#!/bin/sh
# Builds a fresh directory on every container start, so recreating the
# container (`docker compose up -d --force-recreate ldap`) resets all data.
set -eu

CONF=/etc/openldap/slapd.d
DATA=/var/lib/openldap/openldap-data

rm -rf "${CONF:?}"/* "${DATA:?}"/*

ADMIN_PW_HASH=$(slappasswd -s "${LDAP_ADMIN_PASSWORD:-admin}")

# cn=config: modules, schemas, database, ACLs
sed "s|@ADMIN_PW_HASH@|${ADMIN_PW_HASH}|" /bootstrap/config.ldif > /tmp/config.ldif
slapadd -n 0 -F "$CONF" -l /tmp/config.ldif
slapadd -n 0 -F "$CONF" -l /bootstrap/openssh-lpk.ldif

# Directory tree and seed users
slapadd -n 1 -F "$CONF" -l /bootstrap/seed.ldif

chown -R ldap:ldap "$CONF" "$DATA" /run/openldap

# slapd sizes its descriptor table by the open-file limit; under some
# runtimes (kind/containerd) that is ~10^9, and slapd is OOM-killed.
ulimit -n 4096

# -d keeps slapd in the foreground; "stats" logs every operation to stdout.
exec slapd -u ldap -g ldap -F "$CONF" -h "ldap:///" -d "${SLAPD_LOGLEVEL:-stats}"