refactor(handlers): bind notify to a listen topic, not to a name

A handler name was doing two jobs at once: the line an operator reads in the
play output, and the identifier a `notify:` binds to. The two pull in opposite
directions -- the log wants "restart the SSH service, with diagnostics", the
binding wants a token that survives quoting, YAML flow style and a shell
round-trip -- and a name that changes for readability silently changes which
handler runs.

Every handler that a notify reached by name now carries a `listen:` with that
exact wording, so the binding is explicit before anything is renamed. The
topics themselves become identifiers: `compose up` reads `compose-up`,
`Restart NFS ganesha` reads `restart-nfs-ganesha`, 22 of them across both
sides of every notify. Where the topic is assembled at runtime, both branches
moved together: the conditional in sys-service carries two literals, and the
LDAP renderer interpolates `import-{{ folder }}-ldif-files`, which is what
makes those handlers reachable at all.

Freed from the binding, the names take the emoji prefix every other task line
already has.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/drv-lid-switch/handlers/main.yml

@@ -1,5 +1,6 @@
 ---
-- name: Restart systemd-logind
+- name: 🔄 Restart systemd-logind
+  listen: restart-systemd-logind
   become: true
   systemd:
     name: systemd-logind

roles/drv-lid-switch/tasks/00_core.yml

@@ -20,7 +20,7 @@
     regexp: "^#?HandleLidSwitch="
     line: "HandleLidSwitch=hibernate"
     backup: true
-  notify: Restart systemd-logind
+  notify: restart-systemd-logind
 
 - name: 🔧 Configure systemd to lock session when lid is closed on external power
   lineinfile:
@@ -28,7 +28,7 @@
     regexp: "^#?HandleLidSwitchExternalPower="
     line: "HandleLidSwitchExternalPower=lock"
     backup: true
-  notify: Restart systemd-logind
+  notify: restart-systemd-logind
   become: true
 
 - name: 🔧 Configure systemd to lock session when lid is closed while docked
@@ -37,7 +37,7 @@
     regexp: "^#?HandleLidSwitchDocked="
     line: "HandleLidSwitchDocked=lock"
     backup: true
-  notify: Restart systemd-logind
+  notify: restart-systemd-logind
   become: true
 
 - include_tasks: utils/once/flag.yml

roles/svc-db-openldap/handlers/main.yml

@@ -1,49 +1,49 @@
 ---
-- name: Load memberof module in OpenLDAP (cn=config via EXTERNAL)
+- name: 🔌 Load memberof module in OpenLDAP (cn=config via EXTERNAL)
   ansible.builtin.shell: >-
     container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
     ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
     -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/01_member_of_configuration.ldif'] | path_join }}"
   listen:
-    - "Import configuration LDIF files"
+    - "import-configuration-ldif-files"
   register: r
   failed_when: >-
     r.rc != 0 and
     not (r.stderr | default('') | ldap_modify_noop)
 
-- name: Load refint module in OpenLDAP (cn=config via EXTERNAL)
+- name: 🔌 Load refint module in OpenLDAP (cn=config via EXTERNAL)
   ansible.builtin.shell: >-
     container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
     ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
     -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/04_refint_module.ldif'] | path_join }}"
   listen:
-    - "Import configuration LDIF files"
+    - "import-configuration-ldif-files"
   register: r
   failed_when: >-
     r.rc != 0 and
     not (r.stderr | default('') | ldap_modify_noop)
 
-- name: Add memberof overlay (cn=config via EXTERNAL)
+- name: ➕ Add memberof overlay (cn=config via EXTERNAL)
   ansible.builtin.shell: >-
     container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
     ldapadd -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
     -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/02_member_of_configuration.ldif'] | path_join }}"
   listen:
-    - "Import configuration LDIF files"
+    - "import-configuration-ldif-files"
   register: r
   failed_when: r.rc not in [0, 68]
 
-- name: Add refint overlay (cn=config via EXTERNAL)
+- name: ➕ Add refint overlay (cn=config via EXTERNAL)
   ansible.builtin.shell: >-
     container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }}
     ldapadd -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }}
     -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'configuration/03_member_of_configuration.ldif'] | path_join }}"
   listen:
-    - "Import configuration LDIF files"
+    - "import-configuration-ldif-files"
   register: r
   failed_when: r.rc not in [0, 68]
 
-- name: Import users, groups, etc. to LDAP (data tree)
+- name: 📥 Import users, groups, etc. to LDAP (data tree)
   ansible.builtin.shell: >-
     container exec -i {{ lookup('container_address', 'svc-db-openldap', 'openldap') }} ldapadd -x
     -D "{{ OPENLDAP_BIND_DN }}"
@@ -51,7 +51,7 @@
     -c
     -f "{{ [OPENLDAP_LDIF_PATH_DOCKER, 'groups', (item | basename | regex_replace('\.j2$', ''))] | path_join }}"
   listen:
-    - "Import groups LDIF files"
+    - "import-groups-ldif-files"
   register: ldapadd_result
   changed_when: "'adding new entry' in ldapadd_result.stdout"
   failed_when: ldapadd_result.rc not in [0, 20, 68, 65]

roles/svc-db-openldap/tasks/00_core.yml

@@ -15,7 +15,7 @@
   stack_host_template:
     src: "nginx.stream.conf.j2"
     dest: "{{ lookup('nginx','directories.configuration.streams') }}{{ lookup('domain',application_id) }}.conf"
-  notify: restart openresty
+  notify: restart-openresty
   when: OPENLDAP_NETWORK_SWITCH_PUBLIC | bool
 
 - name: 🧹 Remove {{ lookup('domain',application_id) }}.conf if LDAP not public

roles/svc-db-openldap/tasks/_ldifs_creation.yml

@@ -7,4 +7,4 @@
       - src_glob: "ldif/{{ folder }}/*.j2"
         dest_dir: "{{ OPENLDAP_LDIF_PATH_HOST }}{{ folder }}"
         mode: "0770"
-        notify: "Import {{ folder }} LDIF files"
+        notify: "import-{{ folder }}-ldif-files"

roles/svc-net-wireguard-core/handlers/main.yml

@@ -1,10 +1,12 @@
 ---
-- name: "restart wireguard"
+- name: "🔄 restart wireguard"
+  listen: restart-wireguard
   systemd:
     name: wg-quick@wg0.service
     state: restarted
     enabled: true
     daemon_reload: true
 
-- name: "reload sysctl configuration"
+- name: "♻️ reload sysctl configuration"
+  listen: reload-sysctl-configuration
   shell: "sysctl --load='/etc/sysctl.d/wireguard-ip.conf'"

roles/svc-net-wireguard-core/tasks/00_core.yml

@@ -9,7 +9,7 @@
     dest: /etc/sysctl.d/wireguard-ip.conf
     owner: root
     group: root
-  notify: reload sysctl configuration
+  notify: reload-sysctl-configuration
 
 - name: "🚀 deploy {{ WG0_CONF_DEST }}"
   copy:
@@ -17,6 +17,6 @@
     dest: "{{ WG0_CONF_DEST }}"
     owner: root
     group: root
-  notify: restart wireguard
+  notify: restart-wireguard
 
 - include_tasks: utils/once/flag.yml

roles/svc-prx-openresty/handlers/main.yml

@@ -1,8 +1,8 @@
 ---
-- name: Restart and validate OpenResty
-  listen: restart openresty
+- name: 🔄 Restart and validate OpenResty
+  listen: restart-openresty
   include_tasks: restart.yml
 
-- name: Reload OpenResty
-  listen: reload openresty
+- name: ♻️ Reload OpenResty
+  listen: reload-openresty
   include_tasks: reload.yml

roles/svc-prx-openresty/handlers/reload.yml

@@ -5,7 +5,7 @@
 # container already sees the new file and SIGHUP is enough -- unlike
 # nginx.conf, which is bound as a FILE and whose inode the task pins at create
 # time (see restart.yml).
-- name: Validate OpenResty configuration before reloading
+- name: ✅ Validate OpenResty configuration before reloading
   ansible.builtin.shell: >
     container exec {{ lookup('container_address', 'svc-prx-openresty', 'openresty') }} openresty -t -q
   register: openresty_test_reload
@@ -19,7 +19,7 @@
     ('no such container' not in ((openresty_test_reload.stderr | default('')) | lower)) and
     ('is restarting' not in ((openresty_test_reload.stderr | default('')) | lower))
 
-- name: Reload OpenResty
+- name: ♻️ Reload OpenResty
   ansible.builtin.shell: >
     container exec {{ lookup('container_address', 'svc-prx-openresty', 'openresty') }} openresty -s reload
   register: openresty_reload

roles/svc-prx-openresty/handlers/restart.yml

@@ -4,10 +4,10 @@
 # source inode changes; the running task keeps the old, deleted inode
 # mounted and `openresty -s reload` reads stale config. Force a task
 # redeploy on the manager to remount the live inode.
-- name: Compose-mode force-recreate (file bind-mount pins the inode; -s reload reads stale config)
+- name: 🐳 Compose-mode force-recreate (a file bind-mount pins the inode)
   when: DEPLOYMENT_MODE == 'compose'
   block:
-    - name: Force-recreate OpenResty (remounts the config bind to the live inode)
+    - name: 🔄 Force-recreate OpenResty (remounts the config bind to the inode)
       ansible.builtin.shell: |
         set -euo pipefail
         compose up -d --force-recreate --remove-orphans
@@ -17,7 +17,7 @@
       register: openresty_restart
       changed_when: true
 
-    - name: Validate OpenResty configuration (Post-Flight-Check)
+    - name: ✅ Validate OpenResty configuration (Post-Flight-Check)
       ansible.builtin.shell: >
         container exec {{ lookup('container_address', 'svc-prx-openresty', 'openresty') }} openresty -t -q
       register: openresty_test_post
@@ -31,7 +31,7 @@
         ('no such container' not in ((openresty_test_post.stderr | default('')) | lower)) and
         ('is restarting' not in ((openresty_test_post.stderr | default('')) | lower))
 
