fix(web-app-nextcloud): provision the GitLab OAuth coupling in swarm too

The gate probed the partner with container inspect on a bare name, which only resolves under compose co-location. In swarm GitLab sits on another node, the probe fails, and failed_when: false turns that into a silent skip: the deploy reports success while client_id/client_secret are never written, so the per-user Connect button leads nowhere. Nothing else writes those two values.

Mirrors integration_zammad: resolve node and container id first, wait for the partner endpoint, then run both execs against the resolved ids. Gate on IS_STACK_HOST like every other addon. The include had to become relative, or the stack-host lint cannot see the gate through a templated path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-nextcloud/tasks/addons/integration_gitlab.yml

@@ -1,17 +1,9 @@
 ---
 - name: 🔍 Resolve GitLab integration provisioning facts
   set_fact:
-    nextcloud_gl_container: "{{ lookup('config', 'web-app-gitlab', 'services.webservice.name') }}"
     nextcloud_gl_nc_base_url: "{{ lookup('tls', 'web-app-nextcloud', 'url.base') | regex_replace('/$', '') }}"
   changed_when: false
 
-- name: 🔍 Probe whether the GitLab partner container is running
-  command: > # nocheck: container-exec-resolver  this IS the bare-name partner probe gate, compose co-location
-    container inspect --type container -f '{% raw %}{{.State.Running}}{% endraw %}' {{ nextcloud_gl_container }}
-  register: integration_gitlab_partner_running
-  changed_when: false
-  failed_when: false
-
 - name: 📖 Read persisted integration_gitlab OAuth client id
   shell: >
     {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:get integration_gitlab client_id
@@ -28,9 +20,9 @@
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: 🔧 Provision the GitLab <-> Nextcloud OAuth coupling
-  include_tasks: "{{ [role_path, 'tasks/addons/integration_gitlab_provision.yml'] | path_join }}"
+  include_tasks: integration_gitlab_provision.yml
   when: >-
-    (integration_gitlab_partner_running.stdout | trim) == 'true'
+    IS_STACK_HOST | bool
     and (
       (nextcloud_gl_client_id_current.stdout | trim) | length == 0
       or (nextcloud_gl_client_secret_current.stdout | trim) | length == 0

roles/web-app-nextcloud/tasks/addons/integration_gitlab_provision.yml

@@ -1,23 +1,32 @@
 ---
+- name: "🔍 Resolve GitLab webservice hosting node + container id"
+  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
+  vars:
+    resolve_service_key: webservice
+    resolve_service_name: "{{ lookup('container_service', 'web-app-gitlab', 'webservice') }}"
+    resolve_output_prefix: NEXTCLOUD_GITLAB
+    resolve_compose_cid: "{{ NEXTCLOUD_GITLAB_CONTAINER_ADDRESS }}"
+    resolve_converge_retries: 120
+    resolve_converge_delay: 5
+
+- name: ⏳ Wait for the GitLab web endpoint
+  wait_for:
+    host: "{{ lookup('domain', 'web-app-gitlab') }}"
+    port: 80
+    delay: 5
+    timeout: "{{ lookup('timeout', 600) | int }}"
+
 - name: 🔧 Provision the GitLab OAuth application for Nextcloud and capture credentials
-  ansible.builtin.command:
-    argv:
-      - container
-      - exec
-      - -i
-      - -e
-      - "NC_BASE_URL={{ nextcloud_gl_nc_base_url }}"
-      - -e
-      - "NC_REDIRECT_PATH=/apps/integration_gitlab/oauth-redirect"
-      - -e
-      - "NC_HAS_SECRET={{ nextcloud_gl_client_secret_current.stdout | trim }}"
-      - "{{ nextcloud_gl_container }}" # nocheck: container-exec-resolver  runs only behind the bare-name partner probe gate, compose co-location
-      - /srv/gitlab/bin/rails
-      - runner
-      - -e
-      - production
-      - "-"
+  ansible.builtin.shell:
+    cmd: >-
+      container exec -i
+      -e 'NC_BASE_URL={{ nextcloud_gl_nc_base_url }}'
+      -e 'NC_REDIRECT_PATH=/apps/integration_gitlab/oauth-redirect'
+      -e 'NC_HAS_SECRET={{ nextcloud_gl_client_secret_current.stdout | trim }}'
+      {{ NEXTCLOUD_GITLAB_LOCAL_CID | quote }}
+      /srv/gitlab/bin/rails runner -e production -
     stdin: "{{ lookup('file', 'gitlab/provision_oauth_app.rb') }}"
+  delegate_to: "{{ NEXTCLOUD_GITLAB_HOST_NODE }}"
   register: nextcloud_gl_provision
   changed_when: "'CLIENT_ID=' in nextcloud_gl_provision.stdout"
   retries: 12
@@ -53,19 +62,13 @@
       integration_gitlab client_id/client_secret app config to re-provision.
 
 - name: 🔐 Store integration_gitlab OAuth credentials Nextcloud-encrypted (ICrypto, lazy)
-  ansible.builtin.command:
-    argv:
-      - container
-      - exec
-      - -i
-      - -u
-      - "{{ NEXTCLOUD_DOCKER_USER }}"
-      - -e
-      - "NC_APP_ID=integration_gitlab"
-      - -e
-      - "NC_ENC_B64={{ {'client_id': nextcloud_gl_client_id, 'client_secret': nextcloud_gl_client_secret} | to_json | b64encode }}"
-      - "{{ NEXTCLOUD_CONTAINER }}" # nocheck: container-exec-resolver  runs only behind the bare-name partner probe gate, compose co-location
-      - php
+  ansible.builtin.shell:
+    cmd: >-
+      container exec -i -u {{ NEXTCLOUD_DOCKER_USER }}
+      -e 'NC_APP_ID=integration_gitlab'
+      -e 'NC_ENC_B64={{ {'client_id': nextcloud_gl_client_id, 'client_secret': nextcloud_gl_client_secret} | to_json | b64encode }}'
+      {{ NEXTCLOUD_LOCAL_CID | quote }}
+      php
     stdin: "{{ lookup('file', 'set_encrypted_appconfig.php') }}"
   register: nextcloud_gl_enc_set
   changed_when: "'OK' in nextcloud_gl_enc_set.stdout"

roles/web-app-nextcloud/vars/main.yml

@@ -42,6 +42,7 @@ NEXTCLOUD_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, NEX
 
 NEXTCLOUD_OPENPROJECT_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-openproject', 'web') }}"
 NEXTCLOUD_ZAMMAD_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-zammad', 'railsserver') }}"
+NEXTCLOUD_GITLAB_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-gitlab', 'webservice') }}"
 
 NEXTCLOUD_PROXY_SERVICE: "proxy"
 NEXTCLOUD_PROXY_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_PROXY_SERVICE ~ '.name') }}"