From 0bbd6c43ffca9bc6c8eaeebe4bc03027c5cd9263 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Tue, 23 Jun 2026 11:15:00 +0200
Subject: [PATCH] fix(postgres): pin provider context on 02_init for
 nested/looped consumers

svc-db-postgres 02_init.yml asserts application_id == 'svc-db-postgres' AND database_consumer_id \!= 'svc-db-postgres'. When 01_core is skipped (run-once), the include_role application_id var does not reliably reach 02_init through a consumer's nested looped include (web-app-matrix's per-bridge DB seeding), so the assert fails. Pin application_id on the 02_init include so it holds for any caller. On the matrix side, freeze the consumer id eagerly before the provider include so database_consumer_id stays the matrix consumer instead of lazily resolving to svc-db-postgres once application_id is pinned.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 roles/svc-db-postgres/tasks/main.yml          |  2 ++
 .../compose/02_create-and-seed-database.yml   | 22 +++++++++++++------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/roles/svc-db-postgres/tasks/main.yml b/roles/svc-db-postgres/tasks/main.yml
index 59441409b5..c8457b6b5a 100644
--- a/roles/svc-db-postgres/tasks/main.yml
+++ b/roles/svc-db-postgres/tasks/main.yml
@@ -12,3 +12,5 @@
 - name: "Initialize dedicated database"
   include_tasks: 02_init.yml
   when: database_init | bool
+  vars:
+    application_id: svc-db-postgres
diff --git a/roles/web-app-matrix/tasks/flavor/compose/02_create-and-seed-database.yml b/roles/web-app-matrix/tasks/flavor/compose/02_create-and-seed-database.yml
index 114affa384..4f486003c3 100644
--- a/roles/web-app-matrix/tasks/flavor/compose/02_create-and-seed-database.yml
+++ b/roles/web-app-matrix/tasks/flavor/compose/02_create-and-seed-database.yml
@@ -4,21 +4,29 @@
 # - database_username
 # - database_password
 
+- name: "Freeze database consumer id + provider role before provider include"
+  ansible.builtin.set_fact:
+    _matrix_db_consumer_id: "{{ application_id }}"
+    _matrix_db_provider_role: "{{ lookup('database', application_id, 'id') }}"
+  changed_when: false
+
 - name: "Create DB/user for '{{ database_name }}' in central DB"
   include_role:
-    name: "{{ lookup('database', application_id, 'id') }}"
+    name: "{{ _matrix_db_provider_role }}"
+    public: false
   vars:
     database_init: true
-    database_consumer_id: "{{ application_id }}"
-    database_type: "{{ lookup('database', application_id, 'type') }}"
-  when: lookup('database', application_id, 'shared') | bool
+    compose_repository_pull: false
+    database_consumer_id: "{{ _matrix_db_consumer_id }}"
+    database_type: "{{ lookup('database', _matrix_db_consumer_id, 'type') }}"
+  when: lookup('database', _matrix_db_consumer_id, 'shared') | bool
 
 - name: "Seed database entry to backup routine"
   include_tasks: "{{ playbook_dir }}/roles/svc-bkp-container-2-local/tasks/04_seed-database-to-backup.yml"
   vars:
-    database_consumer_id: "{{ application_id }}"
-    database_type: "{{ lookup('database', application_id, 'type') }}"
-    database_instance: "{{ lookup('database', application_id, 'instance') }}"
+    database_consumer_id: "{{ _matrix_db_consumer_id }}"
+    database_type: "{{ lookup('database', _matrix_db_consumer_id, 'type') }}"
+    database_instance: "{{ lookup('database', _matrix_db_consumer_id, 'instance') }}"
     database_host: "{{ MATRIX_POSTGRES_HOST }}"
     database_port: "{{ MATRIX_POSTGRES_PORT }}"
     database_name: "{{ database_name }}"