mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
9967c806bd
Twelve callers load their scripts with the relative form
lookup('file', 'name.py'), which resolves against the role's files/
directory. dfe7a7fdd moved those scripts into files/python/ without
updating them, so the MCP provisioning and probes of baserow, checkmk,
flowise, gitlab, homeassistant, jellyfin, n8n, openwebui and pretix, plus
n8n's AI gateway task, all resolved a path that no longer exists.
This is the second time the same relocation left callers behind. After
2aec4326a fixed the php paths, the claim that no stale references remained
came from grepping the worktree, which already carried the corrected paths;
HEAD still held the old ones. The check has to run against the commit.
Verified against HEAD this time: the eleven remaining stale relative lookups
are exactly the files in this bundle, and no other loading form (copy src,
script) carries a stale path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
2.0 KiB
YAML
57 lines
2.0 KiB
YAML
---
|
|
- name: "🔑 Mint a personal access token carrying the mcp scope"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- container
|
|
- exec
|
|
- -i
|
|
- -e
|
|
- "GITLAB_MCP_TOKEN_NAME={{ GITLAB_MCP_TOKEN_NAME }}"
|
|
- -e
|
|
- "GITLAB_MCP_TOKEN_OWNER={{ GITLAB_MCP_TOKEN_OWNER }}"
|
|
- -e
|
|
- "GITLAB_MCP_TOKEN_OWNER_NAME={{ GITLAB_MCP_TOKEN_OWNER_NAME }}"
|
|
- -e
|
|
- "GITLAB_MCP_TOKEN_OWNER_EMAIL={{ GITLAB_MCP_TOKEN_OWNER_EMAIL }}"
|
|
- -e
|
|
- "GITLAB_MCP_TOKEN_OWNER_PASSWORD={{ GITLAB_MCP_TOKEN_OWNER_PASSWORD }}"
|
|
- -e
|
|
- "GITLAB_MCP_TOKEN_LIFETIME_DAYS={{ GITLAB_MCP_TOKEN_LIFETIME_DAYS }}"
|
|
- "{{ GITLAB_MCP_LOCAL_CID }}" # nocheck: container-exec-resolver
|
|
- "{{ GITLAB_RAILS_BIN }}"
|
|
- runner
|
|
- "-"
|
|
stdin: "{{ lookup('file', 'ruby/provision_mcp_token.rb') }}"
|
|
register: gitlab_mcp_mint
|
|
retries: 30
|
|
delay: 10
|
|
until: gitlab_mcp_mint.rc == 0
|
|
changed_when: "'CHANGED' in gitlab_mcp_mint.stdout"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
delegate_to: "{{ GITLAB_MCP_HOST_NODE }}"
|
|
run_once: true
|
|
|
|
- name: "🔧 Take the minted token from the runner output"
|
|
ansible.builtin.set_fact:
|
|
gitlab_mcp_token: "{{ gitlab_mcp_mint.stdout_lines | last | trim }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
run_once: true
|
|
|
|
- name: "🛑 Refuse an instance that issued no usable token"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- gitlab_mcp_token | length >= 20
|
|
fail_msg: >-
|
|
GitLab did not return a personal access token, so every MCP client would
|
|
be configured with an empty bearer and fail at first use.
|
|
|
|
- name: "💾 Persist the token so MCP clients can read it"
|
|
ansible.builtin.include_role:
|
|
name: sys-token-store
|
|
tasks_from: write.yml
|
|
vars:
|
|
sys_token_store_user_key: "{{ lookup('config', application_id, 'mcp.credential.owner') }}"
|
|
sys_token_store_app: "{{ application_id }}"
|
|
sys_token_store_token: "{{ gitlab_mcp_token }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|