Files
computer-playbook/roles/web-app-magento/tasks/01_setup.yml
kevinveenbirkenbachandClaude Opus 5 53e62c8c8c fix(suitecrm,magento): realign the DB password each app persisted at install
The CI rotation gate moves every application credential between the two deploy passes. MariaDB takes the new value, but both apps baked the old one into a persisted config at install time and their entrypoints refuse to rewrite it once the install flag exists, so every request dies with 'Access denied for user' - a 500 under compose, and under swarm a healthcheck reap that swarm restarts forever.

suitecrm gets the tasks/utils/patch/db_credentials.yml hook that sys-svc-rdbms already reaches for on every deploy, patching db_password in public/legacy/config.php. magento cannot use that hook - app/etc/env.php may carry more than one 'password' line and the shared script is a line-wise sed - so it calls its own supported writer, bin/magento setup:config:set, unguarded after the creates:-guarded install.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-08 13:17:14 +02:00

121 lines
5.1 KiB
YAML

---
- name: "🧭 Resolve the Magento data volume's mountpoint on this node"
ansible.builtin.command: >-
container volume inspect --format '{{ "{{.Mountpoint}}" }}'
{{ MAGENTO_VOLUME | quote }}
register: magento_volume_mountpoint
changed_when: false
- name: "🥾 Bootstrap Magento {{ MAGENTO_COMPOSER_VERSION }} source"
shell: >
container exec
-e COMPOSER_HOME=/tmp/composer
-e COMPOSER_CACHE_DIR=/tmp/composer/cache
--user {{ MAGENTO_USER }}
{{ MAGENTO_PHP_CONTAINER_ADDRESS }} bash -lc 'set -e
mkdir -p /tmp/composer/cache
cd {{ MAGENTO_ROOT }}
composer create-project --no-interaction --no-progress --no-install --repository-url={{ MAGENTO_COMPOSER_REPOSITORY }} {{ MAGENTO_COMPOSER_SPEC }} .
mkdir -p var pub/static pub/media app/etc
chmod -R 775 var pub/static pub/media app/etc
'
args:
creates: "{{ [ magento_volume_mountpoint.stdout | trim, 'html/composer.json' ] | path_join }}"
- name: "📦 Install Magento dependencies"
ansible.builtin.shell: >
container exec
-e COMPOSER_HOME=/tmp/composer
-e COMPOSER_CACHE_DIR=/tmp/composer/cache
--user {{ MAGENTO_USER }}
-w {{ MAGENTO_ROOT }}
{{ MAGENTO_PHP_CONTAINER_ADDRESS }} composer install --no-interaction --no-progress --no-dev
args:
creates: "{{ [ magento_volume_mountpoint.stdout | trim, 'html/bin/magento' ] | path_join }}"
register: magento_composer_install
retries: 3
delay: 5
until: magento_composer_install is succeeded
# Exception: magento2-base ships nginx.conf.sample, so it only exists after
# composer install -- inside the bootstrap the file is not there yet and the
# bootstrap's own creates: guard would make the miss permanent.
- name: "📄 Publish Magento's nginx vhost into the volume"
ansible.builtin.shell: >-
container exec --user {{ MAGENTO_USER }} -w {{ MAGENTO_ROOT }}
{{ MAGENTO_PHP_CONTAINER_ADDRESS }} cp nginx.conf.sample nginx.conf
args:
creates: "{{ [ magento_volume_mountpoint.stdout | trim, 'html/nginx.conf' ] | path_join }}"
register: magento_nginx_conf
- name: "▶️ Run Magento setup:install (in container)"
shell: >
container exec --user {{ MAGENTO_USER }} {{ MAGENTO_PHP_CONTAINER_ADDRESS }} bash -lc "
cd {{ MAGENTO_ROOT }} && rm -f app/etc/env.php && bin/magento setup:install \
--base-url='{{ MAGENTO_URL }}' \
--db-host=\"\$MYSQL_HOST\" \
--db-name=\"\$MYSQL_DATABASE\" \
--db-user=\"\$MYSQL_USER\" \
--db-password=\"\$MYSQL_PASSWORD\" \
--skip-db-validation \
--db-engine=mysql \
--backend-frontname=\"\$MAGENTO_BACKEND_FRONTNAME\" \
--search-engine='opensearch' \
--opensearch-host=\"\$OPENSEARCH_HOST\" \
--opensearch-port=\"\$OPENSEARCH_PORT_NUMBER\" \
--admin-firstname=\"\$MAGENTO_ADMIN_FIRSTNAME\" \
--admin-lastname=\"\$MAGENTO_ADMIN_LASTNAME\" \
--admin-email=\"\$MAGENTO_ADMIN_EMAIL\" \
--admin-user=\"\$MAGENTO_ADMIN_USERNAME\" \
--admin-password=\"\$MAGENTO_ADMIN_PASSWORD\" \
&& touch var/.install-complete"
args:
creates: "{{ MAGENTO_INSTALL_MARKER }}"
register: magento_install
changed_when: >
(magento_install.stdout is defined and
('Magento installation complete' in magento_install.stdout
or 'successfully installed' in magento_install.stdout))
- name: "🔑 Realign the DB password Magento persisted in app/etc/env.php"
shell: >
container exec --user {{ MAGENTO_USER }} {{ MAGENTO_PHP_CONTAINER_ADDRESS }} bash -lc "
cd {{ MAGENTO_ROOT }} && bin/magento setup:config:set --no-interaction --db-password=\"\$MYSQL_PASSWORD\""
register: magento_db_password_realign
changed_when: "'You saved the new configuration' in magento_db_password_realign.stdout"
- name: "📤 Stage Magento's remote-storage configurator into the volume"
ansible.builtin.copy:
src: php/remote-storage.php
dest: "{{ [ magento_volume_mountpoint.stdout | trim, 'remote-storage.php' ] | path_join }}"
mode: "0644"
when: MAGENTO_OBJSTORE_ENABLED | bool
- name: "🪣 Point Magento at the S3 remote storage"
ansible.builtin.shell: >-
container exec --user {{ MAGENTO_USER }} {{ MAGENTO_PHP_CONTAINER_ADDRESS }}
php {{ MAGENTO_ROOT | dirname }}/remote-storage.php
register: magento_remote_storage
changed_when: "'updated' in magento_remote_storage.stdout"
when: MAGENTO_OBJSTORE_ENABLED | bool
- name: "🔄 Reload nginx so it picks up Magento's vhost (compose)"
ansible.builtin.shell: >-
container exec {{ MAGENTO_NGINX_CONTAINER_ADDRESS }} nginx -s reload
register: magento_nginx_restart_compose
changed_when: magento_nginx_restart_compose.rc == 0
when:
- DEPLOYMENT_MODE == 'compose'
- magento_nginx_conf is changed or magento_install is changed
- name: "🔄 Restart nginx so it picks up Magento's vhost (swarm)"
ansible.builtin.command: >-
container service update --force
{{ lookup('container_service', application_id, 'nginx') | quote }}
register: magento_nginx_restart_swarm
changed_when: magento_nginx_restart_swarm.rc == 0
timeout: "{{ lookup('timeout', 600) | int }}"
when:
- DEPLOYMENT_MODE == 'swarm'
- magento_nginx_conf is changed or magento_install is changed