---
# Always defer the OIDC-activating restart to the service-loader post-load
# flush: mid-play the issuer probe can hit a stale Keycloak that a later round
# step replaces, leaving Stalwart bound to a dead issuer. The flush runs after
# the loader finished, i.e. against the final Keycloak (11_oidc_restart still
# waits for the issuer and fails loudly if it never comes up).

- name: "📥 Defer the OIDC restart to the service-loader post-load flush"
  ansible.builtin.set_fact:
    stalwart_oidc_restart_pending: true

- name: "📥 Queue the deferred restart"
  include_role:
    name: sys-service-loader
    tasks_from: list_or_shoot.yml
  vars:
    list_or_shoot_roles:
      - web-app-stalwart