-- name: Force OpenResty service redeploy
+- name: 🚀 Force OpenResty service redeploy
   ansible.builtin.command: >-
     container service update --force
     {{ lookup('container_service', 'svc-prx-openresty', 'openresty') }}
@@ -47,7 +47,7 @@
     - DEPLOYMENT_MODE == 'swarm'
     - IS_STACK_HOST | bool
 
-- name: "MODE_DEBUG: wait + validate OpenResty"
+- name: "🐛 MODE_DEBUG: wait + validate OpenResty"
   when: MODE_DEBUG | bool
   block:
     - ansible.builtin.command: container ps -a --format '{{"{{.Names}} {{.Status}}"}}'

roles/svc-storage-nfs-server/handlers/main.yml

@@ -1,8 +1,10 @@
 ---
-- name: "Reload NFS exports"
+- name: "♻️ Reload NFS exports"
+  listen: reload-nfs-exports
   ansible.builtin.command: exportfs -ra
 
-- name: "Restart NFS ganesha"
+- name: "🔄 Restart NFS ganesha"
+  listen: restart-nfs-ganesha
   ansible.builtin.script:
     cmd: "{{ SVC_STORAGE_NFS_SERVER_GANESHA_SERVE }} restart"
   register: svc_storage_nfs_server_ganesha_restart

roles/svc-storage-nfs-server/tasks/flavor/ganesha/main.yml

@@ -13,7 +13,7 @@
     group: root
     mode: "0644"
   when: ansible_facts['os_family'] == 'Archlinux'
-  notify: "Restart NFS ganesha"
+  notify: "restart-nfs-ganesha"
 
 - name: "🔧 Mask the broken nfs-ganesha-config helper unit"
   ansible.builtin.systemd:
@@ -46,7 +46,7 @@
     owner: root
     group: root
     mode: "0644"
-  notify: "Restart NFS ganesha"
+  notify: "restart-nfs-ganesha"
 
 - name: "📁 Ensure the nfs-ganesha systemd drop-in dir exists"
   ansible.builtin.file:
@@ -63,7 +63,7 @@
     owner: root
     group: root
     mode: "0644"
-  notify: "Restart NFS ganesha"
+  notify: "restart-nfs-ganesha"
 
 - name: "🔄 Reload systemd so the drop-in is live before ganesha starts"
   ansible.builtin.systemd:

roles/svc-storage-nfs-server/tasks/flavor/kernel/main.yml

@@ -30,7 +30,7 @@
     owner: root
     group: root
     mode: "0644"
-  notify: "Reload NFS exports"
+  notify: "reload-nfs-exports"
 
 - name: "🚿 Flush handlers (exports reload before next step)"
   ansible.builtin.meta: flush_handlers

roles/sys-daemon/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: collect systemd unit files
+- name: 🔍 collect systemd unit files
   shell: |
     shopt -s nullglob
     files=({{ DIR_SYSTEM_SERVICE }}*.service {{ DIR_SYSTEM_SERVICE }}*.timer)
@@ -11,10 +11,10 @@
   failed_when: false
   become: true
   listen:
-    - reload system daemon
-    - reexec systemd manager
+    - reload-system-daemon
+    - reexec-systemd-manager
 
-- name: validate systemd units
+- name: ✅ validate systemd units
   shell: |
     systemd-analyze verify {{ _unit_files.stdout_lines | join(' ') }}
   register: _verify_units
@@ -23,28 +23,27 @@
   become: true
   when: _unit_files.stdout | length > 0
   listen:
-    - reload system daemon
-    - reexec systemd manager
+    - reload-system-daemon
+    - reexec-systemd-manager
 
-- name: show merged manager config
+- name: 🐛 show merged manager config
   command: systemd-analyze cat-config systemd/system.conf
   register: _catcfg
   changed_when: false
   become: true
   listen:
-    - reload system daemon
-    - reexec systemd manager
+    - reload-system-daemon
+    - reexec-systemd-manager
 
-- name: "reload system daemon"
+- name: "♻️ reload system daemon"
   ansible.builtin.systemd:
     daemon_reload: true
   become: true
-  listen: reload system daemon
+  listen: reload-system-daemon
 
-- name: reexec systemd manager
-  # daemon-reexec terminates PID-1-systemd containers; effect applies on next boot.
+- name: 🔄 reexec systemd manager
   ansible.builtin.systemd:
     daemon_reexec: true
   become: true
-  listen: reexec systemd manager
+  listen: reexec-systemd-manager
   when: not (DOCKER_IN_CONTAINER | bool)

roles/sys-daemon/tasks/01_reset.yml

@@ -1,7 +1,7 @@
 ---
 - name: 🔄 reload system daemon
   command: /bin/true
-  notify: "reload system daemon"
+  notify: "reload-system-daemon"
 
 - name: "✅ Sanity check SYSTEMD_MANAGER_CONF_DIR"
   assert:
@@ -16,4 +16,4 @@
   file:
     path: "{{ SYSTEMD_MANAGER_CONF_DIR }}"
     state: absent
-  notify: reexec systemd manager
+  notify: reexec-systemd-manager

roles/sys-daemon/tasks/02_defaults.yml

@@ -10,4 +10,4 @@
     src: timeouts.conf.j2
     dest: "{{ SYSTEMD_MANAGER_CONF_DIR }}/timeouts.conf"
     mode: "0644"
-  notify: reexec systemd manager
+  notify: reexec-systemd-manager

roles/sys-front-inj-all/tasks/main.yml

@@ -48,4 +48,4 @@
     src: body_filter.lua.j2
     dest: "{{ lookup('nginx', 'directories.configuration.lua') }}{{ application_id }}.lua"
     mode: "0644"
-  notify: reload openresty
+  notify: reload-openresty

roles/sys-front-tls/tasks/01_http.yml

@@ -10,5 +10,5 @@
   stack_host_template:
     src: "http.conf.j2"
     dest: "{{ lookup('nginx', 'files.domain', domain, protocol='http') }}"
-  notify: restart openresty
+  notify: restart-openresty
   when: HTTPS_REDIRECT_ENABLED | bool

roles/sys-service/handlers/main.yml

@@ -1,4 +1,4 @@
 ---
-- name: refresh systemctl service
-  listen: refresh systemctl service
+- name: 🔄 refresh systemctl service
+  listen: refresh-systemctl-service
   ansible.builtin.include_tasks: refresh_systemctl_service.yml

roles/sys-service/handlers/refresh_systemctl_service.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Enable systemctl service"
+- name: "🔧 Enable systemctl service"
   systemd:
     name: "{{ system_service_name }}"
     enabled: true
@@ -9,7 +9,7 @@
   async: "{{ system_service_async }}"
   poll: "{{ system_service_poll }}"
 
-- name: "Set systemctl service state"
+- name: "🔧 Set systemctl service state"
   systemd:
     name: "{{ system_service_name }}"
     state: "{{ system_service_state }}"
@@ -21,7 +21,7 @@
   register: systemd_set_state
   failed_when: false
 
-- name: sys-service | Read unit Result (oneshot-safe)
+- name: 🔍 sys-service | Read unit Result (oneshot-safe)
   ansible.builtin.command:
     argv:
       - systemctl
@@ -35,7 +35,7 @@
   changed_when: false
   failed_when: false
 
-- name: sys-service | Read unit ExecMainStatus (oneshot-safe)
+- name: 🔍 sys-service | Read unit ExecMainStatus (oneshot-safe)
   ansible.builtin.command:
     argv:
       - systemctl
@@ -49,7 +49,7 @@
   changed_when: false
   failed_when: false
 
-- name: sys-service | Show diagnostics on failure
+- name: 🐛 sys-service | Show diagnostics on failure
   ansible.builtin.include_tasks: "{{ role_path }}/tasks/utils/debug.yml"
   vars:
     system_service_debug_unit: "{{ system_service_name }}"

roles/sys-service/tasks/03_reset.yml

@@ -8,4 +8,4 @@
 
 - name: "🧹 Remove '{{ SYS_SERVICE_SUFFIX }}' files"
   command: "{{ UNIT_SUFFIX_REMOVER_PACKAGE }} -s '{{ SOFTWARE_NAME }}'"
-  notify: "reload system daemon"
+  notify: "reload-system-daemon"

roles/sys-service/tasks/05_files.yml

@@ -12,7 +12,7 @@
         src: "{{ system_service_script_src }}"
         dest: "{{ [system_service_script_dir, (system_service_script_src | basename | regex_replace('\\.j2$', ''))] | path_join }}"
         mode: "0755"
-      notify: "{{ 'reload system daemon' if system_service_is_template | bool else 'refresh systemctl service' }}"
+      notify: "{{ 'reload-system-daemon' if system_service_is_template | bool else 'refresh-systemctl-service' }}"
       when: system_service_script_src.endswith('.j2')
 
     - name: "📋 copy raw file"
@@ -21,5 +21,5 @@
         dest: "{{ [system_service_script_dir, (system_service_script_src | basename)] | path_join }}"
         mode: "0755"
       when: not system_service_script_src.endswith('.j2')
-      notify: "{{ 'reload system daemon' if system_service_is_template | bool else 'refresh systemctl service' }}"
+      notify: "{{ 'reload-system-daemon' if system_service_is_template | bool else 'refresh-systemctl-service' }}"
   when: system_service_copy_files | bool

roles/sys-service/tasks/06_service.yml

@@ -32,15 +32,15 @@
     owner: root
     group: root
     mode: "0644"
-  notify: "{{ 'reload system daemon' if system_service_is_template | bool else 'refresh systemctl service' }}"
+  notify: "{{ 'reload-system-daemon' if system_service_is_template | bool else 'refresh-systemctl-service' }}"
 
