diff --git a/group_vars/ldap_server.yml b/group_vars/ldap_server.yml
index 8818e0c13f70ce36ed1a898714fb397006da5a2c..7a52a6cab85d4f8a6edbcb9767771a0e715389d3 100644
--- a/group_vars/ldap_server.yml
+++ b/group_vars/ldap_server.yml
@@ -1,7 +1,8 @@
 ---
 
 glob_slapd:
-  master_ip: 172.16.10.1
+  master_ip: "{{ query('ldap', 'ipv4', 'tealc', 'adm') | first }}"
+  regex: "^(role:(dhcp|dns|dns-primary|dns-secondary|ftp|gitlab|miroir|ntp|pve|radius|backup)|ecdsa-sha2-nistp256:.*|ssh-(ed25519|dss|rsa):.*)$"
   replication_credentials: "{{ vault_ldap_replication_credentials }}"
   private_key: "{{ vault_ldap_private_key }}"
   certificate: "{{ vault_ldap_certificate }}"
diff --git a/host_vars/daniel.adm.crans.org.yml b/host_vars/daniel.adm.crans.org.yml
index 139b9bd18d048ce5708bf3b6c6a7a7e8875fd72f..6152f24cd27e766e6362e1280fca8644142ee3e4 100644
--- a/host_vars/daniel.adm.crans.org.yml
+++ b/host_vars/daniel.adm.crans.org.yml
@@ -1,5 +1,5 @@
 ---
 loc_slapd:
-  ip: 172.16.10.12
+  ip: "{{ query('ldap', 'ipv4', 'daniel', 'adm') | first }}"
   replica: true
   replica_rid: 2
diff --git a/host_vars/jack.adm.crans.org.yml b/host_vars/jack.adm.crans.org.yml
index 70c60054011cd428318f7397e7e73b185db6d5a9..896420ab4c16a6d9d595664c07e29c0cba0a02ea 100644
--- a/host_vars/jack.adm.crans.org.yml
+++ b/host_vars/jack.adm.crans.org.yml
@@ -1,5 +1,5 @@
 ---
 loc_slapd:
-  ip: 172.16.10.13
+  ip: "{{ query('ldap', 'ipv4', 'jack', 'adm') | first }}"
   replica: true
   replica_rid: 3
diff --git a/host_vars/sam.adm.crans.org.yml b/host_vars/sam.adm.crans.org.yml
index 9ed74927b90b31aebb7ae2d2f97dfb6fa230d8e7..ce52d174280dd8955f5e48bc2edf34350ada09de 100644
--- a/host_vars/sam.adm.crans.org.yml
+++ b/host_vars/sam.adm.crans.org.yml
@@ -1,5 +1,5 @@
 ---
 loc_slapd:
-  ip: 172.16.10.11
+  ip: "{{ query('ldap', 'ipv4', 'sam', 'adm') | first }}"
   replica: true
   replica_rid: 1
diff --git a/host_vars/sputnik.adm.crans.org b/host_vars/sputnik.adm.crans.org
new file mode 100644
index 0000000000000000000000000000000000000000..04c45b94e5bf099f7bd4c35094e845705d6ce139
--- /dev/null
+++ b/host_vars/sputnik.adm.crans.org
@@ -0,0 +1,5 @@
+---
+loc_slapd:
+  ip: "{{ query('ldap', 'ipv4', 'sputnik', 'adm') | first }}"
+  replica: true
+  replica_rid: 4
diff --git a/hosts b/hosts
index 955acc430ac07e3fab2e47c238de15ae6cfb4cfa..bc7e7eac4874818032c61ec7d294ee2dd3980903 100644
--- a/hosts
+++ b/hosts
@@ -66,6 +66,7 @@ tealc.adm.crans.org
 sam.adm.crans.org
 daniel.adm.crans.org
 jack.adm.crans.org
+sputnik.adm.crans.org
 
