mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.7
2c416cb5c7
- Replace 13 raw `container exec mysql/psql` invocations across
web-app-pixelfed, web-app-fider, and web-app-mattermost with the
canonical `database_query` module + `query_file:` + `named_args:`
pattern. The module already speaks both shared (central `svc-db-*`)
and non-shared (per-role `<entity>-database`) modes via the
`database` lookup, so the same task shape works regardless of DB
topology — the per-role hardcoded container-exec argv was the only
blocker.
- Extract every inline SQL body into per-role `files/sql/` trees.
Pixelfed splits further into `files/sql/oidc-mapping/` because the
OIDC-mapping cluster is a distinct concern from the bootstrap /
administrator queries. Each SQL file is single-purpose and named by
verb-noun (count-users, select-admin-id, upsert, etc.) to match the
precedent set by web-app-odoo.
- Fider's existing `files/{create_admin_user,configure_oidc_provider}.sql`
move to `files/sql/` and switch from psql-specific `:'var'`
variable substitution (which forced `stdin:` piping with `-v`
flags) to engine-neutral `%(name)s` placeholders the module
escapes per backend.
- Pixelfed loses `PIXELFED_MARIADB_ARGS` + 3 derived DB vars
(`*_CONTAINER`, `*_USERNAME`, `*_PASSWORD`) from `vars/main.yml` —
they were the manual argv bundle for the old container-exec
pattern and become orphan once `lookup('database', application_id)`
takes over.
- Every refactored task carries `mask_values:
MASK_CREDENTIALS_IN_LOGS` (module-level credential redaction);
tasks that previously used `no_log: MASK_CREDENTIALS_IN_LOGS`
keep both directives so the task-level masking stays alongside
the module-level one.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
36 lines
1.1 KiB
SQL
36 lines
1.1 KiB
SQL
-- Idempotent UPSERT of the `_keycloak` OAuth provider row in Fider's
|
|
-- `oauth_providers` table. Driven by ON CONFLICT (tenant_id, provider).
|
|
|
|
INSERT INTO oauth_providers (
|
|
tenant_id, provider, display_name, status,
|
|
client_id, client_secret,
|
|
authorize_url, token_url, profile_url,
|
|
scope,
|
|
json_user_id_path, json_user_name_path, json_user_email_path,
|
|
logo_bkey, is_trusted
|
|
) VALUES (
|
|
(SELECT id FROM tenants LIMIT 1),
|
|
'_keycloak',
|
|
%(display_name)s,
|
|
2,
|
|
%(client_id)s,
|
|
%(client_secret)s,
|
|
%(authorize_url)s,
|
|
%(token_url)s,
|
|
%(profile_url)s,
|
|
'openid profile email',
|
|
'sub', 'name', 'email',
|
|
'', true
|
|
)
|
|
ON CONFLICT (tenant_id, provider) DO UPDATE SET
|
|
display_name = EXCLUDED.display_name,
|
|
status = EXCLUDED.status,
|
|
client_id = EXCLUDED.client_id,
|
|
client_secret = EXCLUDED.client_secret,
|
|
authorize_url = EXCLUDED.authorize_url,
|
|
token_url = EXCLUDED.token_url,
|
|
profile_url = EXCLUDED.profile_url,
|
|
scope = EXCLUDED.scope,
|
|
logo_bkey = EXCLUDED.logo_bkey,
|
|
is_trusted = EXCLUDED.is_trusted;
|