 - name: 🔄 refresh systemctl service when SYS_SERVICE_ALL_ENABLE
   block:
     - name: 🔄 reload system daemon
       command: /bin/true
-      notify: reload system daemon
+      notify: reload-system-daemon
     - name: 🔄 refresh systemctl service
       command: /bin/true
-      notify: refresh systemctl service
+      notify: refresh-systemctl-service
       when: not system_service_is_template | bool
   when: system_service_force_flush_instant | bool

roles/sys-stk-front-proxy/tasks/main.yml

@@ -100,7 +100,7 @@
     webserver_websocket_location: ""
     webserver_client_max_body_size: "{{ lookup('config', front_proxy_application_id, 'server.client_max_body_size', '100m') }}"
   register: nginx_conf
-  notify: reload openresty
+  notify: reload-openresty
 
 - block:
     - name: "🔍 Check if {{ lookup('domain', front_proxy_application_id) }} is reachable"
@@ -117,7 +117,7 @@
     - name: 🔄 Restart NGINX if site is down
       ansible.builtin.command:
         cmd: "true"
-      notify: restart openresty
+      notify: restart-openresty
       when:
         - site_check.status is defined
         - site_check.status not in [200, 301, 302]
@@ -141,7 +141,7 @@
 - name: 🔄 Fall back to a full redeploy when the reload did not take
   ansible.builtin.command:
     cmd: "true"
-  notify: restart openresty
+  notify: restart-openresty
   when:
     - nginx_conf.changed
     - front_proxy_reload_check.status is defined

roles/sys-svc-cln-domains/tasks/remove_deprecated_nginx_configs.yml

@@ -12,10 +12,10 @@
     state: absent
   loop: "{{ find_result.files | default([]) }}"
   when: item is defined
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: 🗑️ Remove exact nginx config for {{ domain }}
   ansible.builtin.file:
     path: "{{ lookup('nginx', 'files.domain', domain) }}"
     state: absent
-  notify: restart openresty
+  notify: restart-openresty

roles/sys-svc-compose/handlers/compose.yml

@@ -2,11 +2,11 @@
 - name: "🛡️ Guard instance dir at compose flush"
   ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/guard_instance_dir.yml') }}"
   listen:
-    - compose up
-    - compose build
-    - container recreate
+    - compose-up
+    - compose-build
+    - container-recreate
 
-- name: Generate CA trust override
+- name: 📝 Generate CA trust override
   ansible.builtin.shell: |
     set -euo pipefail
     {{ lookup('compose_ca_inject_cmd', application_id) }}
@@ -19,13 +19,13 @@
   delay: 20
   until: compose_ca_override is succeeded
   listen:
-    - compose up
+    - compose-up
   when:
     - lookup('domains') | has_domain(application_id)
     - lookup('tls', application_id, 'enabled') | bool
     - lookup('tls', application_id, 'mode') == 'self_signed'
 
-- name: Validate Docker Compose configuration
+- name: ✅ Validate Docker Compose configuration
   ansible.builtin.shell: |
     set -euo pipefail
     compose config --quiet
@@ -36,10 +36,10 @@
   changed_when: false
   failed_when: dc_validate.rc != 0
   listen:
-    - compose up
+    - compose-up
   when: MODE_ASSERT_LOCAL | bool
 
-- name: compose pull
+- name: 📥 compose pull
   ansible.builtin.script:
     cmd: >-
       pull.py
@@ -59,9 +59,9 @@
   delay: 30
   until: pull is succeeded
   listen:
-    - compose up
+    - compose-up
 
-- name: Build compose
+- name: 🔨 Build compose
   ansible.builtin.shell: |
     set -euo pipefail
     compose build
@@ -75,9 +75,9 @@
   until: compose_build is succeeded
   ignore_errors: true
   listen:
-    - compose build
+    - compose-build
 
-- name: Rebuild compose without cache once the spaced retries are exhausted
+- name: 🔨 Rebuild compose without cache once the retries are exhausted
   ansible.builtin.shell: |
     set -euo pipefail
     compose build --no-cache --pull
@@ -87,9 +87,9 @@
   timeout: "{{ lookup('timeout', 3600) | int }}"
   when: compose_build is failed
   listen:
-    - compose build
+    - compose-build
 
-- name: compose up
+- name: 🐳 compose up
   ansible.builtin.shell: |
     set -euo pipefail
     compose up -d --force-recreate --remove-orphans
@@ -102,5 +102,5 @@
     chdir: "{{ lookup('container', application_id, 'directories.instance') }}"
     executable: /bin/bash
   listen:
-    - compose up
-    - container recreate
+    - compose-up
+    - container-recreate

roles/sys-svc-compose/handlers/main.yml

@@ -1,13 +1,13 @@
 ---
-- name: Aggressively prune Docker data (keep networks + keep in-use images)
+- name: 🧹 Aggressively prune Docker data (keep networks + in-use images)
   become: true
   ansible.builtin.script:
     cmd: prune.sh
   changed_when: true
   when: STORAGE_CONSTRAINED | bool
   listen:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - ansible.builtin.import_tasks: compose.yml
   when: compose_mode == 'compose'

roles/sys-svc-compose/handlers/swarm.yml

@@ -3,10 +3,10 @@
   ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/guard_instance_dir.yml') }}"
   run_once: true
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
 
-- name: "swarm: pre-deploy build of local images"
+- name: "🐝 swarm: pre-deploy build of local images"
   ansible.builtin.shell: |
     set -euo pipefail
     timeout -k 60 {{ lookup('timeout', 3600) | int }} compose build
@@ -20,12 +20,12 @@
   until: _swarm_pre_deploy_build is succeeded
   ignore_errors: true
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: rebuild without cache once the spaced retries are exhausted"
+- name: "🐝 swarm: rebuild without cache once the spaced retries are exhausted"
   ansible.builtin.shell: |
     set -euo pipefail
     timeout -k 60 {{ lookup('timeout', 3600) | int }} compose build --no-cache --pull
@@ -35,12 +35,12 @@
   timeout: "{{ lookup('timeout', 3600) | int }}"
   when: _swarm_pre_deploy_build is failed
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: cache externals + retag built images and push to local registry"
+- name: "🐝 swarm: cache externals + retag built images and push to registry"
   ansible.builtin.script:
     cmd: >-
       swarm/registry_sync.py
@@ -51,13 +51,13 @@
   delay: 6
   until: _swarm_registry_sync is succeeded
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   when: (swarm.registry.host | default('') | length > 0) and (application_id != 'svc-registry-docker')
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: pre-pull images the local registry cannot serve"
+- name: "🐝 swarm: pre-pull images the local registry cannot serve"
   ansible.builtin.shell: |
     set -euo pipefail
     images="$(compose config --images)"
@@ -72,15 +72,15 @@
   delay: 30
   until: _swarm_bypass_pull is succeeded
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   when:
     - swarm.registry.host | default('') | length > 0
     - _swarm_registry_sync is skipped
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: recompute file-backed secret/config name hashes on the stack host"
+- name: "🐝 swarm: recompute file-backed secret/config hashes on the stack host"
   ansible.builtin.script:
     cmd: >-
       swarm/secret_rotate.py
@@ -88,12 +88,12 @@
   register: _swarm_secret_rotate
   changed_when: "'>>> rotate' in _swarm_secret_rotate.stderr"
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: generate CA trust override (no wrapper; env + CA mount only)"
+- name: "🐝 swarm: generate CA trust override (env + CA mount, no wrapper)"
   ansible.builtin.shell: |
     set -euo pipefail
     {{ lookup('compose_ca_inject_cmd', application_id, wrapper=False) }}
@@ -105,8 +105,8 @@
   delay: 20
   until: swarm_compose_ca_override is succeeded
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   when:
     - lookup('domains') | has_domain(application_id)
     - lookup('tls', application_id, 'enabled') | bool
@@ -114,7 +114,7 @@
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: pre-create external provider overlays referenced by the stack"
+- name: "🐝 swarm: pre-create external provider overlays for the stack"
   ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/network/create.yml') }}"
   vars:
     network_role_id: "{{ external_network_role }}"
@@ -122,11 +122,11 @@
   loop_control:
     loop_var: external_network_role
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   when: SWARM_CLUSTER_AVAILABLE | bool
 
-- name: "swarm: validate stack file via docker stack config"
+- name: "✅ swarm: validate stack file via docker stack config"
   ansible.builtin.shell: |
     set -euo pipefail
     docker stack config {{ lookup('compose_file_args', application_id, flag='--compose-file') }} > /dev/null
@@ -137,13 +137,13 @@
   changed_when: false
   failed_when: swarm_validate.rc != 0
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   when: MODE_ASSERT_LOCAL | bool
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: docker stack deploy"
+- name: "🚀 swarm: docker stack deploy"
   ansible.builtin.shell: |
     set -euo pipefail
     docker stack deploy \
@@ -158,12 +158,12 @@
   register: swarm_deploy_result
   changed_when: true
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: wait until stack tasks converge"
+- name: "⏳ swarm: wait until stack tasks converge"
   ansible.builtin.script: "{{ lookup('path_absolute', 'roles/sys-svc-compose/files/swarm/stack_ready.sh') }}"
   environment:
     STACK: "{{ application_id | get_entity_name }}"
@@ -174,12 +174,12 @@
   changed_when: false
   until: _swarm_stack_ready_handler.rc in [0, 2]
   listen:
-    - compose up
-    - swarm deploy
+    - compose-up
+    - swarm-deploy
   run_once: true
   delegate_to: "{{ STACK_HOST }}"
 
