refactor(collabora): float the singleton instead of pinning it to the manager

The manager pin existed only because the coolconfig setup execed the task via the manager-only resolve-container-id helper. Replace default_placement: manager with replicas: 1 (coolwsd holds open-document sessions in kit-process memory and the ingress has no WOPISrc affinity, so one replica stays correct) and run the coolconfig tasks through resolve_host_cid: LOCAL_CID exec delegated to the hosting node, so the task may land on any node. The dead COLLABORA_DOCKER_CONF_EXEC var is removed; compose behavior is unchanged (HOST_NODE=self, bare container name).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/web-svc-collabora/meta/services.yml

@@ -12,8 +12,8 @@ redis:
   enabled: false
   shared: "{{ 'svc-db-redis' in group_names }}"
 collabora:
-  # nocheck: default-placement-manager  single-instance office server; deploy-time coolconfig runs `container exec` on STACK_HOST, which reaches the task only when it is placed on the manager
-  default_placement: manager
+  # nocheck: single-replica
+  replicas: 1
   bond: 1
   enabled: true
   shared: true

roles/web-svc-collabora/tasks/01_core.yml

@@ -14,15 +14,16 @@
 - name: "🖥️ Collabora stack-host-only coolconfig setup"
   when: IS_STACK_HOST | bool
   block:
-    - name: "⏳ Collabora resolve | Wait for collabora task to converge"
-      ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/wait_converged.yml') }}"
+    - name: "🔍 Resolve collabora hosting node + container id"
+      ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
       vars:
-        wait_service_key: "{{ entity_name }}"
-        wait_retries: 600
-        wait_delay: 2
+        resolve_service_key: collabora
+        resolve_output_prefix: COLLABORA
+        resolve_compose_cid: "{{ COLLABORA_CONTAINER_ADDRESS }}"
 
     - name: 🔄 Update Collabora systemplate to include new fonts
-      shell: "{{ COLLABORA_DOCKER_CONF_EXEC }} update-system-template"
+      shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+        container exec {{ COLLABORA_LOCAL_CID | quote }} coolconfig update-system-template
       register: collabora_fonts
       changed_when: >
         (not ASYNC_ENABLED | bool )
@@ -30,9 +31,11 @@
         ('updated' in (collabora_fonts.stdout | default('')))
       async: "{{ ASYNC_TIME  if (ASYNC_ENABLED |  bool) else omit }}"
       poll: "{{ ASYNC_POLL if (ASYNC_ENABLED |  bool) else omit }}"
+      delegate_to: "{{ COLLABORA_HOST_NODE }}"
 
     - name: 🖥️ Allow Nextcloud host IP for Collabora preview conversion
-      shell: "{{ COLLABORA_DOCKER_CONF_EXEC }} set net.post_allow.host {{ networks.internet.ip4 }}"
+      shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+        container exec {{ COLLABORA_LOCAL_CID | quote }} coolconfig set net.post_allow.host {{ networks.internet.ip4 }}
       register: collabora_preview
       changed_when: >
         (not ASYNC_ENABLED | bool )
@@ -40,3 +43,4 @@
         ('already present' not in (collabora_preview.stdout | default('')))
       async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
       poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
+      delegate_to: "{{ COLLABORA_HOST_NODE }}"

roles/web-svc-collabora/vars/main.yml

@@ -7,7 +7,6 @@ http_port: "{{ lookup('config', application_id, 'services.collabora.ports.local.
 
 COLLABORA_CONTAINER: "{{ lookup('config', application_id, 'services.collabora.name') }}"
 COLLABORA_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
-COLLABORA_DOCKER_CONF_EXEC: "container exec {{ COLLABORA_CONTAINER_ADDRESS }} coolconfig"
 COLLABORA_ALLOWED_DOMAINS: "(.*\\.|){{ DOMAIN_PRIMARY | regex_replace('\\.', '\\\\.') }}"
 COLLABORA_ALLOWED_HOSTS: "{{ lookup('domain','web-app-nextcloud') }}"
 COLLABORA_DISCOVERY_PATH: "/hosting/discovery"