mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
0b27ed5ba4
Prosody keeps an account's first password. The image's init registers focus and jvb only once, so after a credential rotation it prints "User exists" and keeps the old passwords, while jicofo and the videobridge start with the new ones. Jicofo then fails with "SASLError using SCRAM-SHA-1: not-authorized" and no conference can start. After compose up the role now deletes and re-registers both accounts with their current passwords, through the container_address lookup so it works in compose and swarm. Found by the full-cycle gate of #1165, whose second pass runs after a credential rotation. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
50 lines
2.0 KiB
YAML
50 lines
2.0 KiB
YAML
---
|
|
- name: "✅ ensure jitsi bind-mount source dirs exist (swarm needs bind source)"
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ JITSI_PROSODY_PLUGINS_HOST_PATH }}"
|
|
- "{{ JITSI_PROSODY_CONFIG_HOST_PATH }}"
|
|
- "{{ JITSI_PROSODY_CONFIG_HOST_PATH }}/conf.d"
|
|
- "{{ [lookup('container', 'web-app-jitsi', 'directories.volumes'), 'jicofo'] | path_join }}"
|
|
- "{{ [lookup('container', 'web-app-jitsi', 'directories.volumes'), 'jvb'] | path_join }}"
|
|
- "{{ [lookup('container', 'web-app-jitsi', 'directories.volumes'), 'config'] | path_join }}"
|
|
- "{{ [lookup('container', 'web-app-jitsi', 'directories.volumes'), 'transcripts'] | path_join }}"
|
|
|
|
- name: "🎬 stage prosody LDAP authentication override (mod_auth_ldap2)"
|
|
stack_host_template:
|
|
src: prosody-ldap.cfg.lua.j2
|
|
dest: "{{ JITSI_PROSODY_CONFIG_HOST_PATH }}/conf.d/ldap.cfg.lua"
|
|
mode: "0644"
|
|
notify: compose-up
|
|
when: JITSI_AUTH_TYPE == 'ldap'
|
|
|
|
- name: "🧹 drop the prosody LDAP override while Jitsi does not authenticate via LDAP"
|
|
ansible.builtin.file:
|
|
path: "{{ JITSI_PROSODY_CONFIG_HOST_PATH }}/conf.d/ldap.cfg.lua"
|
|
state: absent
|
|
notify: compose-up
|
|
when: JITSI_AUTH_TYPE != 'ldap'
|
|
|
|
- name: "🚿 flush handlers so Jitsi containers start with rendered env"
|
|
meta: flush_handlers
|
|
|
|
- name: "🔑 recreate the Jitsi component accounts so rotated passwords apply"
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
container exec {{ JITSI_PROSODY_CONTAINER_ADDRESS }} sh -c
|
|
'prosodyctl --config /config/prosody.cfg.lua deluser "$1@{{ JITSI_XMPP_AUTH_DOMAIN }}"
|
|
&& prosodyctl --config /config/prosody.cfg.lua register "$1" {{ JITSI_XMPP_AUTH_DOMAIN }} "$2"'
|
|
_ {{ item.user | quote }} {{ item.password | quote }}
|
|
loop: "{{ JITSI_COMPONENT_ACCOUNTS }}"
|
|
loop_control:
|
|
label: "{{ item.user }}"
|
|
register: jitsi_component_accounts
|
|
retries: 12
|
|
delay: 5
|
|
until: jitsi_component_accounts.rc == 0
|
|
changed_when: true
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|