kevinveenbirkenbachandClaude Opus 5.5 d6c207f395 fix(svc-swarm-node): reload the ingress guard without a role include ...

Every swarm deploy of PR #1114 stopped at the sys-svc-compose handler that
reloads the guard after `docker stack deploy`:

    [ERROR]: Using 'ansible.builtin.include_role' as a handler is not supported.
    Origin: roles/svc-swarm-node/tasks/utils/ingress_guard/refresh.yml:9:3

The handler includes refresh.yml, and ansible-core refuses a role include
anywhere below a handler (playbook/helpers.py: `use_handlers` propagates
into included task files). The join path ran the same file as a plain task
and passed, which is why the guard loaded before the join and failed only
after the first stack deploy (CI run 39754950746: SuiteCRM#2 on CentOS and
the workspace job's MariaDB swarm drill on Fedora).

refresh.yml now includes svc-net-firewall's 02_fragment.yml as a task file.
The fragment's naming (directory, source, file, table) lives in the role's
vars/main.yml, which a task include does not load, so refresh.yml reads that
file through include_vars under its own name and hands the four values to the
include. The vars file stays the single definition, and the namespaced load
cannot shadow FIREWALL_FRAGMENT_ROLE for a later include of the role.

Refs #1089

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-22 18:39:25 +02:00

..

ingress_guard

…