mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
09e6991076
roles/sys-svc-mail-msmtp/tasks/ca_bundle.yml stat'ed candidate bundle paths on
the Ansible target and wrote the winner into msmtprc. Moodle and WordSpress then
copied that file into a container, where the named path is a different file - or
none. Only update-ca-certificates populates a container's system bundle, and
that runs solely from the with-ca-trust.sh entrypoint, which compose_ca.py sets
only when 'docker image inspect' succeeded. On a fresh host the image is built
minutes later, so it never ran: job 94965457602 of run 31864448027 shows
Config.Entrypoint still moodle-entrypoint.sh while the CA sits mounted beside it,
and msmtp reporting 'The certificate issuer is unknown'.
An explicit tls_trust_file also outranks SSL_CERT_FILE, so the env injection the
override always performs could not compensate.
Name CA_TRUST.inject_cert_container when the CA is actually injected, and emit
no line at all otherwise - msmtp's own 'system' default is the right answer for
a letsencrypt relay, and it is what the container's stock bundle verifies. This
also removes a latent defect on letsencrypt: a RedHat host would have written
/etc/pki/... into a Debian container.
The removal of the probing apparatus is taken from 9a72d01eb on
fork/feature/ai-agent-employees, which diagnosed the wrong-machine measurement
correctly. Its own conclusion - drop the line entirely and rely on the trust
store - does not hold where the wrapper never runs, and in swarm it never does:
handlers/swarm.yml passes wrapper=False by design.
The three-term predicate behind all of this was hand-copied into four places.
lookup('ca_injected', application_id) is now its single source; the swarm and
compose gates and sys-svc-compose-ca's own var read it too.
compose_ca.py finally says when it degrades to mount-plus-env, naming the service
and the image it could not inspect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
65 lines
2.2 KiB
YAML
65 lines
2.2 KiB
YAML
---
|
|
- include_tasks: utils/once/flag.yml
|
|
|
|
- name: "✅ Assert {{ DIR_VAR_LIB }} is cluster-shared in swarm mode"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (DEPLOYMENT_MODE == 'compose') or ('svc-swarm-node' not in group_names) or ('svc-storage-nfs-client' in group_names) or ('svc-storage-nfs-server' in
|
|
group_names)
|
|
fail_msg: >-
|
|
sys-svc-mail-msmtp on a swarm member requires svc-storage-nfs-client
|
|
so {{ DIR_VAR_LIB }} is cluster-shared. Set `storage.backend=nfs` and
|
|
add this host to the `svc-storage-nfs-client` group, unless this host
|
|
is the dedicated NFS server (svc-storage-nfs-server). Hosts outside
|
|
the swarm (svc-swarm-node) keep a local {{ DIR_VAR_LIB }}.
|
|
|
|
- name: 📦 Install msmtp base package
|
|
package_install:
|
|
id: msmtp
|
|
|
|
- name: "📦 Install the CA trust store"
|
|
package_install:
|
|
id: ca-certificates
|
|
|
|
- name: ✅ Ensure the shared Root CA is trusted for the TLS mail relay
|
|
include_role:
|
|
name: sys-ca-selfsigned
|
|
when:
|
|
- (TLS_MODE | lower) == 'self_signed'
|
|
- run_once_sys_ca_selfsigned is not defined
|
|
|
|
- name: "🔴 Disable SMTP to avoid port conflicts"
|
|
include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-mail-smtp/tasks/disable.yml') }}"
|
|
|
|
- when: lookup('email').external | bool
|
|
block:
|
|
- name: 📦 Install msmtp-mta when Mailu is used and package exists on distro
|
|
package_install:
|
|
id: msmtp-mta
|
|
register: sys_svc_mail_msmtp_mta
|
|
|
|
- name: 📧 Provide sendmail compatibility link when msmtp-mta is unavailable
|
|
file:
|
|
src: /usr/bin/msmtp
|
|
dest: /usr/bin/sendmail
|
|
state: link
|
|
force: true
|
|
when: sys_svc_mail_msmtp_mta is skipped
|
|
|
|
- name: 🔧 configure msmtprc.conf.j2
|
|
template: # nocheck: stack-host-template (per-host /root/.msmtprc, not stack-host-only)
|
|
src: "msmtprc.conf.j2"
|
|
dest: "/root/.msmtprc"
|
|
mode: 600
|
|
vars:
|
|
sys_svc_mail_msmtp_in_container: false
|
|
|
|
- name: "🔄 Route hlth-msmtp via service-loader (after mailu compose-up)"
|
|
ansible.builtin.include_role:
|
|
name: sys-service-loader
|
|
tasks_from: list_or_shoot.yml
|
|
vars:
|
|
list_or_shoot_roles:
|
|
- sys-ctl-hlth-msmtp
|
|
when: run_once_sys_ctl_hlth_msmtp is not defined
|