-- name: "swarm: force task recreation so in-container state is reloaded"
+- name: "🔄 swarm: force task recreation so in-container state is reloaded"
   ansible.builtin.shell: |
     set -euo pipefail
     docker stack services --format '{{ "{{.Name}}" }}' {{ application_id | get_entity_name | quote }} \
@@ -193,6 +193,6 @@
   delay: 15
   until: _swarm_force_recreate is succeeded
   listen:
-    - container recreate
+    - container-recreate
   run_once: true
   delegate_to: "{{ STACK_HOST }}"

roles/sys-svc-compose/tasks/03_repository.yml

@@ -19,6 +19,6 @@
   delay: 30
   until: docker_repo_pull is succeeded
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
   become: true

roles/sys-svc-compose/tasks/04_files.yml

@@ -20,8 +20,8 @@
     dest: "{{ lookup('container', application_id, 'files.dockerfile') }}"
     mode: "0640"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
   when:
     - dockerfile_src | default('') | length > 0
 
@@ -32,8 +32,8 @@
     mode: "0640"
     force: true
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
   with_first_found:
     - files:
         - "{{ application_id | abs_role_path_by_application_id }}/templates/env.j2"
@@ -47,7 +47,7 @@
     dest: "{{ lookup('container', application_id, 'files.compose_override') }}"
     mode: "0640"
     force: true
-  notify: compose up
+  notify: compose-up
   with_first_found:
     - files:
         - "{{ application_id | abs_role_path_by_application_id }}/templates/compose.override.yml.j2"
@@ -65,4 +65,4 @@
         - "compose.yml.j2"
       skip: true
   register: docker_compose_template
-  notify: compose up
+  notify: compose-up

roles/sys-svc-compose/tasks/utils/_render_one_template.yml

@@ -20,7 +20,7 @@
   when: (_tpl.condition | default(true)) | bool
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
   register: _role_templates_render
-  notify: "{{ _tpl.notify | default(['compose up']) }}"
+  notify: "{{ _tpl.notify | default(['compose-up']) }}"
 
 - name: "[swarm] Slurp rendered '{{ _tpl.dest }}' from manager"
   ansible.builtin.slurp:

roles/sys-svc-compose/tasks/utils/up.yml

@@ -21,14 +21,14 @@
         env_template.changed          | default(false)
       )
     - compose_mode == 'compose'
-  notify: compose up
+  notify: compose-up
 
 - name: "🔔 Notify swarm deploy (under DEPLOYMENT_MODE == swarm)"
   ansible.builtin.debug:
     msg: "Triggering swarm stack deploy for {{ application_id }}"
   changed_when: true
   when: compose_mode == 'swarm'
-  notify: swarm deploy
+  notify: swarm-deploy
 
 - name: "🔄 Flush compose up handlers for '{{ application_id }}'"
   meta: flush_handlers

roles/sys-svc-container/handlers/main.yml

@@ -1,18 +1,18 @@
 ---
-- name: Ensure Docker daemon is running on host
+- name: 🔄 Ensure Docker daemon is running on host
   ansible.builtin.service:
     name: docker.service
     state: restarted
     enabled: true
-  listen: container manager restart
+  listen: container-manager-restart
 
-- name: Ensure Docker-In-Docker DNS works
+- name: 💬 Ensure Docker-In-Docker DNS works
   ansible.builtin.script: "{{ role_path }}/files/test-dns.sh"
   register: docker_in_docker_dns_check
   until: docker_in_docker_dns_check is succeeded
   retries: 7
   delay: 20
-  listen: container manager restart
+  listen: container-manager-restart
   when:
     - DOCKER_IN_CONTAINER | bool
     - networks.internet.dns | length > 0

roles/sys-svc-container/handlers/restart_docker.yml

@@ -1,11 +1,11 @@
 ---
-- name: Trigger container manager restart non-blocking (hard timeout)
+- name: 🔄 Trigger container manager restart non-blocking (hard timeout)
   ansible.builtin.command: "timeout 10s systemctl restart docker.service --no-block"
   register: restart_cmd
   changed_when: true
   failed_when: false
 
-- name: Wait up to 60s for docker.service to become active
+- name: ⏳ Wait up to 60s for docker.service to become active
   ansible.builtin.command: "systemctl is-active docker.service"
   register: docker_active
   changed_when: false
@@ -13,7 +13,7 @@
   delay: 1
   until: docker_active.stdout.strip() == "active"
 
-- name: Assert docker is active
+- name: ✅ Assert docker is active
   ansible.builtin.assert:
     that:
       - docker_active.stdout.strip() == "active"

roles/sys-svc-container/tasks/00_core.yml

@@ -14,7 +14,7 @@
   retries: 5
   delay: 15
   until: sys_svc_container_packages_install is succeeded
-  notify: container manager restart
+  notify: container-manager-restart
 
 - name: 📦 Install Docker Python SDK dependencies via pip
   include_role:

roles/sys-svc-container/tasks/02_docker_in_docker.yml

@@ -9,7 +9,7 @@
   ansible.builtin.package: # nocheck: dynamic-package - package set assembled at runtime for the nested runtime
     name: fuse-overlayfs
     state: present
-  notify: container manager restart
+  notify: container-manager-restart
 
 - name: 🧮 Compute and set Docker daemon MTU (container)
   include_tasks: "_mtu.yml"
@@ -35,7 +35,7 @@
     src: daemon.json.j2
     dest: "{{ SYS_SVC_DOCKER_DAEMON }}"
     mode: "0644"
-  notify: container manager restart
+  notify: container-manager-restart
 
 - name: 🔎 Check if TCP MSS clamp to PMTU is already present (container)
   ansible.builtin.command:

roles/sys-svc-container/tasks/03_reset.yml

@@ -19,4 +19,4 @@
 - name: ⚡ Trigger Docker restart
   ansible.builtin.debug:
     msg: "MODE_RESET is enabled → restarting Docker"
-  notify: container manager restart
+  notify: container-manager-restart

roles/sys-svc-journalctl/handlers/main.yml

@@ -1,3 +1,4 @@
 ---
-- name: restart systemd-journald
+- name: 🔄 restart systemd-journald
+  listen: restart-systemd-journald
   service: name=systemd-journald state=restarted

roles/sys-svc-journalctl/tasks/main.yml

@@ -11,4 +11,4 @@
   template: # nocheck: stack-host-template (per-host /etc/systemd/journald.conf, not stack-host-only)
     src: templates/journald.conf.j2
     dest: /etc/systemd/journald.conf
-  notify: restart systemd-journald
+  notify: restart-systemd-journald

roles/sys-svc-mail-smtp/handlers/main.yml

@@ -1,5 +1,6 @@
 ---
-- name: restart postfix
+- name: 🔄 restart postfix
+  listen: restart-postfix
   ansible.builtin.systemd:
     name: postfix
     enabled: true

roles/sys-svc-mail-smtp/tasks/enable.yml

@@ -20,16 +20,16 @@
     src: "postfix-main.cf.j2"
     dest: "/etc/postfix/main.cf"
     mode: "0644"
-  notify: restart postfix
+  notify: restart-postfix
 
 - name: "🚀 Deploy postfix aliases"
   ansible.builtin.template: # nocheck: stack-host-template (per-host postfix aliases)
     src: "aliases.j2"
     dest: "/etc/postfix/aliases"
     mode: "0644"
-  notify: restart postfix
+  notify: restart-postfix
 
 - name: "🔨 Build alias database"
   ansible.builtin.command: newaliases
   changed_when: false
-  notify: restart postfix
+  notify: restart-postfix

roles/sys-svc-rdbms/tasks/dedicated.yml

@@ -9,7 +9,7 @@
   stack_host_template:
     src: "env/{{ _database_type }}.env.j2"
     dest: "{{ _database_env }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "🔧 For '{{ application_id }}/{{ _database_consumer_id }}': Apply postgres setup"
   include_tasks: dedicated_postgres.yml

roles/sys-svc-rdbms/tasks/dedicated_postgres.yml

@@ -10,7 +10,7 @@
         src: "initdb.d/extensions.sql.j2"
         dest: "{{ _database_initdb_dir }}extensions.sql"
         mode: "0644"
-      notify: compose up
+      notify: compose-up
   when: (_database_extensions | length) > 0
 
 - block:
@@ -30,6 +30,6 @@
         POSTGRES_VERSION_MAJOR: "{{ lookup('database', _database_consumer_id, 'version') | regex_replace('^([0-9]+).*', '\\1') }}"
         POSTGRES_LIBRARIES: "{{ _database_libraries }}"
       notify:
-        - compose build
-        - compose up
+        - compose-build
+        - compose-up
   when: (_database_libraries | length) > 0

roles/sys-svc-sshd/handlers/main.yml

@@ -1,9 +1,9 @@
 ---
-- name: Gather service facts for SSH handler
+- name: 🔍 Gather service facts for SSH handler
   ansible.builtin.service_facts:
-  listen: sshd restart
+  listen: sshd-restart
 
-- name: Resolve SSH service unit name
+- name: 🔍 Resolve SSH service unit name
   ansible.builtin.set_fact:
     sys_svc_sshd_service_unit: >-
       {{
@@ -15,16 +15,16 @@
         ) | default('')
       }}
   changed_when: false
-  listen: sshd restart
+  listen: sshd-restart
 
-- name: Restart detected SSH service with diagnostics
+- name: 🔄 Restart detected SSH service with diagnostics
   ansible.builtin.include_tasks: restart_ssh_service.yml
   when: sys_svc_sshd_service_unit | length > 0
-  listen: sshd restart
+  listen: sshd-restart
 
-- name: Skip SSH restart if no SSH service exists
+- name: ⏭️ Skip SSH restart if no SSH service exists
   ansible.builtin.debug:
     msg: >-
       Skip handler 'sshd restart': neither sshd nor ssh service unit exists on this host.
   when: sys_svc_sshd_service_unit | length == 0
-  listen: sshd restart
+  listen: sshd-restart

roles/sys-svc-sshd/tasks/00_core.yml

@@ -16,6 +16,6 @@
     owner: root
     group: root
     mode: "0644"
-  notify: sshd restart
+  notify: sshd-restart
 
