computer-playbook/roles/web-app-peertube/tasks/oidc/enable.yml

---
- name: "⚙️ Load OIDC Settings for Peertube"
  include_vars: vars/oidc-settings.yml
  changed_when: false

- name: "🧭 Resolve PeerTube host node + local container id"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: "{{ entity_name }}"
    resolve_output_prefix: PEERTUBE
    resolve_compose_cid: "{{ PEERTUBE_CONTAINER }}"

- name: 🔎 Check if OIDC plugin is already installed
  shell: |
    # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ PEERTUBE_LOCAL_CID | quote }} test -d /data/plugins/node_modules/{{ PEERTUBE_OIDC_PLUGIN }}
  register: peertube_oidc_plugin_check
  failed_when: false
  changed_when: false
  delegate_to: "{{ PEERTUBE_HOST_NODE }}"

- name: "📦 Install auth-openid-connect plugin for Peertube (mem_limit bump + diagnostics)"
  when: peertube_oidc_plugin_check.rc != 0
  block:
    # Exception: install runs via `container exec` and shares the cgroup; combined RSS plus native allocs trips mem_limit and SIGKILLs peertube, so raise the ceiling and allow unlimited swap for the install window.
    - name: "📦 PEERTUBE | Raise mem_limit for plugin install"
      ansible.builtin.shell: |
        container update \
          --memory {{ PEERTUBE_OIDC_PLUGIN_INSTALL_MEM_LIMIT }} \
          --memory-swap -1 \
          {{ PEERTUBE_LOCAL_CID | quote }}
      changed_when: true
      delegate_to: "{{ PEERTUBE_HOST_NODE }}"

    - name: "📦 Install auth-openid-connect plugin for Peertube"
      # Exception: cgroup bump covers native memory; --max-old-space-size still caps the install's V8 old-generation.
      ansible.builtin.shell: >
        container exec
        -e NODE_OPTIONS=--max-old-space-size={{ PEERTUBE_OIDC_PLUGIN_INSTALL_MAX_OLD_SPACE_MB }}
        {{ PEERTUBE_LOCAL_CID | quote }} npm run plugin:install -- --npm-name {{ PEERTUBE_OIDC_PLUGIN }}
      register: peertube_oidc_install
      changed_when: peertube_oidc_install.rc == 0
      retries: 3
      delay: 15
      until: peertube_oidc_install.rc == 0
      delegate_to: "{{ PEERTUBE_HOST_NODE }}"
      notify: container-recreate

    # Exception: happy-path only; on failure the rescue leaves bumped limits so diagnostics reflect install-time state, and the next `compose up` restores compose.yml defaults.
    - name: "♻️ PEERTUBE | Restore compose-defined mem_limit"
      ansible.builtin.shell: |
        container update \
          --memory {{ PEERTUBE_MEM_LIMIT }} \
          --memory-swap {{ PEERTUBE_MEM_LIMIT }} \
          {{ PEERTUBE_LOCAL_CID | quote }}
      changed_when: true
      delegate_to: "{{ PEERTUBE_HOST_NODE }}"

- name: "🔄 Update the settings column of the auth-openid-connect plugin"
  database_query:
    mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
    config: "{{ lookup('database', application_id) }}"
    query: "{{ lookup('file', role_path ~ '/files/sql/upsert-oidc-plugin.sql') }}" # nocheck: database-query-raw  controller-read so the SQL travels to the remote swarm host that lacks the repo files
    named_args:
      settings: "{{ oidc_settings | to_json }}"
    expect_rows: true
  register: _peertube_oidc_update
  retries: 5
  delay: 3
  until: _peertube_oidc_update is succeeded
  changed_when: _peertube_oidc_update.rows | default([]) | length > 0
  notify: container-recreate

- name: "🔎 Check if the running PeerTube has registered the OIDC plugin"
  shell: |
    # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ PEERTUBE_LOCAL_CID | quote }} test -d /data/plugins/data/{{ PEERTUBE_OIDC_PLUGIN }}
  register: _peertube_oidc_registered
  failed_when: false
  changed_when: _peertube_oidc_registered.rc != 0
  delegate_to: "{{ PEERTUBE_HOST_NODE }}"
  notify: container-recreate

- name: "🚿 Flush the container recreation before verifying the OIDC registration"
  meta: flush_handlers

- name: "🧭 Re-resolve PeerTube host node + local container id after the recreation"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: "{{ entity_name }}"
    resolve_output_prefix: PEERTUBE
    resolve_compose_cid: "{{ PEERTUBE_CONTAINER }}"

- name: "🛑 Fail if the running PeerTube has still not registered the OIDC plugin"
  shell: |
    # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ PEERTUBE_LOCAL_CID | quote }} test -d /data/plugins/data/{{ PEERTUBE_OIDC_PLUGIN }}
  register: _peertube_oidc_verified
  retries: 30
  delay: 10
  until: _peertube_oidc_verified.rc == 0
  changed_when: false
  delegate_to: "{{ PEERTUBE_HOST_NODE }}"

- name: "🛑 Fail if the OIDC plugin registered but never built a client"
  shell: |
    # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container logs {{ PEERTUBE_LOCAL_CID | quote }} 2>&1 | grep -q 'Initial OpenID discovery failed'
  register: _peertube_oidc_discovery_failed
  failed_when: _peertube_oidc_discovery_failed.rc == 0
  changed_when: false
  delegate_to: "{{ PEERTUBE_HOST_NODE }}"