mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 04:06:42 +00:00
kevinveenbirkenbachandClaude Opus 5
23e642a3f3
3c72c2002aand5366788ab1moved application roles from the host account administrator onto platform_administrator. administrator never rotates: it declares ansible_become_password in roles/user-administrator/meta/users.yml, so the generator pins nothing into host_vars, and rotate.py:12 exempts it anyway. platform_administrator rotates with every --users pass, between PASS 1 and PASS 2 of a matrix-deploy round. The roles below wrote the password only when they created the account, so from the second pass on the instance kept the previous value while the deploy rendered the new one, and the sign-in failed. Each one now re-applies the declared password through its own handle. baserow drops the 'if created' guard and compares with check_password. gitea and mattermost gain a change-password call beside the create they already had. gitlab realigns its native root break-glass through the Rails runner and clears password_automatically_set, which would otherwise make valid_password? return false whatever the password is. magento and snipe-it get a script because neither ships a CLI for an existing account; magento's runs under AREA_GLOBAL so the adminhtml-only admin_user_save_after observer never loads, at the price of the admin_passwords history row. matomo moves its realign out from behind the token gate a rotation never opens. The matrix ansible flavor gets the realign its compose flavor already had. bluesky resets the native PDS account through the admin API when the create reports the handle taken. Every new path follows the contract web-app-nextcloud and sys-svc-rdbms already use: [CHANGED] / [UNCHANGED] / [FAIL] on the wire, failed_when on rc or [FAIL], and an absent account is a failure rather than a silent zero-row success. The password reaches the container through container exec -e NAME plus a task environment, never the host-side argv. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
29 lines
1.1 KiB
Ruby
29 lines
1.1 KiB
Ruby
# nocheck: mirrored-unit-test - runs in `gitlab-rails runner` against the User model,
|
|
# which comes from the GitLab image and is not loadable anywhere else
|
|
#
|
|
# Env (from the container):
|
|
# GITLAB_ROOT_USERNAME login of the built-in break-glass account
|
|
# GITLAB_ROOT_PASSWORD password it must accept afterwards
|
|
#
|
|
# Exit: 0 with [CHANGED] or [UNCHANGED] on stdout, 1 with [FAIL] on stderr.
|
|
#
|
|
# password_automatically_set makes User#valid_password? return false whatever the
|
|
# password is (app/models/user.rb), so a realign that leaves it set locks the
|
|
# account out instead of recovering it.
|
|
username = ENV.fetch('GITLAB_ROOT_USERNAME')
|
|
password = ENV.fetch('GITLAB_ROOT_PASSWORD')
|
|
|
|
user = User.find_by_username(username)
|
|
abort("[FAIL] no GitLab user named '#{username}'") if user.nil?
|
|
|
|
if user.valid_password?(password) && !user.password_automatically_set?
|
|
puts "[UNCHANGED] #{username} already accepts the declared password"
|
|
exit(0)
|
|
end
|
|
|
|
user.password = user.password_confirmation = password
|
|
user.password_automatically_set = false
|
|
user.save!
|
|
|
|
puts "[CHANGED] #{username} was realigned with the declared password"
|