 - include_tasks: utils/once/flag.yml

roles/sys-svc-webserver-core/tasks/00_core/manager_setup.yml

@@ -21,13 +21,13 @@
   stack_host_template:
     src: nginx.conf.j2
     dest: "{{ lookup('nginx', 'files.configuration') }}"
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: 🚀 Deploy OpenResty default server configuration
   stack_host_template:
     src: default_server.conf.j2
     dest: "{{ [lookup('nginx', 'directories.configuration.global'), 'default_server.conf'] | path_join }}"
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: 🚿 Flush OpenResty Base Setup
   meta: flush_handlers

roles/web-app-bigbluebutton/tasks/00_core.yml

@@ -41,7 +41,7 @@
     src: "websocket_upgrade.conf"
     dest: "{{ [ lookup('nginx','directories.configuration.maps'), 'websocket_upgrade.conf' ] | path_join }}"
   when: IS_STACK_HOST | bool
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: "👔 BBB manager-side operations (compose render + container exec)"
   include_tasks: 00_core/manager_ops.yml

roles/web-app-bigbluebutton/tasks/00_core/manager_ops.yml

@@ -10,28 +10,28 @@
   stack_host_template:
     src: compose.override.yml.j2
     dest: "{{ [lookup('container', application_id, 'directories.instance'), 'compose.override.yml'] | path_join }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "🩹 Vendor the ep_redis_publisher fix mounted over the etherpad plugin"
   stack_host_copy:
     src: ep_redis_publisher_index.js
     dest: "{{ [lookup('container', application_id, 'directories.instance'), 'ep_redis_publisher_index.js'] | path_join }}"
     mode: "0444"
-  notify: compose up
+  notify: compose-up
 
 - name: "🩹 Vendor the etherpad postgres-DB entrypoint wrapper"
   stack_host_copy:
     src: etherpad_pg_entrypoint.sh
     dest: "{{ [lookup('container', application_id, 'directories.instance'), 'etherpad_pg_entrypoint.sh'] | path_join }}"
     mode: "0444"
-  notify: compose up
+  notify: compose-up
 
 - name: "🩹 Vendor the initdb hook that creates the etherpad database"
   stack_host_copy:
     src: postgres_initdb_etherpad.sh
     dest: "{{ [lookup('container', application_id, 'directories.instance'), 'postgres_initdb_etherpad.sh'] | path_join }}"
     mode: "0555"
-  notify: compose up
+  notify: compose-up
 
 - name: 📁 Create symbolic link from .env file to target location
   file:

roles/web-app-bigbluebutton/tasks/01_compose/bootstrap_compose_project.yml

@@ -31,7 +31,7 @@
          ) }}
     dest: "{{ BBB_COMPOSE_FILE_FINAL }}"
   notify:
-    - compose up
+    - compose-up
 - name: "🛡️ Fail if any service still builds locally"
   command:
     cmd: grep -E '^\s+build:' {{ BBB_COMPOSE_FILE_FINAL }}

roles/web-app-bluesky/tasks/01_social_app.yml

@@ -6,8 +6,8 @@
     version: "{{ BLUESKY_SOCIAL_APP_REF }}"
     force: true
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: 💪 Force BAPP_CONFIG_URL to same-origin /config
   ansible.builtin.replace:

roles/web-app-bluesky/tasks/02_login_broker.yml

@@ -11,5 +11,5 @@
     dest: "{{ BLUESKY_BROKER_BUILD_CONTEXT }}/"
     mode: preserve
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build

roles/web-app-bluesky/tasks/03_pds.yml

@@ -8,8 +8,8 @@
     dest: "{{ BLUESKY_PDSADMIN_TMP_TAR }}"
     mode: "0644"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: 📁 Create {{ BLUESKY_PDSADMIN_DIR }}
   file:

roles/web-app-decidim/tasks/02_manager_ops.yml

@@ -4,23 +4,23 @@
     src: "allowed_hosts.rb.j2"
     dest: "{{ lookup('container', application_id, 'directories.instance') }}allowed_hosts.rb"
     mode: "0644"
-  notify: compose up
+  notify: compose-up
 
 - name: "🚀 Deploy '{{ DECIDIM_PATCH_SCRIPT_HOST_ABS }}'"
   copy:
     src: "{{ DECIDIM_PATCH_SCRIPT_FILE }}"
     dest: "{{ DECIDIM_PATCH_SCRIPT_HOST_ABS }}"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🚀 Deploy '{{ DECIDIM_PATCH_RUBY_HOST_ABS }}'"
   copy:
     src: "{{ DECIDIM_PATCH_RUBY_DIR }}/"
     dest: "{{ DECIDIM_PATCH_RUBY_HOST_ABS }}/"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🚿 flush handlers of compose"
   meta: flush_handlers

roles/web-app-discourse/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Handle stack host"
+- name: "🖥️ Handle stack host"
   include_tasks: stack_host.yml
   when: IS_STACK_HOST | bool
-  listen: recreate discourse
+  listen: recreate-discourse

roles/web-app-discourse/handlers/stack_host.yml

@@ -1,5 +1,5 @@
 ---
-- name: "stop discourse container gracefully if it exist"
+- name: "🛑 stop discourse container gracefully if it exist"
   ansible.builtin.command: "container stop {{ DISCOURSE_CONTAINER }}"
   register: container_stop
   changed_when: container_stop.rc == 0
@@ -7,7 +7,7 @@
     container_stop.rc != 0 and
     'No such container' not in (container_stop.stderr | default(''))
 
-- name: "remove discourse container if it exist"
+- name: "🗑️ remove discourse container if it exist"
   ansible.builtin.command: "container rm {{ DISCOURSE_CONTAINER }}"
   register: container_action
   changed_when: container_action.rc == 0
@@ -15,7 +15,7 @@
     container_action.rc != 0 and
     'No such container' not in (container_action.stderr | default(''))
 
-- name: "add central database temporary to discourse network"
+- name: "🔗 add central database temporary to discourse network"
   command: "container network connect {{ DISCOURSE_NETWORK }} {{ DISCOURSE_DATABASE_CONTAINER }}"
   failed_when: >
     result.rc != 0 and
@@ -25,7 +25,7 @@
     - DISCOURSE_DATABASE_IS_SHARED | bool
     - DEPLOYMENT_MODE == 'compose'
 
-- name: rebuild discourse
+- name: 🔨 rebuild discourse
   shell: >
     ./launcher rebuild {{ DISCOURSE_CONTAINER }}
     {% if DOCKER_IN_CONTAINER | bool %}--skip-prereqs{% endif %}
@@ -38,7 +38,7 @@
   until: discourse_rebuild.rc == 0
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
-- name: "Connect '{{ DISCOURSE_CONTAINER }}' to its shared swarm overlays"
+- name: "🔗 Connect '{{ DISCOURSE_CONTAINER }}' to its shared swarm overlays"
   command: "container network connect {{ discourse_overlay }} {{ DISCOURSE_CONTAINER }}"
   loop: "{{ ([DISCOURSE_WEB_NETWORK] + ([DISCOURSE_PG_NETWORK] if (DISCOURSE_DATABASE_IS_SHARED | bool) else []) + ([DISCOURSE_REDIS_NETWORK] if (DISCOURSE_REDIS_SHARED
     | bool) else [])) }}"

roles/web-app-discourse/tasks/03_launcher.yml

@@ -10,7 +10,7 @@
   retries: 12
   delay: 30
   until: discourse_repo_pull is succeeded
-  notify: recreate discourse
+  notify: recreate-discourse
   become: true
 
 - name: 🔧 set chmod 700 for '{{ DISCOURSE_CONTAINERS_DIR }}'
@@ -24,7 +24,7 @@
     src: config.yml.j2
     dest: "{{ DISCOURSE_APPLICATION_YML_DEST }}"
     mode: "0640"
-  notify: recreate discourse
+  notify: recreate-discourse
 
 - name: "✅ Verify that '{{ DISCOURSE_CONTAINER }}' is running"
   ansible.builtin.command:
@@ -40,7 +40,7 @@
   register: docker_ps
   changed_when: docker_ps.stdout.strip() == ""
   failed_when: docker_ps.rc != 0
-  notify: recreate discourse
+  notify: recreate-discourse
 
 - name: 📂 Load discourse handlers explicitly
   include_tasks: utils/load/handlers.yml

roles/web-app-espocrm/tasks/01_patch_config.yml

@@ -17,7 +17,7 @@
     label: "{{ item.key }}"
   register: db_patch
   changed_when: "'CHANGED' in db_patch.stdout"
-  notify: compose up
+  notify: compose-up
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: ✅ Ensure siteUrl matches canonical domain

roles/web-app-espocrm/tasks/02_manager_ops.yml

@@ -4,16 +4,16 @@
     src: "{{ ESPOCRM_ENTRYPOINT_SCRIPT_FILE }}"
     dest: "{{ ESPOCRM_ENTRYPOINT_SCRIPT_HOST_ABS }}"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "🚀 Deploy '{{ ESPOCRM_SCRIPT_SEED_HOST_ABS }}'"
   copy:
     src: "{{ ESPOCRM_SCRIPT_SEED_FILE }}"
     dest: "{{ ESPOCRM_SCRIPT_SEED_HOST_ABS }}"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "🐳 Docker Compose Up for '{{ application_id }}'"
   meta: flush_handlers

roles/web-app-fediwall/tasks/01_manager_ops.yml

@@ -11,8 +11,8 @@
     dest: "{{ FEDIWALL_TARBALL_FILE }}"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "✅ Ensure Fediwall upstream dir '{{ FEDIWALL_UPSTREAM_DIR_ABS }}' exists"
   file:
@@ -28,8 +28,8 @@
     extra_opts:
       - --strip-components=1
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🔧 De-hardcode https in the Fediwall SPA bundles (HTTP-only)"
   when: FEDIWALL_HTTP_ONLY_ENABLED | bool
@@ -49,8 +49,8 @@
       loop_control:
         label: "{{ item.path | basename }}"
       notify:
-        - compose build
-        - compose up
+        - compose-build
+        - compose-up
 
