mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
a46348b6cf
A handler name was doing two jobs at once: the line an operator reads in the
play output, and the identifier a `notify:` binds to. The two pull in opposite
directions -- the log wants "restart the SSH service, with diagnostics", the
binding wants a token that survives quoting, YAML flow style and a shell
round-trip -- and a name that changes for readability silently changes which
handler runs.
Every handler that a notify reached by name now carries a `listen:` with that
exact wording, so the binding is explicit before anything is renamed. The
topics themselves become identifiers: `compose up` reads `compose-up`,
`Restart NFS ganesha` reads `restart-nfs-ganesha`, 22 of them across both
sides of every notify. Where the topic is assembled at runtime, both branches
moved together: the conditional in sys-service carries two literals, and the
LDAP renderer interpolates `import-{{ folder }}-ldif-files`, which is what
makes those handlers reachable at all.
Freed from the binding, the names take the emoji prefix every other task line
already has.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
38 lines
1.8 KiB
YAML
38 lines
1.8 KiB
YAML
---
|
|
# Per-consumer SSO-proxy sidecar wiring.
|
|
#
|
|
# This task is invoked from `sys-stk-backend` during a consumer role's
|
|
# deploy (`application_id` is the consumer, e.g. `web-app-postmarks`)
|
|
# whenever the consumer's `services.sso.flavor` resolves to `oauth2`.
|
|
# It renders the oauth2-proxy upstream-config file into the consumer's
|
|
# volume directory; the compose stack picks up the sidecar container
|
|
# via `roles/web-app-keycloak/templates/sso_proxy/container.yml.j2`,
|
|
# included by `sys-svc-compose/templates/base.yml.j2`.
|
|
#
|
|
# `sso_proxy_application_id` is set by the caller to the consumer's
|
|
# `application_id`. The config lookups inside the template resolve
|
|
# against the consumer's `services.sso.*` block, NOT against
|
|
# `web-app-keycloak`'s own config — that is why the static scan cannot
|
|
# see the cross-role config path.
|
|
|
|
- name: "✅ SSO-proxy | sanity-check consumer is in the resolved list"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sso_proxy_application_id in (lookup('sso_proxy_consumers') | flatten)
|
|
fail_msg: >-
|
|
sys-stk-backend asked web-app-keycloak/tasks/sso_proxy.yml to render
|
|
the SSO-proxy sidecar for '{{ sso_proxy_application_id }}', but that
|
|
app does not appear in lookup('sso_proxy_consumers'). Either the
|
|
consumer's services.sso.flavor is not 'oauth2', or sso.enabled is
|
|
falsy. Fix the consumer's meta/services.yml.
|
|
when: MODE_DEBUG | bool
|
|
|
|
- name: "📄 SSO-proxy | render upstream-config for '{{ sso_proxy_application_id }}'"
|
|
stack_host_template:
|
|
src: "{{ lookup('path_absolute', 'roles/web-app-keycloak/templates/sso_proxy/oauth2-proxy-keycloak.cfg.j2') }}"
|
|
dest: >-
|
|
{{ (sso_proxy_application_id | get_docker_paths(DIR_COMPOSITIONS)).directories.volumes
|
|
}}{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.configuration_file') }}
|
|
notify:
|
|
- compose-up
|