mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
9967c806bd
Twelve callers load their scripts with the relative form
lookup('file', 'name.py'), which resolves against the role's files/
directory. dfe7a7fdd moved those scripts into files/python/ without
updating them, so the MCP provisioning and probes of baserow, checkmk,
flowise, gitlab, homeassistant, jellyfin, n8n, openwebui and pretix, plus
n8n's AI gateway task, all resolved a path that no longer exists.
This is the second time the same relocation left callers behind. After
2aec4326a fixed the php paths, the claim that no stale references remained
came from grepping the worktree, which already carried the corrected paths;
HEAD still held the old ones. The check has to run against the commit.
Verified against HEAD this time: the eleven remaining stale relative lookups
are exactly the files in this bundle, and no other loading form (copy src,
script) carries a stale path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
60 lines
2.1 KiB
YAML
60 lines
2.1 KiB
YAML
---
|
|
- name: "🔑 Grant the mcp group read access to every MCP tool server"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- container
|
|
- exec
|
|
- -i
|
|
- -e
|
|
- "OPENWEBUI_BASE=http://localhost:{{ OPENWEBUI_INTERNAL_HTTP_PORT }}"
|
|
- -e
|
|
- "OPENWEBUI_ADMIN_EMAIL={{ OPENWEBUI_API_BOT_USER.email }}"
|
|
- -e
|
|
- "OPENWEBUI_ADMIN_NAME={{ OPENWEBUI_API_BOT_USER.username }}"
|
|
- -e
|
|
- "OPENWEBUI_ADMIN_PASSWORD={{ OPENWEBUI_API_BOT_USER.password }}"
|
|
- -e
|
|
- "OPENWEBUI_MCP_GROUPS={{ openwebui_mcp_groups | to_json }}"
|
|
- -e
|
|
- "OPENWEBUI_MCP_MEMBERS={{ OPENWEBUI_MCP_MEMBERS | to_json }}"
|
|
- -e
|
|
- "OPENWEBUI_MCP_CONNECTIONS={{ OPENWEBUI_MCP_SERVERS | mcp_tool_server_connections(OPENWEBUI_MCP_GROUP_IDS) | to_json }}"
|
|
- "{{ OPENWEBUI_LOCAL_CID }}" # nocheck: container-exec-resolver
|
|
- python3
|
|
- "-"
|
|
stdin: "{{ lookup('file', 'python/provision_mcp_grants.py') }}"
|
|
register: openwebui_mcp_grants
|
|
retries: 30
|
|
delay: 10
|
|
until: openwebui_mcp_grants.rc == 0
|
|
changed_when: openwebui_mcp_grants.stdout.startswith('CHANGED')
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
delegate_to: "{{ OPENWEBUI_HOST_NODE }}"
|
|
run_once: true
|
|
|
|
- name: "💾 Persist each resolved group id so a bare restart keeps the grant"
|
|
ansible.builtin.include_role:
|
|
name: sys-token-store
|
|
tasks_from: write.yml
|
|
vars:
|
|
sys_token_store_user_key: "{{ OPENWEBUI_MCP_GROUP_OWNER }}"
|
|
sys_token_store_app: "{{ item.key }}"
|
|
sys_token_store_token: "{{ item.value }}"
|
|
loop: "{{ (openwebui_mcp_grants.stdout_lines | last | from_json) | dict2items }}"
|
|
loop_control:
|
|
label: "{{ item.key }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "♻️ Re-render the env now that the group ids are known"
|
|
stack_host_template:
|
|
src: "{{ role_path }}/templates/env.j2"
|
|
dest: "{{ lookup('container', application_id, 'files.env') }}"
|
|
mode: "0640"
|
|
force: true
|
|
notify: compose-up
|
|
vars:
|
|
OPENWEBUI_MCP_GROUP_IDS: "{{ openwebui_mcp_grants.stdout_lines | last | from_json }}"
|
|
|
|
- name: "🚿 Restart Open WebUI so it reads the grants it was just given"
|
|
ansible.builtin.meta: flush_handlers
|