mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5
c7238adb0a
Keycloak stores the permanent admin's password in its own database. When the inventory value rotates, the next deploy renders a credential that authenticates against nothing, and the role cannot reach the instance it just restarted. The bootstrap account is no way back either: Keycloak writes KC_BOOTSTRAP_ADMIN_* once, on an empty database, and upstream states it is meant to be removed once a permanent admin exists. The role now keeps the credential its predecessor used. Before sys-stk-full re-renders the environment file with force: true, utils/capture_previous_admin.yml reads KEYCLOAK_PERMANENT_ADMIN_PASSWORD out of the copy still on disk. When the login after the restart is refused, utils/converge_previous_admin.yml signs in with that captured value and moves the account onto the newly rendered one, which the restarted container already carries in its environment. The bootstrap fallback stays what its name says: the path for an instance that has never been deployed. A host with no previous file captures nothing and goes straight there. Reading the file back needs the inverse of dotenv_quote, which did not exist. dotenv_unquote switches on the same DEPLOYMENT_MODE as the forward direction, so a value written in compose is unescaped and a value written in swarm is taken verbatim; dotenv_value pulls one assignment's raw right-hand side out of the rendered text. The password never reaches argv: the convergence login passes it through container exec -e plus the task's environment:. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>