realign_synapse_password.yml

---
# Param: realign_localpart  - the account's localpart, e.g. "chatgptbot"
# Param: realign_password    - the password the deployment declares for it
- name: "🔑 Hash the declared password for {{ realign_localpart }}"
  ansible.builtin.shell:
    cmd: >-
      IFS= read -r MATRIX_REALIGN_PASSWORD && export MATRIX_REALIGN_PASSWORD &&
      container exec -i -e MATRIX_REALIGN_PASSWORD {{ MATRIX_SYNAPSE_CONTAINER_ADDRESS }}
      sh -c 'hash_password -c "{{ MATRIX_SYNAPSE_CONFIG_PATH_CONTAINER }}"
      -p "$MATRIX_REALIGN_PASSWORD"'
    stdin: "{{ realign_password }}"
    executable: /bin/bash
  register: matrix_password_hash
  changed_when: false

- name: "🔑 Point {{ realign_localpart }} at the declared password"
  ansible.builtin.shell:
    cmd: >-
      IFS= read -r PGPASSWORD && export PGPASSWORD &&
      container exec -i -e PGPASSWORD
      {{ lookup('database', application_id, 'address') }}
      psql -v ON_ERROR_STOP=1 -U {{ MATRIX_POSTGRES_USER | quote }}
      -d {{ MATRIX_POSTGRES_DATABASE | quote }}
      -v hash={{ (matrix_password_hash.stdout | trim) | quote }}
      -v name={{ lookup('mxid', realign_localpart) | quote }}
      -f -
    stdin: |-
      {{ MATRIX_POSTGRES_PASSWORD }}
      {{ lookup('file', 'sql/realign_user_password.sql') }}
    executable: /bin/bash
  register: matrix_password_update
  changed_when: "'UPDATE 1' in matrix_password_update.stdout"
  failed_when: >-
    matrix_password_update.rc != 0
    or 'UPDATE 1' not in matrix_password_update.stdout