mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
4039313266
Add tests/lint/repository/test_task_file_numbering.py: numbered task files use exactly two leading digits, a numbered *_core.yml must be 00_core.yml, per directory the numbers are unique/consecutive and start at 01 (00 with a core file), numbered includes appear in ascending order, and shared helpers live in tasks/utils/ instead of the numbered chain. Apply it across every role: rename NN_core.yml to 00_core.yml with a consecutive down-shift of the siblings, move letter-suffix children into a subdirectory named after their parent task, relocate helpers included from more than one place into tasks/utils/, and update every reference (include_tasks, path_absolute, .ansible-lint-ignore, requirement docs). Legacy narration comments in the touched files are deleted; the upstream xwiki.properties reference block opts out via nocheck. The unused MAILU_IP6_PUBLIC var (only ever named in now-removed comments) is dropped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
61 lines
2.5 KiB
YAML
61 lines
2.5 KiB
YAML
---
|
|
- name: "⏳ Wait for MinIO IAM subsystem before policy attach"
|
|
environment:
|
|
MINIO_ROOT_USER: "{{ lookup('users', 'administrator').username }}"
|
|
MINIO_ROOT_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
shell: |
|
|
set -euo pipefail
|
|
container run --rm \
|
|
-e MINIO_ROOT_USER \
|
|
-e MINIO_ROOT_PASSWORD \
|
|
--entrypoint /bin/sh \
|
|
{{ MINIO_MC_IMAGE }} \
|
|
-c 'mc alias set minio {{ MINIO_API_URL | quote }} "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null \
|
|
&& mc admin policy ls minio'
|
|
args: { executable: /bin/bash }
|
|
register: mc_admin_policy_ls_ldap
|
|
retries: 60
|
|
delay: 5
|
|
until: mc_admin_policy_ls_ldap.rc == 0
|
|
changed_when: false
|
|
|
|
- name: "📁 Create administrator policy (LDAP variant)"
|
|
environment:
|
|
MINIO_ROOT_USER: "{{ lookup('users', 'administrator').username }}"
|
|
MINIO_ROOT_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
shell: |
|
|
set -euo pipefail
|
|
printf '%s' '{{ (MINIO_OIDC_POLICY_CONTENT | from_yaml | to_json) | b64encode }}' \
|
|
| base64 -d \
|
|
| container run --rm -i \
|
|
-e MINIO_ROOT_USER \
|
|
-e MINIO_ROOT_PASSWORD \
|
|
--entrypoint /bin/sh \
|
|
{{ MINIO_MC_IMAGE }} \
|
|
-c 'mc alias set minio {{ MINIO_API_URL | quote }} "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null \
|
|
&& mc admin policy create minio {{ MINIO_OIDC_POLICY_NAME | quote }} /dev/stdin || true'
|
|
args: { executable: /bin/bash }
|
|
changed_when: false
|
|
|
|
- name: "🗂️ Attach MinIO policy to LDAP administrator group"
|
|
environment:
|
|
MINIO_ROOT_USER: "{{ lookup('users', 'administrator').username }}"
|
|
MINIO_ROOT_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
MINIO_LDAP_ADMIN_GROUP_DN: "cn=web-app-minio-administrator,ou=roles,{{ LDAP.DN.ROOT }}"
|
|
shell: |
|
|
set -euo pipefail
|
|
container run --rm \
|
|
-e MINIO_ROOT_USER \
|
|
-e MINIO_ROOT_PASSWORD \
|
|
-e MINIO_LDAP_ADMIN_GROUP_DN \
|
|
--entrypoint /bin/sh \
|
|
{{ MINIO_MC_IMAGE }} \
|
|
-c 'mc alias set minio {{ MINIO_API_URL | quote }} "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null \
|
|
&& mc admin policy attach minio {{ MINIO_OIDC_POLICY_NAME | quote }} --group "$MINIO_LDAP_ADMIN_GROUP_DN"'
|
|
args: { executable: /bin/bash }
|
|
register: mc_policy_attach_ldap
|
|
changed_when: '"already attached" not in mc_policy_attach_ldap.stderr'
|
|
failed_when:
|
|
- mc_policy_attach_ldap.rc != 0
|
|
- '"already attached" not in (mc_policy_attach_ldap.stderr | default(""))'
|