fix(nextcloud): let occ read a credential that starts with a dash

Symfony ArgvInput reads a token beginning with a dash as an option, so passing the secret as a separate token after --value handed occ two tokens and occ reported the option as missing its value. Doorkeeper mints base64url secrets, so roughly one run in 43 produced one starting with a dash and the OpenProject provisioning died with: The "--value" option requires a value.

The equals form is unambiguous: Symfony splits at the first equals sign and takes everything after it as the value. The quote filter replaces the hand-written single quotes and stays shell-safe. Note that shlex leaves a leading-dash value unquoted, so the equals form is what carries the fix, not the quoting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-nextcloud/tasks/addons/integration_openai.yml

@@ -20,7 +20,7 @@
 - name: 🔧 Provision integration_openai api_key for the Flowise/LiteLLM backend
   shell: >
     {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:set integration_openai api_key
-    --value '{{ nextcloud_openai_flowise_api_key }}'
+    --value={{ nextcloud_openai_flowise_api_key | quote }}
   register: nextcloud_openai_set_api_key
   changed_when: nextcloud_openai_set_api_key.stdout is search(' set to ')
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

roles/web-app-nextcloud/tasks/addons/integration_openproject_provision.yml

@@ -57,7 +57,7 @@
 - name: ⬆️ Push the OpenProject OAuth application credentials into Nextcloud
   shell: >
     {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:set integration_openproject {{ item.key }}
-    --value '{{ item.value }}'
+    --value={{ item.value | quote }}
   loop:
     - { key: "authorization_method", value: "oauth2" }
     - { key: "openproject_client_id", value: "{{ nextcloud_op_oauth.openproject_client_id }}" }
@@ -88,7 +88,7 @@
     - name: ⬆️ Push the Nextcloud OAuth2 client id into integration_openproject
       shell: >
         {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:set integration_openproject nc_oauth_client_id
-        --value '{{ nextcloud_op_ncclient.clientId }}'
+        --value={{ nextcloud_op_ncclient.clientId | quote }}
       changed_when: true
       no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 

roles/web-app-nextcloud/tasks/addons/integration_suitecrm_provision.yml

@@ -35,7 +35,7 @@
 - name: 🔗 Link the SuiteCRM OAuth password client into integration_suitecrm
   shell: >
     {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:set integration_suitecrm {{ item.key }}
-    --value '{{ item.value }}'
+    --value={{ item.value | quote }}
   loop:
     - { key: "oauth_instance_url", value: "{{ nextcloud_crm_base_url }}" }
     - { key: "client_id", value: "{{ nextcloud_crm_client_id }}" }