 - name: "🧹 Wipe Fediwall dist tree '{{ FEDIWALL_DIST_DIR_ABS }}' to drop removed slugs"
   file:
@@ -74,8 +74,8 @@
     loop_var: wall
     label: "{{ wall.slug }}"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "📄 Render per-slug Fediwall wall-config.json for '{{ wall.slug }}'"
   stack_host_template:
@@ -87,8 +87,8 @@
     loop_var: wall
     label: "{{ wall.slug }}"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "📄 Render Fediwall root link list at '{{ FEDIWALL_DIST_DIR_ABS }}/index.html'"
   stack_host_template:
@@ -96,8 +96,8 @@
     dest: "{{ [ FEDIWALL_DIST_DIR_ABS, 'index.html' ] | path_join }}"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🚿 flush compose for '{{ application_id }}'"
   meta: flush_handlers

roles/web-app-friendica/tasks/01_manager_ops.yml

@@ -5,8 +5,8 @@
     dest: "{{ FRIENDICA_INIT_GATE_HOST }}"
     mode: "0755"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: 🔗 Integrate LDAP
   include_tasks: 02_ldap.yml
@@ -43,7 +43,7 @@
   ansible.builtin.include_tasks:
     file: 03_patch_config.yml
     apply:
-      notify: compose up
+      notify: compose-up
   when: friendica_config_exists.rc == 0
 - name: ➕ Add Friendica Add Ons
   include_tasks: 04_addons.yml

roles/web-app-gitea/tasks/02_database.yml

@@ -19,7 +19,7 @@
   retries: 12
   delay: 5
   until: _gitea_patch_host.rc == 0
-  notify: compose up
+  notify: compose-up
 
 - name: 🩹 Patch Gitea DB name in app.ini
   shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
@@ -30,7 +30,7 @@
   retries: 12
   delay: 5
   until: _gitea_patch_name.rc == 0
-  notify: compose up
+  notify: compose-up
 
 - name: 🩹 Patch Gitea DB user in app.ini
   shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
@@ -41,7 +41,7 @@
   retries: 12
   delay: 5
   until: _gitea_patch_user.rc == 0
-  notify: compose up
+  notify: compose-up
 
 - name: 🩹 Patch Gitea DB password in app.ini
   shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
@@ -54,7 +54,7 @@
   retries: 12
   delay: 5
   until: _gitea_patch_passwd.rc == 0
-  notify: compose up
+  notify: compose-up
 
 - name: "🚿 Flush database patches"
   meta: flush_handlers

roles/web-app-gitlab/tasks/01_config.yml

@@ -106,7 +106,7 @@
   delegate_to: "{{ STACK_HOST }}"
   run_once: true
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "[swarm] Slurp GitLab SSH host keys from stack host"
   ansible.builtin.slurp:
@@ -134,4 +134,4 @@
     - DEPLOYMENT_MODE == 'swarm'
     - not (IS_STACK_HOST | bool)
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-  notify: compose up
+  notify: compose-up

roles/web-app-jenkins/tasks/main.yml

@@ -9,7 +9,7 @@
     dest: "{{ JENKINS_CASC_FILE }}"
     mode: "0644"
   notify:
-    - compose up
+    - compose-up
   when: IS_STACK_HOST | bool
 
 - name: "🎬 Stage Jenkins build-context sidecar files into the compose dir"
@@ -21,5 +21,5 @@
     - plugins.txt
     - "{{ lookup('path_absolute', 'roles/sys-ca-selfsigned/files/java-with-ca-trust.sh') }}"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up

roles/web-app-jitsi/tasks/01_manager_ops.yml

@@ -18,7 +18,7 @@
     src: prosody-ldap.cfg.lua.j2
     dest: "{{ JITSI_PROSODY_CONFIG_HOST_PATH }}/conf.d/ldap.cfg.lua"
     mode: "0644"
-  notify: compose up
+  notify: compose-up
   when: JITSI_LDAP_ENABLED
 
 - name: "🚿 flush handlers so Jitsi containers start with rendered env"

roles/web-app-joomla/tasks/01_config.yml

@@ -11,6 +11,6 @@
     dest: "{{ JOOMLA_ENTRYPOINT_SCRIPT_HOST_ABS }}"
     mode: "0755"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
   when: IS_STACK_HOST | bool

roles/web-app-keycloak/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Keycloak | Sync LDAP groups (ldap-roles mapper)"
+- name: "🔁 Keycloak | Sync LDAP groups (ldap-roles mapper)"
   ansible.builtin.shell: |-
     {{ KEYCLOAK_COMMAND_PERMANENT_ADMIN_LOGIN }}
       {{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '
@@ -8,7 +8,7 @@
         "user-storage/{{ ldap_cmp_id | trim }}/mappers/{{ grp_mapper_id | trim }}/sync?direction=fedToKeycloak" \
         -r {{ KEYCLOAK_REALM }}
     '
-  listen: sync ldap groups
+  listen: sync-ldap-groups
   register: group_sync
   changed_when: true
   retries: 6

roles/web-app-keycloak/tasks/sso_proxy.yml

@@ -34,4 +34,4 @@
       {{ (sso_proxy_application_id | get_docker_paths(DIR_COMPOSITIONS)).directories.volumes
          }}{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.configuration_file') }}
   notify:
-    - compose up
+    - compose-up

roles/web-app-keycloak/tasks/update/05_ldap/main.yml

@@ -227,4 +227,4 @@
     realm: "{{ KEYCLOAK_REALM }}"
     assert_mode: "{{ MODE_ASSERT }}"
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-  notify: sync ldap groups
+  notify: sync-ldap-groups

roles/web-app-listmonk/tasks/02_manager_ops.yml

@@ -3,7 +3,7 @@
   stack_host_template:
     src: "config.toml.j2"
     dest: "{{ LISTMONK_CONFIG_HOST }}"
-  notify: compose up
+  notify: compose-up
 
 - meta: flush_handlers
 
@@ -47,7 +47,7 @@
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
   register: listmonk_settings
   changed_when: true
-  notify: container recreate
+  notify: container-recreate
   # rationale: async; settings apply overlapped, reaped below before the role ends
   async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
   poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

roles/web-app-littlejs/tasks/01_manager_ops.yml

@@ -9,8 +9,8 @@
     dest: "{{ LITTLEJS_INDEX_HOST_ABS }}"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "📄 Render LittleJS run.html for shorts"
   stack_host_template:
@@ -18,8 +18,8 @@
     dest: "{{ LITTLEJS_RUN_HOST_ABS }}"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🚿 flush compose for '{{ application_id }}'"
   meta: flush_handlers

roles/web-app-mastodon/tasks/01_overrides.yml

@@ -15,19 +15,14 @@
         content: |
           # frozen_string_literal: true
 
-          # Hard-disable SSL enforcement (HTTP-only deployments)
           Rails.application.config.force_ssl = false
-
-          # Remove middleware that performs the redirect + HSTS
           Rails.application.config.middleware.delete ActionDispatch::SSL if defined?(ActionDispatch::SSL)
-
-          # Defensive: ensure URLs default to http in this process
           Rails.application.routes.default_url_options[:protocol] = "http"
-      notify: compose up
+      notify: compose-up
 
     - name: "📦 MASTODON | Install OIDC http-discovery override initializer (HTTP-only)"
       ansible.builtin.copy:
         src: "00_oidc_http_discovery.rb"
         dest: "{{ MASTODON_OIDC_HTTP_DISCOVERY_FILE }}"
         mode: "0644"
-      notify: compose up
+      notify: compose-up

roles/web-app-matomo/tasks/02_manager_ops.yml

@@ -5,7 +5,7 @@
     dest: "{{ MATOMO_BOOTSTRAP_ENV_FILE }}"
     mode: "0640"
     force: true
-  notify: compose up
+  notify: compose-up
 
 - name: 🚿 flush docker service
   meta: flush_handlers

roles/web-app-matomo/tasks/03_install_path.yml

@@ -18,7 +18,7 @@
     file: 05_patch_database.yml
     apply:
       delegate_to: "{{ MATOMO_HOST_NODE }}"
-      notify: compose up
+      notify: compose-up
   when: (matomo_install_state.stdout | trim) == 'installed'
 
 - name: "🩹 Patch Trusted Hosts for {{ application_id }}"

roles/web-app-matomo/tasks/06_patch_trusted_hosts.yml

@@ -18,4 +18,4 @@
     SERVICE: "{{ MATOMO_SERVICE }}"
     LOCAL: "{{ DOCKER_REACH_HOST }}:{{ http_port }}"
   delegate_to: "{{ MATOMO_HOST_NODE }}"
-  notify: compose up
+  notify: compose-up

roles/web-app-matrix/tasks/flavor/ansible/04_run_playbook.yml

@@ -19,8 +19,8 @@
     dest: "{{ MATRIX_MDAD_RUNNER_BUILD_DIR }}/"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🎬 ansible-flavor: render the inner docker daemon.json from the network SPOT"
   stack_host_copy:
@@ -28,8 +28,8 @@
     dest: "{{ [ MATRIX_MDAD_RUNNER_BUILD_DIR, 'daemon.json' ] | path_join }}"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🔄 ansible-flavor: flush handlers (build runner image + start matrix-mdad)"
   ansible.builtin.meta: flush_handlers

roles/web-app-matrix/tasks/flavor/compose/01_docker.yml

@@ -37,13 +37,13 @@
     src: "flavor/compose/mautrix/{{ item.bridge_name }}.config.yml.j2"
     dest: "{{ lookup('container', application_id, 'directories.instance') }}mautrix/{{ item.bridge_name }}/config.yaml"
   loop: "{{ MATRIX_BRIDGES }}"
-  notify: compose up
+  notify: compose-up
 
