mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
18cf9b9ada
The matomo bootstrap re-injects early-rendered web-svc consumers (such as
web-svc-logout) after obtaining the admin token, but in swarm this never ran:
roles_with_service filters by the manager's group_names, which omits
worker-placed web-svc services, so the re-injection loop was empty and the
logout page shipped without the matomo tracker.
- roles_with_service: add a scope kwarg; scope='all' bypasses the per-host
group_names filter (the merged applications config is already
deployment-scoped, so iterating all of it equals the deployment's consumers).
- 05_bootstrap: enumerate consumers with scope='all', stat each compose project
dir, and re-inject only deployed ones. Avoids a fatal chdir into an undeployed
consumer's missing /opt/compose/<entity>/ that scope='all' would otherwise hit.
- sys-front-inj-matomo: resolve matomo_effective_token (override else
lookup('users')); the disable-gate and the SitesManager getSitesId/addSite
calls use it, so the re-injection passes the fresh bootstrap token and bypasses
the play-start-stale controller-side users cache that left matomo disabled.
scope defaults to 'host' and the override defaults to empty, so every existing
caller and the per-consumer injection path are unchanged. Validated green in
both compose and swarm round 1.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.2 KiB
YAML
28 lines
1.2 KiB
YAML
---
|
|
# nocheck: run-once
|
|
|
|
# The Matomo API token may be empty on first deployment or when the Matomo container is
|
|
# already reachable but the bootstrap has not run yet (so sys-token-store never wrote the
|
|
# token file). In that case inj_enabled.matomo is set to false so the NGINX template skips
|
|
# the Matomo body snippet (avoiding 'matomo_site_id is undefined') and inject.yml is not run.
|
|
# See docs/contributing/design/exceptions.md — "Matomo Token Not Yet Available".
|
|
|
|
- name: "🔧 Resolve effective Matomo API token for '{{ domain }}'"
|
|
ansible.builtin.set_fact:
|
|
matomo_effective_token: >-
|
|
{{
|
|
(matomo_token_override | default('') | string | trim)
|
|
if (matomo_token_override | default('') | string | trim) != ''
|
|
else (lookup('users', 'administrator').tokens['web-app-matomo'] | default('') | string | trim)
|
|
}}
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🔴 Disable Matomo in inj_enabled for '{{ domain }}' — token not yet available"
|
|
ansible.builtin.set_fact:
|
|
inj_enabled: "{{ inj_enabled | combine({'matomo': false}) }}"
|
|
when: matomo_effective_token == ""
|
|
|
|
- name: "💉 Inject Matomo tracking for '{{ domain }}'"
|
|
include_tasks: inject.yml
|
|
when: inj_enabled.matomo | bool
|