mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
15e71f465b
02_manager_ops.yml includes the plugin chain with `apply: delegate_to: NEXTCLOUD_HOST_NODE`, so the addon hook runs wherever that node happens to be. On a swarm worker the partner probe could not answer: it used NEXTCLOUD_ZAMMAD_CONTAINER_ADDRESS, which expands to a `resolve-container-id zammad railsserver` subshell, and that helper exits 64 off a manager. The substitution came back empty, `container inspect ""` failed, `failed_when: false` swallowed it, and the gate `(nextcloud_zammad_partner_running.stdout | trim) == 'true'` was false. The OAuth provisioning was therefore skipped, client_id and client_secret stayed empty, and integration_zammad's personal view fell back to its access-token UI - so the 'Connect to Zammad' control the spec waits for never existed. That is what failed web-app-nextcloud 5 in run 30781723102. The probe and its clause are gone; provisioning now resolves the railsserver's hosting node and local container id through the standard sys-svc-compose/utils/swarm/resolve_host_cid.yml and delegates the rails call there. resolve_host_cid pins its own delegate_to on STACK_HOST and <prefix>_HOST_NODE, so it is unaffected by the inherited one, and the trailing occ tasks keep no delegate_to and still run on the Nextcloud node. Losing the probe also loses its quiet skip. The addon is still gated on services.zammad.enabled, i.e. 'web-app-zammad' in group_names (meta/addons/integration_zammad.yml:2), so the exposure is a targeted deploy where the partner is in the inventory but excluded from the run: wait_converged then spends 120x5s before failing instead of skipping. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
37 lines
1.6 KiB
YAML
37 lines
1.6 KiB
YAML
---
|
|
# The generic config SPOT sets only oauth_instance_url; the per-user OAuth connect flow
|
|
# additionally needs client_id/client_secret, which only exist once an OAuth (Doorkeeper)
|
|
# application is registered on the partner Zammad. This hook provisions that application on
|
|
# the partner and writes the returned credentials into Nextcloud, encrypted the same way the
|
|
# integration_gitlab coupling does.
|
|
- name: 🔍 Resolve Zammad integration provisioning facts
|
|
set_fact:
|
|
nextcloud_zammad_base_url: "{{ lookup('tls', 'web-app-zammad', 'url.base') | regex_replace('/$', '') }}"
|
|
nextcloud_zammad_nc_base_url: "{{ lookup('tls', 'web-app-nextcloud', 'url.base') | regex_replace('/$', '') }}"
|
|
changed_when: false
|
|
|
|
- name: 📖 Read persisted integration_zammad OAuth client id
|
|
shell: >
|
|
{{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:get integration_zammad client_id
|
|
register: nextcloud_zammad_client_id_current
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: 📖 Read persisted integration_zammad OAuth client secret
|
|
shell: >
|
|
{{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:get integration_zammad client_secret
|
|
register: nextcloud_zammad_client_secret_current
|
|
changed_when: false
|
|
failed_when: false
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: 🔧 Provision the Zammad <-> Nextcloud OAuth coupling
|
|
include_tasks: integration_zammad_provision.yml
|
|
when: >-
|
|
IS_STACK_HOST | bool
|
|
and (
|
|
(nextcloud_zammad_client_id_current.stdout | trim) | length == 0
|
|
or (nextcloud_zammad_client_secret_current.stdout | trim) | length == 0
|
|
or ('|' in (nextcloud_zammad_client_id_current.stdout | trim))
|
|
)
|