 - name: ➕ add element configuration
   stack_host_template:
     src: "flavor/compose/element.config.json.j2"
     dest: "{{ MATRIX_ELEMENT_CONFIG_PATH_HOST }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "📄 Render Synapse config files (local + swarm peers)"
   ansible.builtin.include_tasks:
@@ -66,7 +66,7 @@
   stack_host_template:
     src: "compose.yml.j2"
     dest: "{{ [ lookup('container', application_id, 'directories.instance'),'compose.yml' ] | path_join }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "🐳 compose-mode lifecycle (pull + up)"
   include_tasks: 03_compose_pull_and_up.yml

roles/web-app-matrix/tasks/flavor/compose/04_webserver.yml

@@ -38,4 +38,4 @@
     http_port: "{{ MATRIX_SYNAPSE_PORT }}"
     proxy_service_key: synapse
     proxy_internal_port: "{{ MATRIX_SYNAPSE_CONTAINER_PORT }}"
-  notify: restart openresty
+  notify: restart-openresty

roles/web-app-mattermost/tasks/00_core.yml

@@ -5,7 +5,7 @@
   ansible.builtin.file:
     path: "{{ [lookup('nginx', 'directories.configuration.servers'), 'https', 'chat.' ~ DOMAIN_PRIMARY ~ '.conf'] | path_join }}"
     state: absent
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: "🧩 load docker, db and proxy for {{ application_id }}"
   include_role:

roles/web-app-mobilizon/tasks/main.yml

@@ -9,5 +9,5 @@
   stack_host_template:
     src: "config.exs.j2"
     dest: "{{ mobilizon_host_conf_exs_file }}"
-  notify: compose up
+  notify: compose-up
   when: IS_STACK_HOST | bool

roles/web-app-moodle/tasks/01_manager_ops.yml

@@ -13,7 +13,7 @@
     src: "nginx-moodle.conf.j2"
     dest: "{{ docker_compose.directories.instance | default(lookup('container', application_id, 'directories.instance')) }}/nginx.conf"
     mode: "0640"
-  notify: compose up
+  notify: compose-up
 
 - name: 🚿 flush docker service
   meta: flush_handlers

roles/web-app-moodle/tasks/02_build_context.yml

@@ -39,8 +39,8 @@
   loop_control:
     label: "{{ item.path }}"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "🔧 Ensure msmtp CA-bundle fact is set before rendering msmtprc"
   ansible.builtin.include_role:
@@ -57,8 +57,8 @@
     sys_svc_mail_msmtp_ca_bundle_override: /etc/ssl/certs/ca-certificates.crt
     sys_svc_mail_msmtp_in_container: true
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - name: "📄 Render PHP runtime tuning into compose context"
   stack_host_template:
@@ -66,5 +66,5 @@
     dest: "{{ [_moodle_build_dir, MOODLE_BUILD_FILES.runtime_ini] | path_join }}"
     mode: "0644"
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up

roles/web-app-n8n/tasks/00_core.yml

@@ -15,7 +15,7 @@
       - src: "{{ lookup('path_absolute', 'roles/web-app-n8n/files/hooks.js') }}"
         dest: "{{ N8N_HOOKS_FILE_HOST }}"
         mode: "0644"
-        notify: ["compose up"]
+        notify: ["compose-up"]
   when: N8N_SSO_ENABLED | bool
 
 - name: "🚿 Flush handlers so '{{ N8N_CONTAINER }}' restarts with the SSO hook mounted"

roles/web-app-navigator/tasks/main.yml

@@ -4,7 +4,6 @@
     name: pkgmgr-install
   vars:
     package_name: infinito-presentation
-    # package_notify: compose up
 
 - name: ⬇️ Get path of infinito-presentation using pkgmgr
   command: "{{ ansible_facts['env']['HOME'] }}/.venvs/pkgmgr/bin/pkgmgr path infinito-presentation"
@@ -21,4 +20,4 @@
 # Hack because it wasn't possible to fix an handler bug in pkgmgr install
 - name: „Trigger“ compose up
   command: /bin/true
-  notify: compose up
+  notify: compose-up

roles/web-app-nextcloud/tasks/01_fullstack.yml

@@ -14,8 +14,8 @@
     mode: "0755"
   when: IS_STACK_HOST | bool
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - when: NEXTCLOUD_WHITEBOARD_ENABLED | bool
   block:
@@ -31,7 +31,7 @@
       stack_host_template:
         src: "Dockerfiles/Whiteboard.j2"
         dest: "{{ NEXTCLOUD_WHITEBOARD_SERVICE_DOCKERFILE }}"
-      notify: compose build
+      notify: compose-build
 
 - name: "📁 create {{ NEXTCLOUD_HOST_CONF_ADD_PATH }}"
   file:

roles/web-app-odoo/tasks/01_manager_ops.yml

@@ -11,7 +11,7 @@
     dest: "{{ ODOO_CONF_FILE_HOST }}"
     mode: "0644"
   notify:
-    - compose up
+    - compose-up
 
 - name: "📋 Copy custom addons"
   copy:
@@ -19,8 +19,8 @@
     dest: "{{ ODOO_ADDONS_HOST }}"
     mode: "0644"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "📋 Copy Odoo entrypoint (first-boot db init)"
   copy:
@@ -28,8 +28,8 @@
     dest: "{{ ODOO_ENTRYPOINT_SCRIPT_HOST_ABS }}"
     mode: "0755"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "🐳 Docker Compose Up for '{{ application_id }}'"
   meta: flush_handlers

roles/web-app-openproject/tasks/01_manager_ops.yml

@@ -10,15 +10,15 @@
     src: Gemfile
     dest: "{{ [OPENPROJECT_PLUGINS_FOLDER,'Gemfile.plugins'] | path_join }}"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "⏳ Transferring await_migrations.sh to {{ OPENPROJECT_AWAIT_MIGRATIONS_ABS }}"
   stack_host_copy:
     src: shell/await_migrations.sh
     dest: "{{ OPENPROJECT_AWAIT_MIGRATIONS_ABS }}"
     mode: "0555"
-  notify: compose up
+  notify: compose-up
 
 - name: "📁 create {{ OPENPROJECT_DUMMY_DIR }}"
   file:

roles/web-app-opentalk/tasks/01_manager_ops.yml

@@ -5,7 +5,7 @@
     dest: "{{ [lookup('container', application_id, 'directories.volumes'), 'controller.toml'] | path_join }}"
     mode: "0644"
   notify:
-    - compose up
+    - compose-up
 
 - name: "📄 Render LiveKit config '{{ application_id }}'"
   stack_host_template:
@@ -13,7 +13,7 @@
     dest: "{{ [lookup('container', application_id, 'directories.volumes'), 'livekit.yaml'] | path_join }}"
     mode: "0644"
   notify:
-    - compose up
+    - compose-up
 
 - name: "📄 Render OpenTalk recorder config '{{ application_id }}'"
   stack_host_template:
@@ -21,7 +21,7 @@
     dest: "{{ [lookup('container', application_id, 'directories.volumes'), 'recorder.toml'] | path_join }}"
     mode: "0644"
   notify:
-    - compose up
+    - compose-up
 
 - name: "📂 Provision the OpenTalk Keycloak clients"
   include_tasks: 02_keycloak_client.yml

roles/web-app-peertube/tasks/02_fix-application-schema.yml

@@ -48,7 +48,7 @@
     config: "{{ lookup('database', application_id) }}"
     query: "{{ lookup('file', role_path ~ '/files/sql/backfill-application-defaults.sql') }}" # nocheck: database-query-raw  controller-read so the SQL travels to the remote swarm host that lacks the repo files
   register: _peertube_app_defaults
-  notify: compose up
+  notify: compose-up
 
 - name: "🔍 Resolve {{ application_id }} hosting node + container id"
   ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"

roles/web-app-peertube/tasks/oidc/enable.yml

@@ -44,7 +44,7 @@
       delay: 15
       until: peertube_oidc_install.rc == 0
       delegate_to: "{{ PEERTUBE_HOST_NODE }}"
-      notify: container recreate
+      notify: container-recreate
 
     # Exception: happy-path only; on failure the rescue leaves bumped limits so diagnostics reflect install-time state, and the next `compose up` restores compose.yml defaults.
     - name: "♻️ PEERTUBE | Restore compose-defined mem_limit"
@@ -69,7 +69,7 @@
   delay: 3
   until: _peertube_oidc_update is succeeded
   changed_when: _peertube_oidc_update.rows | default([]) | length > 0
-  notify: container recreate
+  notify: container-recreate
 
 - name: "🔎 Check if the running PeerTube has registered the OIDC plugin"
   shell: |
@@ -79,7 +79,7 @@
   failed_when: false
   changed_when: _peertube_oidc_registered.rc != 0
   delegate_to: "{{ PEERTUBE_HOST_NODE }}"
-  notify: container recreate
+  notify: container-recreate
 
 - name: "🚿 Flush the container recreation before verifying the OIDC registration"
   meta: flush_handlers

roles/web-app-penpot/tasks/main.yml

@@ -11,7 +11,7 @@
     src: "{{ lookup('path_absolute', 'roles/sys-ca-selfsigned/files/java-with-ca-trust.sh') }}"
     dest: "{{ [ lookup('container', application_id, 'directories.instance'), 'java-with-ca-trust.sh' ] | path_join }}"
     mode: "0755"
-  notify: compose up
+  notify: compose-up
 
