fix(nextcloud): realign the administrator password when the declared one changes

Nextcloud seeds the administrator once, at install time, from NEXTCLOUD_ADMIN_USER
and NEXTCLOUD_ADMIN_PASSWORD in the environment file, and no later run touches the
account again. A rotated credential therefore leaves the instance authenticating
against the old secret while every task in the role still reports success -- which
is exactly what the CI proves against, rotating every inventory credential between
the sync and the async pass.

The reset runs only when the declared password differs from the one this script
last applied, compared through a sha256 marker kept in the config volume. An
unconditional reset would have worked too, but it reports changed on every single
run and turns a rotation check into noise. The marker's cost is stated in the
script header: a password changed outside this script is not noticed.

The comparison cannot be an authentication probe. Nextcloud has no occ command
that verifies a password, and the HTTP endpoints that would are not reachable from
inside an fpm image, where no web server listens in the same container.

OC_PASS reaches occ through the environment and never through an argument, so the
secret stays out of the process list on both the host and the container, the same
way dc32574873 took the redis password off the exec command line.

The account this touches is the local administrator. The LDAP resolution in
07_admin_identities.yml only collects additional identities for the same person,
and the MCP service account reset added in e3caa074b2 targets a different user.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-nextcloud/files/shell/realign_admin_password.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage:
+#   realign_admin_password.sh <container> <run_as_user> <admin_username> <occ_path>
+#   OC_PASS: the declared password, read from the environment only.
+#
+# Exit: 0 with [CHANGED] or [UNCHANGED] on stdout, 1 with [FAIL] on stderr.
+#
+# Exception: staleness is detected against a marker of the password this script
+# last wrote, not against the account, so a password changed outside this script
+# is not noticed until the declared one changes too.
+
+container="${1:-}"
+run_as="${2:-}"
+admin_user="${3:-}"
+occ="${4:-}"
+
+if [[ -z "$container" || -z "$run_as" || -z "$admin_user" || -z "$occ" ]]; then
+  echo "Usage: $0 <container> <run_as_user> <admin_username> <occ_path>" >&2
+  exit 2
+fi
+
+if [[ -z "${OC_PASS:-}" ]]; then
+  echo "[FAIL] OC_PASS is empty; refusing to set an empty administrator password." >&2
+  exit 1
+fi
+
+marker="/var/www/html/config/.admin_password_sha256"
+declared_sha="$(printf '%s' "$OC_PASS" | sha256sum | cut -d' ' -f1)"
+
+current_sha="$(container exec -u "$run_as" "$container" \
+  sh -c "cat '$marker' 2>/dev/null || true")"
+
+if [[ "$current_sha" == "$declared_sha" ]]; then
+  echo "[UNCHANGED] Administrator password already matches the declared one."
+  exit 0
+fi
+
+if ! container exec -u "$run_as" -e "OC_PASS=$OC_PASS" "$container" \
+  php "$occ" user:resetpassword --password-from-env "$admin_user" >/dev/null; then
+  echo "[FAIL] occ user:resetpassword failed for '$admin_user'." >&2
+  exit 1
+fi
+
+if ! container exec -u "$run_as" -e "SHA=$declared_sha" "$container" \
+  sh -c "printf '%s' \"\$SHA\" > '$marker'"; then
+  echo "[FAIL] Password was reset but the marker could not be written." >&2
+  exit 1
+fi
+
+echo "[CHANGED] Administrator password did not match the declared one, and does now."

roles/web-app-nextcloud/tasks/02_manager_ops/04_admin.yml

@@ -1,4 +1,20 @@
 ---
+- name: "🔑 Realign the administrator password with the declared one"
+  ansible.builtin.script: > # nocheck: container-exec-resolver  NEXTCLOUD_LOCAL_CID resolved at delegate_to runtime
+    {{ lookup('path_absolute', 'roles/web-app-nextcloud/files/shell/realign_admin_password.sh') }}
+    {{ NEXTCLOUD_LOCAL_CID | quote }}
+    {{ NEXTCLOUD_DOCKER_USER | quote }}
+    {{ NEXTCLOUD_ADMINISTRATOR_USERNAME | quote }}
+    {{ NEXTCLOUD_INTERNAL_OCC_COMMAND | quote }}
+  environment:
+    OC_PASS: "{{ NEXTCLOUD_ADMINISTRATOR_PASSWORD }}"
+  register: _nextcloud_admin_password
+  changed_when: _nextcloud_admin_password.stdout is search('\[CHANGED\]')
+  failed_when: >-
+    _nextcloud_admin_password.rc != 0
+    or _nextcloud_admin_password.stdout is search('\[FAIL\]')
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
 - name: ✅ Ensure Nextcloud administrator is in the 'admin' group
   shell: >
     {{ NEXTCLOUD_DOCKER_EXEC }}