---
# Always defer the OIDC refresh to the service-loader post-load flush: mid-play
# the issuer probe can hit a stale Keycloak that a later round step replaces.
# The flush runs after the loader finished, i.e. against the final Keycloak
# (10_oidc_refresh still waits for the issuer and fails loudly if absent).

- name: "📥 Defer the OIDC refresh to the service-loader post-load flush"
  ansible.builtin.set_fact:
    mailu_oidc_restart_pending: true

- name: "📥 Queue the deferred refresh"
  include_role:
    name: sys-service-loader
    tasks_from: list_or_shoot.yml
  vars:
    list_or_shoot_roles:
      - web-app-mailu