fix(svc-db): keep elasticsearch, rabbitmq and redis credentials off argv

- elasticsearch: the consumer user's payload carries its password and went
  into curl's -d on the exec line; curl now reads it as --data-binary @-
  from the task's stdin through ELASTICSEARCH_EXEC_SHELL_STDIN.
- rabbitmq: add_user and change_password take only the username and read
  the password from stdin (rabbitmqctl's infer_password, present since
  4.0.0); the RMQ_PW environment variable is gone.
- redis: the healthcheck rendered `redis-cli -a <password>`; it now
  authenticates with REDISCLI_AUTH from the container's own
  REDIS_PASSWORD and is declared in meta/services.yml through the
  container_healthcheck SPOT with unchanged timings. Administration.md
  stops expanding the password in the operator's host shell.

Refs #1213.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/svc-db-elasticsearch/tasks/01_init.yml

@@ -61,12 +61,14 @@
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: "📁 Create user '{{ elasticsearch_consumer_username }}' bound to its index role"
-  ansible.builtin.shell: >
-    {{ ELASTICSEARCH_EXEC_SHELL }}
-    '{{ 30 | curl }} -fS -u "elastic:$ELASTIC_PW"
-    -X PUT "{{ ELASTICSEARCH_API_BASE }}/_security/user/{{ elasticsearch_consumer_username }}"
-    -H "Content-Type: application/json"
-    -d {{ es_user_payload | to_json | quote }}'
+  ansible.builtin.shell:
+    cmd: >
+      {{ ELASTICSEARCH_EXEC_SHELL_STDIN }}
+      '{{ 30 | curl }} -fS -u "elastic:$ELASTIC_PW"
+      -X PUT "{{ ELASTICSEARCH_API_BASE }}/_security/user/{{ elasticsearch_consumer_username }}"
+      -H "Content-Type: application/json"
+      --data-binary @-'
+    stdin: "{{ es_user_payload | to_json }}"
   environment:
     ELASTIC_PW: "{{ ELASTICSEARCH_PASSWORD }}"
   register: es_user_result

roles/svc-db-elasticsearch/vars/main.yml

@@ -15,3 +15,4 @@ ELASTICSEARCH_RETRIES: 5
 ELASTICSEARCH_DELAY: 2
 ELASTICSEARCH_API_BASE: "http://{{ ELASTICSEARCH_LOCAL_HOST }}:{{ ELASTICSEARCH_INTERNAL_PORT }}"
 ELASTICSEARCH_EXEC_SHELL: "container exec -e ELASTIC_PW {{ ELASTICSEARCH_CONTAINER_ADDRESS }} sh -lc"
+ELASTICSEARCH_EXEC_SHELL_STDIN: "container exec -i -e ELASTIC_PW {{ ELASTICSEARCH_CONTAINER_ADDRESS }} sh -lc"

roles/svc-db-rabbitmq/tasks/01_init.yml

@@ -57,11 +57,11 @@
   until: rmq_users.rc == 0
 
 - name: "📁 Create user: {{ rabbitmq_consumer_username }}"
-  ansible.builtin.shell: >
-    container exec -e RMQ_PW {{ RABBITMQ_CONTAINER_ADDRESS }} sh -lc
-    'rabbitmqctl -q add_user {{ rabbitmq_consumer_username | quote }} "$RMQ_PW"'
-  environment:
-    RMQ_PW: "{{ rabbitmq_consumer_password }}"
+  ansible.builtin.shell:
+    cmd: >
+      container exec -i {{ RABBITMQ_CONTAINER_ADDRESS }} sh -lc
+      'rabbitmqctl -q add_user {{ rabbitmq_consumer_username | quote }}'
+    stdin: "{{ rabbitmq_consumer_password }}"
   register: rmq_add_user
   changed_when: rmq_add_user.rc == 0
   retries: "{{ RABBITMQ_RETRIES }}"
@@ -71,11 +71,11 @@
   when: rabbitmq_consumer_username not in (rmq_users.stdout | from_json | map(attribute='user') | list)
 
 - name: "✅ Ensure user password matches inventory: {{ rabbitmq_consumer_username }}"
-  ansible.builtin.shell: >
-    container exec -e RMQ_PW {{ RABBITMQ_CONTAINER_ADDRESS }} sh -lc
-    'rabbitmqctl -q change_password {{ rabbitmq_consumer_username | quote }} "$RMQ_PW"'
-  environment:
-    RMQ_PW: "{{ rabbitmq_consumer_password }}"
+  ansible.builtin.shell:
+    cmd: >
+      container exec -i {{ RABBITMQ_CONTAINER_ADDRESS }} sh -lc
+      'rabbitmqctl -q change_password {{ rabbitmq_consumer_username | quote }}'
+    stdin: "{{ rabbitmq_consumer_password }}"
   register: rmq_change_password
   changed_when: false
   retries: "{{ RABBITMQ_RETRIES }}"

roles/svc-db-redis/Administration.md

@@ -6,13 +6,13 @@ To administer the central Redis instance via the `default` user, execute the fol
 
 ```bash
 # Assuming the container name is redis
-docker exec -it redis redis-cli -a "$REDIS_PASSWORD" --no-auth-warning
+docker exec -it redis sh -c 'REDISCLI_AUTH="$REDIS_PASSWORD" exec redis-cli'
 ```
 
 ## Inspect a consumer ACL user
 
 ```bash
-docker exec -it redis redis-cli -a "$REDIS_PASSWORD" --no-auth-warning ACL GETUSER <entity>
+docker exec -it redis sh -c 'REDISCLI_AUTH="$REDIS_PASSWORD" exec redis-cli ACL GETUSER <entity>'
 ```
 
 A consumer user named `<entity>` is restricted to keys matching `<entity>:*`.

roles/svc-db-redis/meta/services.yml

@@ -14,6 +14,9 @@ redis:
   name: redis-central
   version: 8.10.2-alpine
   min_storage: 238MB
+  healthcheck:
+    test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep -q PONG"]
+    retries: 30
   backup:
     disabled: true
   cpus: "0.5"

roles/svc-db-redis/templates/compose.yml.j2

@@ -17,13 +17,7 @@
     {% if REDIS_EXPOSE_LOCAL %}
     {{ lookup('container_ports', ['redis', 'redis', DOCKER_BIND_HOST]) | indent(4) }}
     {% endif %}
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli -a {{ REDIS_PASSWORD | quote }} --no-auth-warning ping | grep -q PONG"]
-      interval: 2m
-      timeout: 5s
-      retries: 30
-      start_period: 10m
-      start_interval: 5s
+    {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_volumes', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}