 [linx]
 linx.adm.crans.org
diff --git a/ldap.yml b/ldap.yml
deleted file mode 100755
index 5a4d03f4dd019c53736c7fe242d4ffa2967ec9b0..0000000000000000000000000000000000000000
--- a/ldap.yml
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env ansible-playbook
----
-- hosts: daniel
-  roles:
-    - slapd
diff --git a/lookup_plugins/ldap.py b/lookup_plugins/ldap.py
index 3a77bfb34d1a09fc39576bc315f440e399b08eab..838c67b4a9c56a19fbfe60e315107688328d6333 100644
--- a/lookup_plugins/ldap.py
+++ b/lookup_plugins/ldap.py
@@ -60,6 +60,21 @@ class LookupModule(LookupBase):
         result = [res.decode('utf-8') for res in result['ipHostNumber']]
         return result
 
+    def ipv4(self, host, vlan):
+        if isinstance(vlan, int):
+            network_query_id = self.base.search(f"ou=networks,{self.base_dn}", ldap.SCOPE_ONELEVEL, f"description={vlan}")
+            network_result = self.base.result(network_query_id)
+            vlan = network_result[1][0][1]['cn'][0].decode('utf-8')
+        if vlan == 'srv':
+            query_id = self.base.search(f"cn={host}.crans.org,cn={host},ou=hosts,{self.base_dn}", ldap.SCOPE_BASE)
+        else:
+            query_id = self.base.search(f"cn={host}.{vlan}.crans.org,cn={host},ou=hosts,{self.base_dn}", ldap.SCOPE_BASE)
+        result = self.base.result(query_id)
+        result = result[1][0][1]
+        result = [res.decode('utf-8') for res in result['ipHostNumber']]
+        result = [ res for res in result if type(ipaddress.ip_address(res)) is ipaddress.IPv4Address ]
+        return result
+
     def all_ip(self, host):
         """
         Retrieve all IP addresses of a device
@@ -141,6 +156,8 @@ class LookupModule(LookupBase):
             result = self.query(*terms[1:])
         elif terms[0] == 'ip':
             result = self.ip(*terms[1:])
+        elif terms[0] == 'ipv4':
+            result = self.ipv4(*terms[1:])
         elif terms[0] == 'all_ip':
             result = self.all_ip(*terms[1:])
         elif terms[0] == 'cn':
diff --git a/plays/root.yml b/plays/root.yml
index 39df32973c425b1174def8a2e355dea5b32dae4e..7c3dee2f68a37ddc9c653e049976bee923b0e0fc 100755
--- a/plays/root.yml
+++ b/plays/root.yml
@@ -48,11 +48,7 @@
     - qemu-guest-agent
     - serial-tty
 
-- hosts: ldap_server
-  vars:
-    slapd: '{{ glob_slapd | combine(loc_slapd | default({})) }}'
-  roles:
-    - slapd
+- import_playbook: slapd.yml
 
 - hosts: server
   vars:
diff --git a/plays/slapd.yml b/plays/slapd.yml
new file mode 100755
index 0000000000000000000000000000000000000000..60b55e61d2b574287ca383f4863f26fd58d742f8
--- /dev/null
+++ b/plays/slapd.yml
@@ -0,0 +1,7 @@
+#!/usr/bin/env ansible-playbook
+---
+- hosts: ldap_server
+  vars:
+    slapd: '{{ glob_slapd | default({}) | combine(loc_slapd | default({})) }}'
+  roles:
+    - slapd
diff --git a/roles/slapd/templates/ldap/slapd.conf.j2 b/roles/slapd/templates/ldap/slapd.conf.j2
index ab870c2628e650177ba5bb869e9faea5fa65248e..6680b9eeb97224872b26d0d04ef5e5821e8335bc 100644
--- a/roles/slapd/templates/ldap/slapd.conf.j2
+++ b/roles/slapd/templates/ldap/slapd.conf.j2
@@ -31,7 +31,7 @@ auditlog 		/var/log/openldap/auditlog.log
 
 moduleload constraint
 overlay constraint
-constraint_attribute description regex ^(dhcp|dns|dns-primary|dns-secondary|ftp|gitlab|miroir|ntp|pve|radius)$
+constraint_attribute description regex {{ slapd.regex }}
   restrict=ldap:///ou=hosts,dc=crans,dc=org??one?(objectClass=device)
 constraint_attribute uid regex ^_
   restrict=ldap:///ou=passwd,dc=crans,dc=org??one?(objectClass=posixAccount)