#!/bin/bash
# Generated by igos-build/hookseal.py from the openldap recipe's
# post_install() function at build time. Do not edit inside the archive —
# edit the recipe and rebuild.
# package: openldap-2.6.12
set -e
    set -e
    # ldap user/group is declared by /usr/lib/sysusers.d/openldap.conf.
    # Process it explicitly here so the user exists before the subsequent
    # `install -o ldap -g ldap` commands resolve ownership. Idempotent;
    # safe at both BUILD VM time (chroot's live /etc/passwd) and laptop
    # install time (chroot context; pkm canonical pre-hook may have
    # already run sysusers — re-run is a no-op).
    systemd-sysusers /usr/lib/sysusers.d/openldap.conf

    # Create LDAP database directory with proper ownership. /var/lib is
    # machine state and is created here; /etc/openldap/slapd.d ships as
    # payload from do_install and only has its ownership restored, since
    # the ldap account does not exist when the archive is deployed.
    install -v -dm700 -o ldap -g ldap /var/lib/openldap
    chown -v ldap:ldap /etc/openldap/slapd.d

    # Set security permissions on config files (contain admin password in plain text)
    chmod  -v 640     /etc/openldap/slapd.{conf,ldif}   2>/dev/null || true
    chown  -v root:ldap /etc/openldap/slapd.{conf,ldif} 2>/dev/null || true
