net/389-ds-base: Fix instance creation

Add a dedicated dirsrv user and group.

Use FreeBSD-compatible paths for runtime files, databases, backups,
LDIF files, and logs.  Create the persistent database and log parent
directories with suitable permissions.

Detect getpeereid(3) during configuration and fix peer credential
handling for LDAPI SASL EXTERNAL authentication.

Sponsored by:	Netzkommune GmbH

7 files changed, 57 insertions, 2 deletions

diff --git a/GIDs b/GIDs
index 31accb8716a2..b93300ab2228 100644
--- a/GIDs
+++ b/GIDs
@@ -332,7 +332,7 @@ goimapnotify:*:387:
 autopulse:*:388:
 ldap:*:389:
 bunkerweb:*:390:
-# free: 391
+dirsrv:*:391:
 # free: 392
 # free: 393
 # free: 394
diff --git a/UIDs b/UIDs
index ddfeb2f110dd..d465e172f231 100644
--- a/UIDs
+++ b/UIDs
@@ -337,7 +337,7 @@ goimapnotify:*:387:387::0:0:Goimapnotify Daemon:/nonexistent:/usr/sbin/nologin
 autopulse:*:388:388::0:0:Autopulse Daemon:/nonexistent:/usr/sbin/nologin
 ldap:*:389:389::0:0:OpenLDAP Server:/nonexistent:/usr/sbin/nologin
 bunkerweb:*:390:390::0:0:Bunkerweb Service:/nonexistent:/usr/sbin/nologin
-# free: 391
+dirsrv:*:391:391::0:0:389 Directory Server:/usr/local/share/dirsrv:/usr/sbin/nologin
 # free: 392
 # free: 393
 # free: 394
diff --git a/net/389-ds-base/Makefile b/net/389-ds-base/Makefile
index 0b975415be01..0d4a2bfbff4d 100644
--- a/net/389-ds-base/Makefile
+++ b/net/389-ds-base/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	389-ds-base
 DISTVERSION=	3.2.1
+PORTREVISION=	1
 CATEGORIES=	net
 MASTER_SITES=	https://github.com/389ds/389-ds-base/releases/download/${PORTNAME}-${DISTVERSION}/
 
@@ -10,6 +11,9 @@ WWW=		https://www.port389.org/
 LICENSE=	GPLv3+
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
+USERS=		dirsrv
+GROUPS=		dirsrv
+
 BUILD_DEPENDS=	${LOCALBASE}/include/crypt.h:security/libxcrypt \
 		cargo:lang/rust \
 		rsync:net/rsync
@@ -41,6 +45,7 @@ CONFIGURE_ARGS=	--disable-dependency-tracking \
 		--enable-rust-offline \
 		--with-netsnmp=${LOCALBASE} \
 		--with-openldap=${LOCALBASE} \
+		--with-localrundir=/var/run \
 		--with-pythonexec=${PYTHON_CMD}
 
