Prosody keeps an account's first password. The image's init registers
focus and jvb only once, so after a credential rotation it prints
"User exists" and keeps the old passwords, while jicofo and the
videobridge start with the new ones. Jicofo then fails with
"SASLError using SCRAM-SHA-1: not-authorized" and no conference can
start.
After compose up the role now deletes and re-registers both accounts
with their current passwords, through the container_address lookup so
it works in compose and swarm.
Found by the full-cycle gate of #1165, whose second pass runs after a
credential rotation.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The mod_auth_ldap2 override redeclares VirtualHost "meet.jitsi" with
authentication = "ldap2". It was staged whenever LDAP was enabled, also
with SSO, where JITSI_AUTH_TYPE is internal and ENABLE_AUTH is false:
the web client then logs in anonymously, Prosody offers no matching
mechanism, and every conference join fails with
"connfail[no-auth-mech]" and reloads every 17 seconds. The role's own
spec only reaches the prejoin lobby, so it never noticed.
The override is now staged only when JITSI_AUTH_TYPE is ldap, and an
override left by an earlier deploy is removed otherwise.
Found by the new Matrix Jitsi spec against the shared Jitsi (#1165).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A handler name was doing two jobs at once: the line an operator reads in the
play output, and the identifier a `notify:` binds to. The two pull in opposite
directions -- the log wants "restart the SSH service, with diagnostics", the
binding wants a token that survives quoting, YAML flow style and a shell
round-trip -- and a name that changes for readability silently changes which
handler runs.
Every handler that a notify reached by name now carries a `listen:` with that
exact wording, so the binding is explicit before anything is renamed. The
topics themselves become identifiers: `compose up` reads `compose-up`,
`Restart NFS ganesha` reads `restart-nfs-ganesha`, 22 of them across both
sides of every notify. Where the topic is assembled at runtime, both branches
moved together: the conditional in sys-service carries two literals, and the
LDAP renderer interpolates `import-{{ folder }}-ldif-files`, which is what
makes those handlers reachable at all.
Freed from the binding, the names take the emoji prefix every other task line
already has.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add tests/lint/repository/test_task_file_numbering.py: numbered task
files use exactly two leading digits, a numbered *_core.yml must be
00_core.yml, per directory the numbers are unique/consecutive and start
at 01 (00 with a core file), numbered includes appear in ascending
order, and shared helpers live in tasks/utils/ instead of the numbered
chain.
Apply it across every role: rename NN_core.yml to 00_core.yml with a
consecutive down-shift of the siblings, move letter-suffix children into
a subdirectory named after their parent task, relocate helpers included
from more than one place into tasks/utils/, and update every reference
(include_tasks, path_absolute, .ansible-lint-ignore, requirement docs).
Legacy narration comments in the touched files are deleted; the upstream
xwiki.properties reference block opts out via nocheck. The unused
MAILU_IP6_PUBLIC var (only ever named in now-removed comments) is dropped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5