Improve MariaDB readiness handling

roles/svc-db-mariadb/tasks/01_core.yml

@@ -14,13 +14,17 @@
     global_install: true
   when: MARIADB_EXPOSE_LOCAL | bool
 
-- name: "Wait until the MariaDB container with hostname '{{ MARIADB_NAME }}' is healthy"
+- name: "Wait until the MariaDB container with hostname '{{ MARIADB_NAME }}' is running"
+  # We only wait for the container process here. A healthcheck can stay red
+  # when the persisted volume still has an older root password, and that would
+  # block the recovery reset path below. The login probe below retries so we
+  # do not treat normal startup lag as a password mismatch.
   community.docker.docker_container_info:
     name: "{{ MARIADB_NAME }}"
   register: db_info
   until:
     - db_info.container is defined
-    - db_info.container.State.Health.Status == "healthy"
+    - db_info.container.State.Running
   retries: 30
   delay: 5
 
@@ -36,6 +40,9 @@
       register: mariadb_login_desired
       changed_when: false
       failed_when: false
+      retries: 30
+      delay: 5
+      until: mariadb_login_desired.rc == 0
 
     - name: "Ensure MariaDB root password matches desired value"
       include_tasks: 03_reset_root_password.yml

roles/svc-db-mariadb/templates/compose.yml.j2

@@ -19,7 +19,7 @@
     healthcheck:
       test:
         - "CMD-SHELL"
-        - "mariadb {% if MARIADB_EXPOSE_LOCAL %}-h127.0.0.1 -P3306{% endif %} -u root -p$MARIADB_ROOT_PASSWORD -e 'SHOW DATABASES;'"
+        - "mariadb {% if MARIADB_EXPOSE_LOCAL %}-h127.0.0.1 -P3306{% endif %} -u root -p\"$MARIADB_ROOT_PASSWORD\" -e 'SHOW DATABASES;'"
       interval: 10s
       timeout: 5s
       retries: 18