 MAKE_ENV=	CARGO_HOME=${WRKSRC}/.cargo \
@@ -51,4 +56,8 @@ LIBS+=		-lexecinfo
 
 BINARY_ALIAS=	python3=${PYTHON_CMD}
 
+post-install:
+	${MKDIR} ${STAGEDIR}/var/db/dirsrv \
+		${STAGEDIR}/var/log/dirsrv
+
 .include <bsd.port.mk>
diff --git a/net/389-ds-base/files/patch-configure.ac b/net/389-ds-base/files/patch-configure.ac
new file mode 100644
index 000000000000..d337c5dcae75
--- /dev/null
+++ b/net/389-ds-base/files/patch-configure.ac
@@ -0,0 +1,11 @@
+--- configure.ac.orig	2026-06-29 19:19:58 UTC
++++ configure.ac
+@@ -811,6 +811,8 @@ esac
+ # gcc -march=native -dM -E - < /dev/null | grep SSE
+ # We can just use the define in GCC instead!
+ 
++AC_CHECK_FUNCS([getpeereid])
++
+ AC_MSG_CHECKING([for GCC provided 64-bit atomic operations])
+ AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+     #include <inttypes.h>
diff --git a/net/389-ds-base/files/patch-ldap_admin_src_defaults.inf.in b/net/389-ds-base/files/patch-ldap_admin_src_defaults.inf.in
new file mode 100644
index 000000000000..1b0fb1408349
--- /dev/null
+++ b/net/389-ds-base/files/patch-ldap_admin_src_defaults.inf.in
@@ -0,0 +1,22 @@
+--- ldap/admin/src/defaults.inf.in.orig	2026-06-29 16:38:28 UTC
++++ ldap/admin/src/defaults.inf.in
+@@ -53,14 +53,14 @@ cert_dir = @instconfigdir@/slapd-{instance_name}
+ schema_dir = @instconfigdir@/slapd-{instance_name}/schema
+ cert_dir = @instconfigdir@/slapd-{instance_name}
+ 
+-lock_dir = @localrundir@/lock/dirsrv/slapd-{instance_name}
++lock_dir = @localrundir@/dirsrv/slapd-{instance_name}
+ log_dir = @localstatedir@/log/dirsrv/slapd-{instance_name}
+ access_log = @localstatedir@/log/dirsrv/slapd-{instance_name}/access
+ audit_log = @localstatedir@/log/dirsrv/slapd-{instance_name}/audit
+ error_log = @localstatedir@/log/dirsrv/slapd-{instance_name}/errors
+ security_log = @localstatedir@/log/dirsrv/slapd-{instance_name}/security
+-db_dir = @localstatedir@/lib/dirsrv/slapd-{instance_name}/db
+-db_home_dir = /dev/shm/slapd-{instance_name}
+-backup_dir = @localstatedir@/lib/dirsrv/slapd-{instance_name}/bak
+-ldif_dir = @localstatedir@/lib/dirsrv/slapd-{instance_name}/ldif
++db_dir = @localstatedir@/db/dirsrv/slapd-{instance_name}/db
++db_home_dir = @localstatedir@/db/dirsrv/slapd-{instance_name}/db
++backup_dir = @localstatedir@/db/dirsrv/slapd-{instance_name}/bak
++ldif_dir = @localstatedir@/db/dirsrv/slapd-{instance_name}/ldif
+ 
diff --git a/net/389-ds-base/files/patch-ldap_servers_slapd_getsocketpeer.c b/net/389-ds-base/files/patch-ldap_servers_slapd_getsocketpeer.c
new file mode 100644
index 000000000000..e2ea7171ceca
--- /dev/null
+++ b/net/389-ds-base/files/patch-ldap_servers_slapd_getsocketpeer.c
@@ -0,0 +1,11 @@
+--- ldap/servers/slapd/getsocketpeer.c.orig	2026-06-29 19:19:59 UTC
++++ ldap/servers/slapd/getsocketpeer.c
+@@ -77,7 +77,7 @@ slapd_get_socket_peer(PRFileDesc *nspr_fd, uid_t *uid,
+ 
+ #elif defined(HAVE_GETPEEREID) /* osx / some BSDs */
+ 
+-    if (0 == getpeereid(fd, &uid, &gid))
++    if (0 == getpeereid(fd, uid, gid))
+         ret = 0;
+ 
+ #else /* hpux / Solaris9 / some BSDs - file descriptor cooperative auth */
diff --git a/net/389-ds-base/pkg-plist b/net/389-ds-base/pkg-plist
index e1305c4897b6..c2c94149ab34 100644
--- a/net/389-ds-base/pkg-plist
+++ b/net/389-ds-base/pkg-plist
@@ -176,3 +176,5 @@ share/man/man5/dirsrv.systemd.5.gz
 share/man/man5/slapd-collations.conf.5.gz
 share/man/man8/ns-slapd.8.gz
 share/metainfo/389-console/org.port389.cockpit_console.metainfo.xml
+@dir(root,wheel,0755) /var/db/dirsrv
+@dir(root,wheel,0755) /var/log/dirsrv