mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
dcb921c260
container_address resolves a container id for exec and emits a $(...) subshell in swarm; setup/oidc.yml passes the value through shlex.quote, so the substitution never ran and client.php wrote the literal text into token_endpoint and userinfo_endpoint. The deploy stayed green and every admin SSO login failed at the code-to-token exchange. container_service is the maintained lookup for the addressable form and yields keycloak in compose, keycloak_keycloak in swarm. init.sh no longer waits on the S3 endpoint: c5a149b11 unmounted the config it guarded, while a hard fail there still took web, worker and scheduler with it. The admin-bundle check now runs unconditionally — it was skipped exactly when objstore was on, i.e. in the only variant with SSO, although the bundles are local either way. The two objstore env vars lost their last consumer with it. no_log now sits on the two tasks that carry the admin password and the OIDC client secret; handing it through include_tasks apply: does not censor them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
49 lines
2.0 KiB
YAML
49 lines
2.0 KiB
YAML
---
|
|
- name: "📦 Install & activate {{ SHOPWARE_OIDC_PLUGIN }}"
|
|
ansible.builtin.shell:
|
|
cmd: >- # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i --user {{ SHOPWARE_USER }}
|
|
-e SHOPWARE_ROOT={{ SHOPWARE_ROOT | quote }}
|
|
-e PLUGIN_NAME={{ SHOPWARE_OIDC_PLUGIN | quote }}
|
|
{{ SHOPWARE_WEB_LOCAL_CID | quote }}
|
|
sh
|
|
stdin: |
|
|
set -e
|
|
cd "$SHOPWARE_ROOT"
|
|
php bin/console plugin:refresh
|
|
installed="$(php bin/console plugin:install --activate "$PLUGIN_NAME")"
|
|
printf '%s\n' "$installed"
|
|
printf '%s' "$installed" | grep -qi installed
|
|
changed_when: false
|
|
|
|
- name: "🔐 Ensure the Keycloak login provider is configured"
|
|
ansible.builtin.shell:
|
|
cmd: >- # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i --user {{ SHOPWARE_USER }}
|
|
-e SHOPWARE_API_BASE={{ SHOPWARE_API_BASE | quote }}
|
|
-e ADMIN_USER={{ lookup('users', 'administrator').username | quote }}
|
|
-e ADMIN_PASSWORD={{ lookup('users', 'administrator').password | quote }}
|
|
-e OIDC_AUTH_SERVER={{ OIDC.URL | quote }}
|
|
-e OIDC_INTERNAL_BASE={{ SHOPWARE_OIDC_INTERNAL_BASE | quote }}
|
|
-e OIDC_REALM={{ OIDC.CLIENT.REALM | quote }}
|
|
-e OIDC_CLIENT_ID={{ OIDC.CLIENT.ID | quote }}
|
|
-e OIDC_CLIENT_SECRET={{ OIDC.CLIENT.SECRET | quote }}
|
|
{{ SHOPWARE_WEB_LOCAL_CID | quote }}
|
|
php
|
|
stdin: "{{ lookup('ansible.builtin.file', role_path ~ '/files/php/oidc/client.php') }}"
|
|
changed_when: false
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "♻️ Clear the cache so the provider is discovered"
|
|
ansible.builtin.shell:
|
|
cmd: >- # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i --user {{ SHOPWARE_USER }}
|
|
-e SHOPWARE_ROOT={{ SHOPWARE_ROOT | quote }}
|
|
{{ SHOPWARE_WEB_LOCAL_CID | quote }}
|
|
sh
|
|
stdin: |
|
|
set -e
|
|
cd "$SHOPWARE_ROOT"
|
|
php bin/console cache:clear
|
|
changed_when: false
|