mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
4039313266
Add tests/lint/repository/test_task_file_numbering.py: numbered task files use exactly two leading digits, a numbered *_core.yml must be 00_core.yml, per directory the numbers are unique/consecutive and start at 01 (00 with a core file), numbered includes appear in ascending order, and shared helpers live in tasks/utils/ instead of the numbered chain. Apply it across every role: rename NN_core.yml to 00_core.yml with a consecutive down-shift of the siblings, move letter-suffix children into a subdirectory named after their parent task, relocate helpers included from more than one place into tasks/utils/, and update every reference (include_tasks, path_absolute, .ansible-lint-ignore, requirement docs). Legacy narration comments in the touched files are deleted; the upstream xwiki.properties reference block opts out via nocheck. The unused MAILU_IP6_PUBLIC var (only ever named in now-removed comments) is dropped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
199 lines
8.3 KiB
YAML
199 lines
8.3 KiB
YAML
---
|
|
- name: "🔎 Check if Keycloak OAuth provider exists"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/select/keycloak/provider-id.sql"
|
|
expect_rows: true
|
|
register: oauth_check
|
|
|
|
- name: "🔄 Update existing Keycloak OAuth provider"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/update/keycloak-provider.sql"
|
|
named_args:
|
|
auth_endpoint: "{{ ODOO_OIDC_AUTHORIZE_URL }}"
|
|
userinfo_endpoint: "{{ ODOO_OIDC_USERINFO_URL }}"
|
|
client_id: "{{ ODOO_OIDC_CLIENT_ID }}"
|
|
when: oauth_check.rows | length > 0
|
|
|
|
- name: "📁 Create new Keycloak OAuth provider"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/insert/keycloak-provider.sql"
|
|
named_args:
|
|
auth_endpoint: "{{ ODOO_OIDC_AUTHORIZE_URL }}"
|
|
userinfo_endpoint: "{{ ODOO_OIDC_USERINFO_URL }}"
|
|
client_id: "{{ ODOO_OIDC_CLIENT_ID }}"
|
|
when: oauth_check.rows | length == 0
|
|
|
|
- name: "🟢 Enable OAuth authentication in system parameters"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
|
|
named_args:
|
|
key: "auth_oauth.oauth_providers"
|
|
value: "True"
|
|
|
|
- name: "🟢 Enable OAuth signup (allow user creation on first OAuth login)"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
|
|
named_args:
|
|
key: "auth_signup.invitation_scope"
|
|
value: "b2c"
|
|
|
|
- name: "🔑 Allow uninvited OAuth signup on website"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/update/website-uninvited-b2c.sql"
|
|
|
|
- name: "🔎 Check if OAuth template user exists"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/select/oauth-template-user.sql"
|
|
expect_rows: true
|
|
register: oauth_template_check
|
|
|
|
- name: "📁 Create OAuth template partner"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/insert/oauth-template/partner.sql"
|
|
expect_rows: true
|
|
register: oauth_template_partner
|
|
when: oauth_template_check.rows | length == 0
|
|
|
|
- name: "📁 Create OAuth template user"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/insert/oauth-template/user.sql"
|
|
named_args:
|
|
partner_id: "{{ oauth_template_partner.rows[0][0] | int }}"
|
|
register: oauth_template_user
|
|
when:
|
|
- oauth_template_check.rows | length == 0
|
|
- oauth_template_partner.rows is defined
|
|
- oauth_template_partner.rows | length > 0
|
|
|
|
- name: "✅ Ensure OAuth template user is active"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/update/activate-oauth-template.sql"
|
|
|
|
- name: "🔐 Grant Internal User group to OAuth template"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/grant/internal-user-to-oauth/template.sql"
|
|
|
|
- name: "🔐 Grant company access to OAuth template"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/grant/company-to-oauth/template.sql"
|
|
|
|
- name: "🔧 Set OAuth template user for signup (base.template_portal_user_id)"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter-template-user-id.sql"
|
|
named_args:
|
|
key: "base.template_portal_user_id"
|
|
|
|
- name: "🔧 Set OAuth template user for signup (auth_signup.template_user_id)"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter-template-user-id.sql"
|
|
named_args:
|
|
key: "auth_signup.template_user_id"
|
|
|
|
- name: "🔑 Use Authorization header for OAuth token validation"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
|
|
named_args:
|
|
key: "auth_oauth.authorization_header"
|
|
value: "True"
|
|
|
|
- name: "🔧 Set web.base.url for HTTPS redirects"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
|
|
named_args:
|
|
key: "web.base.url"
|
|
value: "{{ ODOO_URL }}"
|
|
|
|
- name: "🧊 Freeze web.base.url to prevent automatic detection"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/upsert-ir-config-parameter.sql"
|
|
named_args:
|
|
key: "web.base.url.freeze"
|
|
value: "True"
|
|
|
|
- name: "🔐 Grant Internal User group to OAuth-created users"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/grant/internal-user-to-oauth/users-repair.sql"
|
|
|
|
- name: "⬇️ Get Keycloak OAuth provider id in Odoo"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/select/keycloak/provider-id.sql"
|
|
expect_rows: true
|
|
register: keycloak_provider
|
|
|
|
- name: "🔍 Query Keycloak DB for administrator username"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', 'web-app-keycloak') }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/select/keycloak/realm-user.sql"
|
|
named_args:
|
|
realm: "{{ OIDC.CLIENT.REALM }}"
|
|
admin: "{{ lookup('users', 'administrator').username }}"
|
|
expect_rows: true
|
|
register: keycloak_users
|
|
when: keycloak_provider.rows | length > 0
|
|
|
|
- name: "🔗 Link administrator user to Keycloak in Odoo"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/update/user-oauth-link.sql"
|
|
named_args:
|
|
provider_id: "{{ keycloak_provider.rows[0][0] | int }}"
|
|
oauth_uid: "{{ (keycloak_users.rows | map('first') | select('equalto', lookup('users', 'administrator').username) | list | first) }}"
|
|
login: "{{ lookup('users', 'administrator').username }}"
|
|
when:
|
|
- keycloak_provider.rows | length > 0
|
|
- keycloak_users.rows | map('first') | select('equalto', lookup('users', 'administrator').username) | list | length > 0
|
|
|
|
- name: "🔐 Grant internal user access to OAuth-created users"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/grant/internal-user-to-oauth/signup-users.sql"
|
|
when: keycloak_provider.rows | length > 0
|
|
|
|
- name: "🔐 Grant company access to OAuth-created users"
|
|
database_query:
|
|
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
config: "{{ lookup('database', application_id) }}"
|
|
query_file: "{{ role_path }}/files/sql/oidc/grant/company-to-oauth/signup-users.sql"
|
|
when: keycloak_provider.rows | length > 0
|