Files
computer-playbook/roles/web-app-peertube/files/sql/upsert-oidc-plugin.sql
kevinveenbirkenbachandClaude Opus 5 cfd6f08795 fix(swarm): recreate tasks so in-container changes reach the process
docker stack deploy leaves tasks running when the service spec is unchanged, so a change made inside a container never reaches the process. PeerTube's CLI installs plugins with register:false, so the OIDC plugin sat installed and enabled in the database while the running server had loaded nothing: /login rendered only the local form and both OIDC specs timed out through all three attempts. Compose never showed it because its handler force-recreates.

Add a container recreate notify. In swarm it forces a task recreation per stack service and waits for convergence; in compose it maps onto the existing --force-recreate, so a role states the intent once and both modes honour it.

In the peertube role the install probe now tests node_modules/<npm-name>, where pnpm puts the plugin code; the old path was the data directory that registerPlugin creates at boot, so it never existed and the plugin was reinstalled on every run. The settings upsert derives changed from the rowcount via RETURNING, because database_query reports changed from the kind of statement rather than from what it touched. A registration probe notifies when the running process has not loaded the plugin, so an already-broken instance heals itself instead of walking past both earlier probes. The plugin:enable task is gone: npm has no such script, the call always failed and failed_when swallowed it.

The spec now polls the button lookup instead of counting once twenty milliseconds after goto, while still asserting on the URL so a failure keeps printing the address the browser actually sat on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 15:08:50 +02:00

16 lines
551 B
SQL

-- Enable the auth-openid-connect plugin and refresh its settings in
-- place. Caller passes %(settings)s (JSON-encoded plugin settings) as
-- named_args; the ::jsonb cast turns the escaped string literal into a
-- jsonb value at the engine boundary.
UPDATE public.plugin
SET settings = %(settings)s::jsonb,
enabled = TRUE,
uninstalled = FALSE
WHERE name = 'auth-openid-connect'
AND (
settings IS DISTINCT FROM %(settings)s::jsonb
OR enabled IS DISTINCT FROM TRUE
OR uninstalled IS DISTINCT FROM FALSE
)
RETURNING name;