The three credential tasks exec into the container the moment the service
reports up, which races the directory's own startup and fails the run.
Retry until the exec succeeds instead.
The first task also ran slappasswd with the bind password as an argument
and the second carried the resulting hash, both in clear text in the task
result, so both now honour MASK_CREDENTIALS_IN_LOGS.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add tests/lint/repository/test_name_emoji_and_length.py: every Ansible task
name and GitHub Actions workflow/job/step name must start with an emoji (first
char not 0-9/A-Za-z) and be <= 80 chars.
- emit emoji names at the source: cli/build/include generator now writes
"🔧 setup <app>" / "🚿 flush handlers after <app>" so generated
tasks/groups/*-roles.yml satisfy the convention too
- convert existing task/step/job/workflow names to emoji-prefixed, choosing a
task-fitting icon per action (📦 install, ✅ ensure, 🔍 probe, 🥾 bootstrap,
🚀 deploy, 🧩 service-module load, ⬇️ checkout, 📂 include-routines, ...)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The openldap container is manager-pinned (meta/services.yml default_placement: manager), but the role's setup tasks run on every node. The six tasks that container-exec via OPENLDAP_CONTAINER_ADDRESS (which expands to a manager-only resolve-container-id subshell in swarm) therefore failed on the workers with 'resolve-container-id: must run on a Swarm manager node / invalid container name or ID: value is empty' (TASK 'Query data backend DN' on svc-bkp-container-2-local-swarm-wrk-01/02, rc=1). Add delegate_to: STACK_HOST + run_once: true to each of the six (01_core: bind check, module DN, query databases; 02_credentials: query DN, slappasswd, set RootDN/RootPW), mirroring the committed svc-db-mariadb pattern; run_once propagates the registered results to all hosts so the intervening all-host set_fact tasks still resolve. Compose-safe: STACK_HOST falls back to inventory_hostname and run_once is a no-op on a single host.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a mode-aware `container_address` lookup plugin and a
`resolve-container-id` helper script that resolve swarm task IDs at
exec time (compose mode returns bare names unchanged). Migrates ~25
roles + ~28 task files from `command:` to `shell:` so the lookup's
`$(...)` subshell evaluates correctly, and extends `database` lookup
with an `address` key for cross-role DB exec.
Three new lint tests enforce the contract: every container exec
target goes through the resolver, lives behind an IS_STACK_HOST gate
(walks the include graph one hop deep), and uses `shell:` rather than
`command:` when the target is a Jinja reference. Existing nocheck
suppressions on bare-name DB exec sites (nextcloud redis, listmonk,
moodle OIDC, mailu) are replaced with the lookup-based form.
Fixes the systemd Environment= injection in sys-ctl-cln-disc-space
(it never expanded $(...)) by passing STACK / SERVICE_KEY parts and
resolving inside the script. Extracts shopware admin and mediawiki
extension install bodies into dedicated .sh files invoked via env.
Rewrites password-bearing shell tasks to either `| quote` directly or
the `-e VAR=... | quote` + `sh -c '... ${VAR} ...'` env-bridge pattern.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Migrate `svc-db-openldap` from `bitnamilegacy/openldap` to a locally built `infinito/openldap:local` image (Debian bookworm-slim) with a bootstrap `entrypoint.sh` that initializes `slapd.d` and an MDB backend from `LDAP_SUFFIX/LDAP_ROOT_DN/LDAP_ROOT_PW`.
* Add Dockerfile + entrypoint + healthcheck scripts
* Persist config + data in separate volumes (`/etc/ldap/slapd.d`, `/var/lib/ldap`)
* Switch cn=config operations to `ldapi:///` with SASL EXTERNAL (`-Q -Y EXTERNAL`)
* Simplify env template to only `LDAP_SUFFIX`, `LDAP_ROOT_DN`, `LDAP_ROOT_PW`
* Refactor docker init into `02_docker.yml` and update compose template (build context)
* Update LDAP tasks/handlers to use `OPENLDAP_BIND_DN/OPENLDAP_BIND_PW`
* Remove outdated Bitnami-specific docs and credential reset logic
https://chatgpt.com/share/6965c921-3304-800f-9e8f-d2f10d273f1b
Bitnami OpenLDAP images do not allow write access to cn=config via
SASL/EXTERNAL (peercred), even when executed as root. This caused
"Insufficient access (50)" errors during module, overlay and password
configuration.
Switch all cn=config modifications (modules, overlays, olcRootPW) to
simple bind authentication using the configuration admin DN and password.
This makes LDAP provisioning reliable across all distros and CI runners.
https://chatgpt.com/share/696574b0-ebac-800f-aee6-dfd9b27d74cd
- Add global_install flag to sys-pip-install role (default: false)
- Allow optional system-wide installs via pip3 with --break-system-packages
- Install python-ldap via pip in Ansible interpreter for OpenLDAP role
- Refactor svc-db-openldap tasks into 01_core.yml with run-once gating
- Fix environment handling for conditional global pip installs
- Enable global pip installs for CLI tools (gitcon, ldapsm, backup tools, cleanup tools)
https://chatgpt.com/share/6963dd5d-cae0-800f-b8d7-82a3808be634
kevinveenbirkenbachandClaude Opus 5