 - name: "🚿 Flush docker service for '{{ application_id }}'"
   ansible.builtin.meta: flush_handlers

roles/web-app-pgadmin/tasks/configuration.yml

@@ -8,7 +8,7 @@
     src: servers.json.j2
     dest: "{{ pgadmin_host_server_file }}"
     mode: "0644"
-  notify: compose up
+  notify: compose-up
 
 - name: "📄 Render .pgpass file"
   stack_host_template:
@@ -17,4 +17,4 @@
     owner: "{{ PGADMIN_USER }}"
     group: "{{ PGADMIN_GROUP }}"
     mode: "0600"
-  notify: compose up
+  notify: compose-up

roles/web-app-pixelfed/tasks/01_manager_ops.yml

@@ -4,14 +4,14 @@
     src: "{{ PIXELFED_ENTRYPOINT_FILE }}"
     dest: "{{ PIXELFED_ENTRYPOINT_HOST_ABS }}"
     mode: "0755"
-  notify: compose up
+  notify: compose-up
 
 - name: "🚀 Deploy '{{ PIXELFED_WORKER_ENTRYPOINT_HOST_ABS }}'"
   ansible.builtin.copy:
     src: "{{ PIXELFED_WORKER_ENTRYPOINT_FILE }}"
     dest: "{{ PIXELFED_WORKER_ENTRYPOINT_HOST_ABS }}"
     mode: "0755"
-  notify: compose up
+  notify: compose-up
 
 - name: "✅ Ensure Pixelfed .env ownership and permissions for www-data"
   ansible.builtin.file:

roles/web-app-postmarks/tasks/00_core.yml

@@ -15,7 +15,7 @@
     - { src: "sso/header_auth.js", dest: "header_auth.js" }
     - { src: "sso/patch_server.js", dest: "patch_server.js" }
   notify:
-    - compose build
-    - compose up
+    - compose-build
+    - compose-up
 
 - include_tasks: utils/once/flag.yml

roles/web-app-prometheus/tasks/00_core.yml

@@ -11,7 +11,7 @@
   stack_host_template:
     src: "roles/web-app-prometheus/templates/nginx/prometheus.conf.j2"
     dest: "{{ [ lookup('nginx','directories.configuration.global'), 'prometheus.conf' ] | path_join }}"
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: "📄 Render Prometheus config files (local + swarm peers)"
   ansible.builtin.include_tasks:

roles/web-app-seaweedfs/tasks/00_core.yml

@@ -22,14 +22,14 @@
   stack_host_template:
     src: s3.json.j2
     dest: "{{ SEAWEEDFS_S3_CONFIG_PATH }}"
-  notify: compose up
+  notify: compose-up
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: "📄 Render role proxy nginx config"
   stack_host_template:
     src: nginx.conf.j2
     dest: "{{ [lookup('container', application_id, 'directories.volumes'), 'nginx.conf'] | path_join }}"
-  notify: compose up
+  notify: compose-up
   when: SEAWEEDFS_FRONTEND_ENABLED | bool
 
 - name: "▶️ Start the SeaweedFS stack"
@@ -55,7 +55,7 @@
     loop_var: seaweedfs_vhost
     label: "{{ seaweedfs_vhost[0] }}/{{ seaweedfs_vhost[1] }}"
   when: not (SEAWEEDFS_FRONTEND_ENABLED | bool)
-  notify: restart openresty
+  notify: restart-openresty
 
 - name: "⏳ Wait until the SeaweedFS S3 gateway answers"
   ansible.builtin.shell: >

roles/web-app-shopware/tasks/02_manager_ops.yml

@@ -5,8 +5,8 @@
     dest: "{{ SHOPWARE_INIT_HOST }}"
     mode: "0755"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "📄 Render framework.yaml (trusted proxies/headers/hosts)"
   copy:
@@ -14,7 +14,7 @@
     dest: "{{ SHOPWARE_FRAMEWORK_HOST }}"
     mode: "0644"
   notify:
-    - compose up
+    - compose-up
 
 - name: "📄 Render shopware.yaml (SeaweedFS S3 filesystem)"
   stack_host_template:
@@ -23,8 +23,8 @@
     mode: "0644"
   when: SHOPWARE_OBJSTORE_ENABLED | bool
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "🚿 Flush compose handlers"
   meta: flush_handlers

roles/web-app-socialhome/tasks/main.yml

@@ -10,7 +10,7 @@
     src: socialhome.toml.j2
     dest: "{{ SOCIALHOME_CONFIG_HOST_FILE }}"
     mode: "0444"
-  notify: compose up
+  notify: compose-up
 
 - name: "🐳 Finalize compose deploy for '{{ application_id }}'"
   include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/finalize.yml') }}"

roles/web-app-suitecrm/tasks/01_manager_ops.yml

@@ -4,7 +4,7 @@
     src: "php.ini.j2"
     dest: "{{ SUITECRM_PHP_CONFIG_HOST }}"
   notify:
-    - compose up
+    - compose-up
 
 - name: "📄 Render SuiteCRM LDAP mapping (local + swarm peers)"
   ansible.builtin.include_tasks:
@@ -19,8 +19,8 @@
     src: "{{ SUITECRM_ENTRYPOINT_SCRIPT_FILE }}"
     dest: "{{ SUITECRM_ENTRYPOINT_SCRIPT_HOST_ABS }}"
   notify:
-    - compose up
-    - compose build
+    - compose-up
+    - compose-build
 
 - name: "🐳 Docker Compose Up for '{{ application_id }}'"
   meta: flush_handlers

roles/web-app-taiga/tasks/02_manager_ops.yml

@@ -3,41 +3,41 @@
   template: # nocheck: stack-host-template (taiga compose dir, not project nginx tree)
     src: "taiga-gateway/taiga.conf.j2"
     dest: "{{ [compose_repository_path, 'taiga-gateway', 'taiga.conf'] | path_join }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "📄 render Dockerfile.taiga-back for custom auth-enabled backend image"
   stack_host_template:
     src: "Dockerfile.backend.j2"
     dest: "{{ [compose_repository_path, 'Dockerfile.taiga-back'] | path_join }}"
   when: TAIGA_PLUGINS_ENABLED | bool
-  notify: compose up
+  notify: compose-up
 
 - name: "📄 render Dockerfile.taiga-front for custom OIDC frontend image"
   stack_host_template:
     src: "Dockerfile.frontend.j2"
     dest: "{{ [compose_repository_path, 'Dockerfile.taiga-front'] | path_join }}"
   when: TAIGA_OIDC_ENABLED | bool
-  notify: compose up
+  notify: compose-up
 
 - name: "📋 Copy taiga config.append.py (OIDC/LDAP settings appended at runtime)"
   stack_host_template:
     src: "settings/config.append.py.j2"
     dest: "{{ TAIGA_CONFIG_APPEND_PATH }}"
   when: TAIGA_PLUGINS_ENABLED | bool
-  notify: compose up
+  notify: compose-up
 
 - name: "📋 copy taiga urls.py (OIDC URL routing)"
   stack_host_template:
     src: "settings/urls.py.j2"
     dest: "{{ TAIGA_URLS_PATH }}"
   when: TAIGA_OIDC_ENABLED | bool
-  notify: compose up
+  notify: compose-up
 
 - name: "📋 copy taiga frontend conf.json (loginFormType / contribPlugins)"
   stack_host_template:
     src: "settings/conf.json.j2"
     dest: "{{ TAIGA_FRONTEND_CONF_PATH }}"
-  notify: compose up
+  notify: compose-up
 
 - name: "🚿 Flush Taiga handlers"
   meta: flush_handlers

roles/web-app-wordpress/tasks/01_patch_config.yml

@@ -13,21 +13,21 @@
     container exec --user root {{ WORDPRESS_CONTAINER_ADDRESS }}
     sed -i "s/define(\s*'DB_HOST'\s*,\s*'[^']*'\s*);/define( 'DB_HOST', '{{ lookup('database', application_id, 'host') | sed_escape('/') }}:{{ lookup('database',
     application_id, 'port') | sed_escape('/') }}' );/i" {{ WORDPRESS_DOCKER_CONF_PATH }}
-  notify: compose up
+  notify: compose-up
 
 - name: 🔄 Update DB name in {{ WORDPRESS_CONFIG_FILE }}
   shell: >
     container exec --user root {{ WORDPRESS_CONTAINER_ADDRESS }}
     sed -i "s/define(\s*'DB_NAME'\s*,\s*'[^']*'\s*);/define( 'DB_NAME', '{{ lookup('database', application_id, 'name') | sed_escape('/') }}' );/i" {{ WORDPRESS_DOCKER_CONF_PATH
     }}
-  notify: compose up
+  notify: compose-up
 
 - name: 🔄 Update DB user in {{ WORDPRESS_CONFIG_FILE }}
   shell: >
     container exec --user root {{ WORDPRESS_CONTAINER_ADDRESS }}
     sed -i "s/define(\s*'DB_USER'\s*,\s*'[^']*'\s*);/define( 'DB_USER', '{{ lookup('database', application_id, 'username') | sed_escape('/') }}' );/i" {{ WORDPRESS_DOCKER_CONF_PATH
     }}
-  notify: compose up
+  notify: compose-up
 
 - name: 🔄 Update DB password in {{ WORDPRESS_CONFIG_FILE }}
   shell: >
@@ -35,7 +35,7 @@
     -e PATCH_PASSWORD={{ lookup('database', application_id, 'password') | sed_escape('/') | quote }}
     {{ WORDPRESS_CONTAINER_ADDRESS }}
     sh -c "sed -i \"s/define(\\s*'DB_PASSWORD'\\s*,\\s*'[^']*'\\s*);/define( 'DB_PASSWORD', '\${PATCH_PASSWORD}' );/i\" {{ WORDPRESS_DOCKER_CONF_PATH }}"
-  notify: compose up
+  notify: compose-up
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: "🚿 Flush handlers to reinitialize new database credentials"