%= @suffix %>
olcLastMod: TRUE
olcDbCheckpoint: 64 5
olcDbMaxReaders: 4096
olcDbMaxSize: 40000000000
olcDbIndex: cn eq,sub
olcDbIndex: creatorsName eq
olcDbIndex: displayName sub
olcDbIndex: entryCSN eq
olcDbIndex: gidNumber eq
olcDbIndex: givenName sub
olcDbIndex: homeDirectory eq
olcDbIndex: krbPrincipalName eq
olcDbIndex: member eq
olcDbIndex: memberUid eq
olcDbIndex: objectClass eq
olcDbIndex: puavoAdminOfSchool eq
olcDbIndex: puavoDevicePrimaryUser eq
olcDbIndex: puavoDeviceType eq
olcDbIndex: puavoEduGroupType eq
olcDbIndex: puavoEduPersonAffiliation eq
olcDbIndex: puavoExternalId eq
olcDbIndex: puavoHostname eq
olcDbIndex: puavoId eq
olcDbIndex: puavoPrinterQueue eq
olcDbIndex: puavoSchoolAdmin eq
olcDbIndex: puavoSchool eq
olcDbIndex: puavoServiceDomain eq
olcDbIndex: puavoWirelessPrinterQueue eq
olcDbIndex: sn sub
olcDbIndex: uid eq,sub
olcSyncRepl: rid=001 provider="ldap://<%= @master_server %>" binddn="<%= @binddn %>" bindmethod=simple credentials="<%= @bindpw %>" searchbase="<%= @suffix %>" type=refreshAndPersist interval=00:00:00:05 retry="15 +" timeout=30 starttls=critical tls_cacert=/etc/puavo-conf/rootca.pem schemachecking=off scope=sub
olcUpdateRef: ldap://<%= @master_server %>
<%= @acls %>
