kevinveenbirkenbachandClaude Opus 5 ff73f66b21 fix(semaphore): carry the break-glass password into the app on every deploy ...

SEMAPHORE_ADMIN_PASSWORD resolves to the web-app-semaphore-breakglass user password, and the deploy hands it to Semaphore only when the account is first created. The swarm matrix rotates credentials between the sync and the async pass, and --except administrator exempts the literal user key 'administrator', not this one, so the async pass typed a password the app had never been told about. In run 33923190220 semaphore#1 failed with 'Incorrect login or password' after 15.6 minutes of onion-scaled retries.

The realign runs ungated by SSO: the break-glass account exists precisely for the case where the OIDC path is unavailable. Both account operations now share one stack-host block instead of repeating the condition.

Verified end to end against semaphore v2.19.12 on postgres: the CLI accepts --password as a non-interactive flag, change-by-login reports the user changed, the stored hash moves, and it then verifies against the rotated password and no longer against the seeded one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-09 00:05:09 +02:00

..

00_core.yml

fix(semaphore): carry the break-glass password into the app on every deploy

2026-09-09 00:05:09 +02:00

01_oidc.yml

refactor(tasks): enforce and apply a single task-file numbering scheme

2026-07-23 20:01:31 +02:00

02_breakglass.yml

fix(semaphore): carry the break-glass password into the app on every deploy

2026-09-09 00:05:09 +02:00

main.yml

refactor(tasks): enforce and apply a single task-file numbering scheme

2026-07-23 20:01:31 +02:00