---
# Restart admin only while the issuer answers: heviat-Mailu fetches the OIDC
# provider config on the first /sso request and caches a failure until restart.
- name: "⏳ Wait for the OIDC issuer discovery endpoint"
ansible.builtin.shell: >-
container exec -i {{ MAILU_ADMIN_CONTAINER_ADDRESS }}
{{ 30 | curl }} -ksS -o /dev/null -w "%{http_code}"
--proxy {{ MAILU_OIDC_SOCKS_PROXY | quote }} {{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}
register: mailu_oidc_issuer_probe
changed_when: false
retries: 30
delay: 5
until: mailu_oidc_issuer_probe.stdout == '200'
- name: "🔄 Restart Mailu admin so the OIDC provider config is re-fetched (compose)"
ansible.builtin.shell: "container restart {{ MAILU_ADMIN_CONTAINER_ADDRESS }}"
changed_when: true
when: IS_COMPOSE_MODE
- name: "🔄 Restart Mailu admin so the OIDC provider config is re-fetched (swarm)"
ansible.builtin.command: "container service update --force {{ lookup('container_service', application_id, 'admin') }}"
changed_when: true
timeout: "{{ lookup('timeout', 600) | int }}"
when: IS_SWARM_MODE
- name: "🧹 Clear the deferred OIDC refresh flag"
ansible.builtin.set_fact:
mailu_oidc_restart_pending: false
