mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
dcb921c260
container_address resolves a container id for exec and emits a $(...) subshell in swarm; setup/oidc.yml passes the value through shlex.quote, so the substitution never ran and client.php wrote the literal text into token_endpoint and userinfo_endpoint. The deploy stayed green and every admin SSO login failed at the code-to-token exchange. container_service is the maintained lookup for the addressable form and yields keycloak in compose, keycloak_keycloak in swarm. init.sh no longer waits on the S3 endpoint: c5a149b11 unmounted the config it guarded, while a hard fail there still took web, worker and scheduler with it. The admin-bundle check now runs unconditionally — it was skipped exactly when objstore was on, i.e. in the only variant with SSO, although the bundles are local either way. The two objstore env vars lost their last consumer with it. no_log now sits on the two tasks that carry the admin password and the OIDC client secret; handing it through include_tasks apply: does not censor them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
27 lines
1.4 KiB
YAML
27 lines
1.4 KiB
YAML
---
|
|
- name: "✅ Ensure Shopware admin exists and has the desired password"
|
|
ansible.builtin.shell:
|
|
cmd: >- # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i --user {{ SHOPWARE_USER }}
|
|
-e SHOPWARE_ROOT={{ SHOPWARE_ROOT | quote }}
|
|
-e ADMIN_USER={{ lookup('users', 'administrator').username | quote }}
|
|
-e ADMIN_PASSWORD={{ lookup('users', 'administrator').password | quote }}
|
|
-e ADMIN_FIRST_NAME={{ lookup('users', 'administrator').username | quote }}
|
|
-e ADMIN_LAST_NAME={{ DOMAIN_PRIMARY | lower | quote }}
|
|
-e ADMIN_EMAIL={{ lookup('users', 'administrator').email | quote }}
|
|
{{ SHOPWARE_WEB_LOCAL_CID | quote }}
|
|
sh
|
|
stdin: "{{ lookup('ansible.builtin.file', role_path ~ '/files/shell/admin/user.sh') }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🛡️ Ensure the Shopware admin still holds the admin privilege"
|
|
ansible.builtin.shell:
|
|
cmd: >- # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i --user {{ SHOPWARE_USER }}
|
|
-e ADMIN_USER={{ lookup('users', 'administrator').username | quote }}
|
|
{{ SHOPWARE_WEB_LOCAL_CID | quote }}
|
|
php
|
|
stdin: "{{ lookup('ansible.builtin.file', role_path ~ '/files/php/admin/privileges.php') }}"
|
|
register: shopware_admin_privilege
|
|
changed_when: "'(0 row(s))' not in shopware_admin_privilege.stdout"
|