fix(web-app-nextcloud): delegate mattermost oauth

roles/web-app-nextcloud/tasks/addons/integration_mattermost.yml

@@ -5,22 +5,13 @@
 # partner and wires the returned credentials into Nextcloud.
 - name: 🔍 Resolve Mattermost partner coupling facts
   set_fact:
-    nextcloud_mm_container: "{{ lookup('config', 'web-app-mattermost', 'services.mattermost.name') }}"
-    nextcloud_mm_instance_dir: "{{ lookup('container', 'web-app-mattermost', 'directories.instance') }}"
     nextcloud_mm_base_url: "{{ lookup('tls', 'web-app-mattermost', 'url.base') }}"
-    nextcloud_mm_local_url: "http://localhost:{{ lookup('config', 'web-app-mattermost', 'services.mattermost.ports.local.http') }}"
+    nextcloud_mm_local_url: "http://localhost:{{ lookup('config', 'web-app-mattermost', 'services.mattermost.ports.internal.http') }}"
     nextcloud_mm_redirect_path: "/apps/integration_mattermost/oauth-redirect"
+    nextcloud_mm_exec_chdir: "{{ lookup('container', 'web-app-mattermost', 'directories.instance') if DEPLOYMENT_MODE == 'compose' else omit }}"
   changed_when: false
 
-- name: 🔍 Probe whether the Mattermost partner container is running
-  command: >
-    container inspect -f '{% raw %}{{.State.Running}}{% endraw %}' {{ nextcloud_mm_container }}
-  register: nextcloud_mm_partner_running
-  changed_when: false
-  failed_when: false
-
 - name: 🔧 Provision the bidirectional Mattermost <-> Nextcloud OAuth coupling
   include_tasks: integration_mattermost_provision.yml
   when:
     - IS_STACK_HOST | bool
-    - (nextcloud_mm_partner_running.stdout | trim) == 'true'

roles/web-app-nextcloud/tasks/addons/integration_mattermost_provision.yml

@@ -1,10 +1,21 @@
 ---
+- name: "🔍 Resolve Mattermost hosting node + container id"
+  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
+  vars:
+    resolve_service_key: mattermost
+    resolve_service_name: "{{ lookup('container_service', 'web-app-mattermost', 'mattermost') }}"
+    resolve_output_prefix: NEXTCLOUD_MM
+    resolve_compose_cid: "{{ lookup('container_address', 'web-app-mattermost', 'mattermost') }}"
+    resolve_converge_retries: 120
+    resolve_converge_delay: 5
+
 - name: ⏳ Wait until Mattermost mmctl local mode is ready
-  shell: >
-    container exec -i {{ NEXTCLOUD_MATTERMOST_CONTAINER_ADDRESS }}
+  shell: >- # nocheck: container-exec-resolver  NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
+    container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
     /mattermost/bin/mmctl --local system status
   args:
-    chdir: "{{ nextcloud_mm_instance_dir }}"
+    chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
+  delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
   register: nextcloud_mm_ready
   retries: 60
   delay: 5
@@ -13,20 +24,22 @@
   failed_when: nextcloud_mm_ready.rc != 0 and nextcloud_mm_ready.attempts | default(0) >= 60
 
 - name: 🟢 Enable the Mattermost OAuth 2.0 service provider (required for the connector)
-  shell: >
-    container exec -i {{ NEXTCLOUD_MATTERMOST_CONTAINER_ADDRESS }}
+  shell: >- # nocheck: container-exec-resolver  NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
+    container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
     /mattermost/bin/mmctl --local config set ServiceSettings.EnableOAuthServiceProvider true
   args:
-    chdir: "{{ nextcloud_mm_instance_dir }}"
+    chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
+  delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
   register: nextcloud_mm_oauth_provider
   changed_when: "'true' in nextcloud_mm_oauth_provider.stdout"
 
 - name: ⚙️ Generate a short-lived admin personal access token for OAuth provisioning
-  shell: >
-    container exec -i {{ NEXTCLOUD_MATTERMOST_CONTAINER_ADDRESS }}
+  shell: >- # nocheck: container-exec-resolver  NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
+    container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
     /mattermost/bin/mmctl --local token generate {{ lookup('users', 'administrator').username }} infinito-nc-oauth-provision --json
   args:
-    chdir: "{{ nextcloud_mm_instance_dir }}"
+    chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
+  delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
   register: nextcloud_mm_pat
   changed_when: true
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
@@ -40,16 +53,26 @@
 - name: 🔧 Provision Mattermost OAuth app for Nextcloud and capture creds (idempotent)
   ansible.builtin.command:
     argv:
+      - container
+      - exec
+      - -i
+      - -e
+      - "MM_LOCAL_URL={{ nextcloud_mm_local_url }}"
+      - -e
+      - "MM_TOKEN={{ nextcloud_mm_token }}"
+      - -e
+      - "MM_APP_NAME=Nextcloud"
+      - -e
+      - "NC_BASE_URL={{ NEXTCLOUD_URL }}"
+      - -e
+      - "NC_REDIRECT_PATH={{ nextcloud_mm_redirect_path }}"
+      - -e
+      - "MM_HOMEPAGE={{ NEXTCLOUD_URL }}"
+      - "{{ NEXTCLOUD_MM_LOCAL_CID }}" # nocheck: container-exec-resolver  resolved CID from resolve_host_cid, delegated to the hosting node
       - bash
       - -s
     stdin: "{{ lookup('file', 'mattermost/provision_oauth_app.sh') }}"
-  environment:
-    MM_LOCAL_URL: "{{ nextcloud_mm_local_url }}"
-    MM_TOKEN: "{{ nextcloud_mm_token }}"
-    MM_APP_NAME: Nextcloud
-    NC_BASE_URL: "{{ NEXTCLOUD_URL }}"
-    NC_REDIRECT_PATH: "{{ nextcloud_mm_redirect_path }}"
-    MM_HOMEPAGE: "{{ NEXTCLOUD_URL }}"
+  delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
   register: nextcloud_mm_provision
   changed_when: false
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
@@ -90,10 +113,11 @@
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: 🚫 Revoke the short-lived admin personal access token
-  shell: >
-    container exec -i {{ NEXTCLOUD_MATTERMOST_CONTAINER_ADDRESS }}
+  shell: >- # nocheck: container-exec-resolver  NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
+    container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
     /mattermost/bin/mmctl --local token revoke {{ nextcloud_mm_token_id }}
   args:
-    chdir: "{{ nextcloud_mm_instance_dir }}"
+    chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
+  delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
   changed_when: true
   failed_when: false

roles/web-app-nextcloud/vars/main.yml

@@ -42,7 +42,6 @@ NEXTCLOUD_IMAGE: "{{ lookup('config', application_id, 'services.'~ NEXTCLOUD_SER
 NEXTCLOUD_CONTAINER: "{{ lookup('config', application_id, 'services.'~ NEXTCLOUD_SERVICE ~'.name') }}"
 NEXTCLOUD_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, NEXTCLOUD_SERVICE) }}"
 
-NEXTCLOUD_MATTERMOST_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-mattermost', 'mattermost') }}"
 NEXTCLOUD_ZAMMAD_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-zammad', 'railsserver') }}"
 
 NEXTCLOUD_PROXY_SERVICE: "proxy"