mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
ea85683796
b3ce43a596 set no_log on every task of two included files, which
test_include_uniform_apply_keyword rejects: a keyword every included task
repeats belongs in the include's apply block. The Cloudflare development
mode tasks and the ChatGPT bridge token tasks now receive no_log through
apply at their include sites. The matrix include had set no_log on the
include task itself, which never reaches the included tasks.
Two loops over MATRIX_BRIDGES were unmasked: the bridge folder creation
and the readiness gate. A loop result prints the whole item, and every item
carries the bridge's database_password, so both printed it at -v whenever
MASK_CREDENTIALS_IN_LOGS is on. The credential lint cannot see this because
the loop variable's name carries no secret marker.
Verified: test_include_uniform_apply_keyword, the credential masking lint,
the task lints and the matrix unit tests pass, and ansible-lint is clean on
the five files.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
---
|
|
# Initialize cache dict (works within the play; persists if fact cache is enabled)
|
|
- name: "✅ Ensure cf_zone_ids cache dict exists"
|
|
set_fact:
|
|
cf_zone_ids: "{{ cf_zone_ids | default({}) }}"
|
|
|
|
- name: "📥 Load cf_zone_id from cache if present"
|
|
set_fact:
|
|
cf_zone_id: "{{ (cf_zone_ids | default({})).get(domain | to_primary_domain, false) }}"
|
|
|
|
- name: "✅ Ensure Cloudflare Zone ID is known for '{{ domain }}'"
|
|
vars:
|
|
cf_api_url: "https://api.cloudflare.com/client/v4/zones"
|
|
uri_retry:
|
|
url: "{{ cf_api_url }}?name={{ domain | to_primary_domain }}"
|
|
method: GET
|
|
headers:
|
|
Authorization: "Bearer {{ lookup('api', 'cloudflare.api_token') }}"
|
|
Content-Type: "application/json"
|
|
return_content: true
|
|
register: cf_zone_lookup_dev
|
|
changed_when: false
|
|
when:
|
|
- not cf_zone_id
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🔧 Set fact cf_zone_id and update cache dict"
|
|
set_fact:
|
|
cf_zone_id: "{{ cf_zone_lookup_dev.json.result[0].id }}"
|
|
cf_zone_ids: >-
|
|
{{ (cf_zone_ids | default({}))
|
|
| combine({ (domain | to_primary_domain): cf_zone_lookup_dev.json.result[0].id }) }}
|
|
when:
|
|
- not cf_zone_id
|
|
- cf_zone_lookup_dev.json.result | length > 0
|
|
|
|
- name: "🛑 Fail if no Cloudflare zone found for {{ domain | to_primary_domain }}"
|
|
ansible.builtin.fail:
|
|
msg: "No Cloudflare zone found for {{ domain | to_primary_domain }} — aborting!"
|
|
when:
|
|
- not cf_zone_id
|
|
- cf_zone_lookup_dev.json.result | length == 0
|
|
|
|
- name: 🟢 activate cloudflare cache development mode
|
|
include_tasks:
|
|
file: "cloudflare/01_enable_cf_dev_mode.yml"
|
|
apply:
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
when: (ENVIRONMENT | lower) == 'development'
|
|
|
|
- name: 🧹 purge cloudflare domain cache
|
|
include_tasks: "cloudflare/02_cleanup.yml"
|
|
when: MODE_CLEANUP | bool
|