---
# Always defer the OIDC refresh to the service-loader post-load flush: mid-play
# the issuer probe can hit a stale Keycloak that a later round step replaces.
# The flush runs after the loader finished, i.e. against the final Keycloak
# (10_oidc_refresh still waits for the issuer and fails loudly if absent).
- name: "📥 Defer the OIDC refresh to the service-loader post-load flush"
ansible.builtin.set_fact:
mailu_oidc_restart_pending: true
- name: "📥 Queue the deferred refresh"
include_role:
name: sys-service-loader
tasks_from: list_or_shoot.yml
vars:
list_or_shoot_roles:
- web-app-mailu
