TODO

• tasks/01_setup.yml:30 passes lookup('users', 'platform_administrator').password to mmctl --local user create --password on the command line, where the process list of the node shows it (read from the task; mmctl reads a password from standard input only for user change-password). Options: create the account with a random throwaway password and set the real one through mmctl --local user change-password fed on standard input; or create the account through the local API socket.

• MM_EXPERIMENTALSETTINGS_DISABLELANDINGPAGE in templates/env.j2 does not switch the landing page off: the deployed 11.11.1 still hands EnableDesktopLandingPage: "true" to its client (measured through /api/v4/config/client on the compose stack), so a first visit lands on /landing and the specs seed localStorage.__landingPageSeen__. Options: set MM_SERVICESETTINGS_ENABLEDESKTOPLANDINGPAGE=false; or keep the page and drop the dead variable.

• templates/javascript.js.j2 inserts the “SSO with …” link into the sign-in form whenever the form shows, also with services.sso.enabled false, where no MM_GITLABSETTINGS_* is rendered (measured on the compose stack with sso off: a[href='/oauth/gitlab/login'] is present on /login). Options: render the snippet only under MATTERMOST_OIDC_ENABLED.

• The browser tab icon stays upstream’s: Team Edition has no favicon setting and the client rewrites its five link[rel=icon] elements on every unread or mention change (read from unreads_status_handler.tsx at tag v11.11.1). The sign-in brand image (TeamSettings.EnableCustomBrand) is not set either: its upload route POST /api/v4/brand/image needs a session and has no mmctl --local command. Options: upload the image with a personal access token of the administrator; or leave both to upstream.