fix(web-app-snipe-it): stop reseeding the demo database on every deploy

tasks/01_install.yml ran `php artisan db:seed --force` on every deploy
and role sync. Snipe-IT's upstream seeders truncate the users, inventory
and settings tables and recreate the demo data: about 2100 users, among
them superusers with the public upstream factory password, and an LDAP
setting against ldap.forumsys.com. Every deploy therefore wiped real
users and assets and opened known superuser accounts.

The task now only creates the settings row Snipe-IT needs before the
LDAP and admin steps, through files/php/ensure_settings.php, and only
when no row exists. SNIPE_IT_INITIAL_SETTINGS carries the values the
setup wizard writes. Existing rows are left untouched.

Installs seeded before this change keep the demo users and the demo
LDAP setting; TODO.md records both.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

roles/web-app-snipe-it/TODO.md

@@ -0,0 +1,4 @@
+# TODO
+
+- Existing installs that were seeded before the demo seeder was removed still hold the demo users, among them superusers with the upstream factory password; their removal is an open operator decision.
+- Installs seeded before the demo seeder was removed keep `ldap_enabled = 1` against `ldap://ldap.forumsys.com` while the `ldap` service is off, because `tasks/02_ldap.yml` only runs with `ldap` on; the upstream login controller then attempts an LDAP login with the submitted user name and password before local authentication (one form sign-in took 1.9 s on the local stack). Fresh installs do not get these settings. Options: write `ldap_enabled = 0` through the Setting model when the service is off.

roles/web-app-snipe-it/files/php/ensure_settings.php

@@ -0,0 +1,19 @@
+<?php
+// nocheck: mirrored-unit-test - boots Snipe-IT's Laravel kernel through bootstrap/app.php and writes the settings row
+// of the live install; top-level procedural code with nothing to load without that install
+require "vendor/autoload.php";
+$app = require "bootstrap/app.php";
+$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();
+
+if (\App\Models\Setting::query()->exists()) {
+    echo "unchanged\n";
+    exit(0);
+}
+
+$settings = new \App\Models\Setting;
+$settings->forceFill(json_decode(getenv('SNIPE_IT_INITIAL_SETTINGS'), true, 512, JSON_THROW_ON_ERROR));
+if (! $settings->save()) {
+    fwrite(STDERR, json_encode($settings->getErrors()) . "\n");
+    exit(1);
+}
+echo "changed\n";

roles/web-app-snipe-it/tasks/01_install.yml

@@ -35,13 +35,12 @@
     or ('Migrated:' in snipeit_migrate.stdout)
   failed_when: snipeit_migrate.rc != 0
 
-- name: 🌱 Seed Snipe-IT database (optional, safe to rerun if seeder is idempotent)
-  ansible.builtin.shell: >-
-    container exec -i
-    -e APP_KEY="{{ SNIPE_IT_APP_KEY }}"
-    -e XDG_CONFIG_HOME=/tmp
-    {{ SNIPE_IT_CONTAINER_ADDRESS }}
-    php -d memory_limit={{ lookup('service_memory_mb', application_id, SNIPE_IT_SERVICE, 0.25) }}M artisan db:seed --force
-  register: snipeit_seed
-  changed_when: "'Seeding:' in snipeit_seed.stdout"
-  failed_when: snipeit_seed.rc != 0
+- name: "⚙️ Create the Snipe-IT settings row when none exists"
+  ansible.builtin.shell:
+    cmd: >-
+      container exec -i
+      -e SNIPE_IT_INITIAL_SETTINGS={{ SNIPE_IT_INITIAL_SETTINGS | to_json | quote }}
+      {{ SNIPE_IT_CONTAINER_ADDRESS }} php
+    stdin: "{{ lookup('file', 'php/ensure_settings.php') }}"
+  register: snipeit_settings
+  changed_when: snipeit_settings.stdout_lines | last == 'changed'

roles/web-app-snipe-it/vars/main.yml

@@ -14,6 +14,19 @@ SNIPE_IT_SERVICE: "{{ entity_name }}"
 SNIPE_IT_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, SNIPE_IT_SERVICE) }}"
 SNIPE_IT_APP_KEY: "{{ lookup('config', application_id, 'secrets.credentials.app_key') }}"
 
+SNIPE_IT_INITIAL_SETTINGS:
+  alert_email: "{{ lookup('users', 'administrator').email }}"
+  alerts_enabled: 1
+  auto_increment_assets: 0
+  brand: 1
+  default_currency: "USD"
+  full_multiple_companies_support: 0
+  locale: "{{ HOST_LL_CC }}"
+  next_auto_tag_base: 1
+  pwd_secure_min: 10
+  site_name: "Snipe-IT"
+  zerofill_count: 0
+
 SNIPE_IT_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 SNIPE_IT_TLS_ENABLED: "{{ lookup('tls', application_id, 'enabled') | bool }}"