TODO¶

Custom CSS ownership: with sso enabled files/shell/configure-auth.sh posts a fixed CustomCss to /System/Configuration/branding on every deploy and so replaces the whole custom CSS of the server; replaying that payload on the compose stack removed the corporate block, and the design task in tasks/utils/design.yml that runs afterwards appended it again and reported changed, so the role is not idempotent in that variant and the web client is unstyled between the two tasks. Let the script read the branding first and keep foreign CSS, or move its two rules into templates/branding.css.j2 and let the script write only the login disclaimer.
Administrator password in argv: files/shell/configure-auth.sh puts JELLYFIN_ADMIN_PASSWORD into the curl -d argument of the wizard user (line 25), of authenticate (line 33) and of the password change (line 70) on the hosting node, and tasks/utils/mcp.yml passes it as -e JELLYFIN_ADMIN_PASSWORD=<value> to container exec (line 31), so the process list of the node shows the administrator password while these calls run, and ansible.builtin.command runs os.path.expandvars over the MCP argv while that password alphabet contains $. Send the JSON bodies with --data @- from the printf builtin, and forward the MCP value as -e JELLYFIN_ADMIN_PASSWORD plus the task’s environment:.
Stale login route: onLoginSurface in files/playwright/_shared.js matches login.html or a bare /web/, while Jellyfin 10.11.11 routes a visitor to /web/#/login?serverid=<id>&url=%2Fhome; the guest test and logout therefore only pass on the transient /web/ before the client has routed. Match #/login instead.
The four auth tasks (“Wizard + plugin install”, “Restart to load installed plugins”, “LDAP/SSO configuration”, “Final restart”) carry changed_when: true and report changed on every deploy (measured 2026-10-11 in two consecutive role syncs), and a changed administrator password costs about two minutes of wizard retries before the pin reset converges it. Options: changed_when on output the script prints only on a real change, and probe the password once before entering the retry loop.