mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
47060a72d3
Follow-up to the v1.0.0 port, closing holes a review and a local run found: - WebUI sign-in: WebUI v2 sends an http:// client-metadata-document id on the onion origin, which Stalwart v1.0.0 rejects (unknown http ids get no CIMD fallback, trusted hosts require TLS). The recovery admin under SSO hit the same wall with the bare id 'stalwart-webui'. Register a public first-party x:OAuthClient 'stalwart-webui' with the WebUI's callback and login URIs on the served origin, and always inject it as the Application's oauthClientId. Native sign-in now shows Stalwart's consent step; test-login-native.js clicks it and also runs under SSO. - Store guard: the previous guard only checked a running 0.16 server; a local run showed v1 writing into a 0.16 store whose server was stopped. The guard now reads the store whenever one exists (shared: pg_database, dedicated: volume) and fails on the 0.16 bigint layout. A host marker written at the end of a successful v1 deploy lets restores and redeploys with a stopped dedicated database pass; without the marker, a stopped dedicated database fails with an explicit message instead of a masked psql error. Queries retry while the database recovers. - README: WebUI sign-in, guard semantics, restore and redeploy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.9 KiB
YAML
56 lines
1.9 KiB
YAML
---
|
|
# include-gated: when: IS_STACK_HOST | bool
|
|
# Manager-side operations: every task here execs into or restarts containers
|
|
# of the manager-pinned stack, so only the stack host may run them.
|
|
|
|
- name: "🔄 Restart clamav to apply milter config change (compose)"
|
|
ansible.builtin.command: "container restart {{ STALWART_CONTAINER }}_clamav"
|
|
changed_when: true
|
|
when:
|
|
- DEPLOYMENT_MODE == 'compose'
|
|
- STALWART_ANTIVIRUS_ENABLED | bool
|
|
- stalwart_clamav_conf is defined
|
|
- stalwart_clamav_conf is changed
|
|
|
|
- name: "🔄 Restart webmail to apply Roundcube config change (compose)"
|
|
ansible.builtin.command: "container restart {{ STALWART_CONTAINER }}_webmail"
|
|
changed_when: true
|
|
when:
|
|
- DEPLOYMENT_MODE == 'compose'
|
|
- STALWART_SSO_ENABLED | bool
|
|
- stalwart_webmail_conf is defined
|
|
- stalwart_webmail_conf is changed
|
|
|
|
- name: ⏳ Wait for Stalwart database and management API
|
|
include_tasks: 01_wait_for_api.yml
|
|
|
|
- name: "🔧 Point Stalwart's file tracer at a writable directory"
|
|
include_tasks: tracing.yml
|
|
|
|
- name: "⏱️ Let Stalwart's address bans expire"
|
|
include_tasks: security.yml
|
|
|
|
- name: "⚙️ Provision the Stalwart WebUI (WebAdmin) bundle"
|
|
include_tasks: 02_webadmin.yml
|
|
|
|
- name: "⚙️ Provision Stalwart mail domain, accounts, DKIM and DNS"
|
|
include_tasks: 03_provision_domain.yml
|
|
|
|
- name: "🔧 Apply Stalwart OIDC directory changes"
|
|
include_tasks: 10_oidc_apply.yml
|
|
when: STALWART_SSO_ENABLED | bool
|
|
|
|
- name: "📥 Import legacy Mailu maildirs (manual cutover switch, compose only)"
|
|
include_tasks: 12_import_mailu.yml
|
|
when:
|
|
- STALWART_IMPORT_MAILU | bool
|
|
- "'web-app-mailu' in group_names"
|
|
- STALWART_ACTIVE_PROVIDER | bool
|
|
- DEPLOYMENT_MODE == 'compose'
|
|
|
|
- name: "📝 Record that Stalwart 1.x serves the store of this host"
|
|
stack_host_copy:
|
|
content: "{{ STALWART_STORE_LAYOUT_VERSION }}\n"
|
|
dest: "{{ STALWART_STORE_MARKER_FILE }}"
|
|
mode: "0644"
|