mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
d6c207f395
Every swarm deploy of PR #1114 stopped at the sys-svc-compose handler that reloads the guard after `docker stack deploy`: [ERROR]: Using 'ansible.builtin.include_role' as a handler is not supported. Origin: roles/svc-swarm-node/tasks/utils/ingress_guard/refresh.yml:9:3 The handler includes refresh.yml, and ansible-core refuses a role include anywhere below a handler (playbook/helpers.py: `use_handlers` propagates into included task files). The join path ran the same file as a plain task and passed, which is why the guard loaded before the join and failed only after the first stack deploy (CI run 39754950746: SuiteCRM#2 on CentOS and the workspace job's MariaDB swarm drill on Fedora). refresh.yml now includes svc-net-firewall's 02_fragment.yml as a task file. The fragment's naming (directory, source, file, table) lives in the role's vars/main.yml, which a task include does not load, so refresh.yml reads that file through include_vars under its own name and hands the four values to the include. The vars file stays the single definition, and the namespaced load cannot shadow FIREWALL_FRAGMENT_ROLE for a later include of the role. Refs #1089 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
31 lines
1.3 KiB
YAML
31 lines
1.3 KiB
YAML
---
|
|
- name: "🔎 Swarm ingress guard | Read the published ports and the swarm nodes"
|
|
ansible.builtin.include_tasks:
|
|
file: "{{ lookup('path_absolute', 'roles/svc-swarm-node/tasks/utils/ingress_guard/read.yml') }}"
|
|
apply:
|
|
run_once: true
|
|
delegate_to: "{{ STACK_HOST }}"
|
|
|
|
- name: "📄 Swarm ingress guard | Load the fragment naming of svc-net-firewall"
|
|
ansible.builtin.include_vars:
|
|
file: "{{ lookup('path_absolute', 'roles/svc-net-firewall/vars/main.yml') }}"
|
|
name: swarm_ingress_firewall
|
|
|
|
- name: "🛡️ Swarm ingress guard | Reload the bound on every swarm node"
|
|
ansible.builtin.include_tasks:
|
|
file: "{{ lookup('path_absolute', 'roles/svc-net-firewall/tasks/02_fragment.yml') }}"
|
|
apply:
|
|
delegate_to: "{{ swarm_ingress_guard_node }}"
|
|
vars:
|
|
FIREWALL_FRAGMENT_ROLE: svc-swarm-node
|
|
FIREWALL_FRAGMENT_DIR: "{{ swarm_ingress_firewall.FIREWALL_FRAGMENT_DIR }}"
|
|
FIREWALL_FRAGMENT_SRC: "{{ swarm_ingress_firewall.FIREWALL_FRAGMENT_SRC }}"
|
|
FIREWALL_FRAGMENT_FILE: "{{ swarm_ingress_firewall.FIREWALL_FRAGMENT_FILE }}"
|
|
FIREWALL_TABLE: "{{ swarm_ingress_firewall.FIREWALL_TABLE }}"
|
|
SWARM_INGRESS_GUARDED_PORTS: "{{ SWARM_INGRESS_GUARDED }}"
|
|
SWARM_INGRESS_PEER_ADDRESSES: "{{ SWARM_INGRESS_PEERS }}"
|
|
loop: "{{ groups['svc-swarm-node'] }}"
|
|
loop_control:
|
|
loop_var: swarm_ingress_guard_node
|
|
run_once: true
|