---
- name: "🔍 Resolve Mattermost hosting node + container id"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
vars:
resolve_service_key: mattermost
resolve_service_name: "{{ lookup('container_service', 'web-app-mattermost', 'mattermost') }}"
resolve_output_prefix: NEXTCLOUD_MM
resolve_compose_cid: "{{ lookup('container_address', 'web-app-mattermost', 'mattermost') }}"
resolve_converge_retries: 120
resolve_converge_delay: 5
- name: ⏳ Wait until Mattermost mmctl local mode is ready
shell: >- # nocheck: container-exec-resolver NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
{{ lookup('config', 'web-app-mattermost', 'services.mattermost.mmctl') }} --local system status
args:
chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
register: nextcloud_mm_ready
retries: 60
delay: 5
until: nextcloud_mm_ready.rc == 0
changed_when: false
failed_when: nextcloud_mm_ready.rc != 0 and nextcloud_mm_ready.attempts | default(0) >= 60
- name: 🟢 Enable the Mattermost OAuth 2.0 service provider (required for the connector)
shell: >- # nocheck: container-exec-resolver NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
{{ lookup('config', 'web-app-mattermost', 'services.mattermost.mmctl') }} --local config set ServiceSettings.EnableOAuthServiceProvider true
args:
chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
register: nextcloud_mm_oauth_provider
changed_when: "'true' in nextcloud_mm_oauth_provider.stdout"
- name: ⚙️ Generate a short-lived admin personal access token for OAuth provisioning
shell: >- # nocheck: container-exec-resolver NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
{{ lookup('config', 'web-app-mattermost', 'services.mattermost.mmctl') }} --local token generate {{ lookup('users', 'platform_administrator').username }} infinito-nc-oauth-provision
--json
args:
chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
register: nextcloud_mm_pat
changed_when: true
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: 🔎 Parse the admin personal access token
set_fact:
nextcloud_mm_token: "{{ (nextcloud_mm_pat.stdout | from_json | first).token }}"
nextcloud_mm_token_id: "{{ (nextcloud_mm_pat.stdout | from_json | first).id }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "⏳ Wait until the Mattermost HTTP API serves (mmctl local mode skips it)"
uri_retry:
url: "{{ nextcloud_mm_local_url }}/api/v4/system/ping"
timeout: "{{ lookup('timeout', 10) | int }}"
status_code: 200
delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
register: nextcloud_mm_http_ready
retries: 30
delay: 5
until: nextcloud_mm_http_ready is succeeded
- name: 🔧 Provision Mattermost OAuth app for Nextcloud and capture creds (idempotent)
ansible.builtin.command:
argv:
- bash
- -s
stdin: "{{ lookup('file', 'shell/addons/mattermost/provision_oauth_app.sh') }}"
environment:
MM_LOCAL_URL: "{{ nextcloud_mm_local_url }}"
MM_TOKEN: "{{ nextcloud_mm_token }}"
MM_APP_NAME: Nextcloud
NC_BASE_URL: "{{ NEXTCLOUD_URL }}"
NC_REDIRECT_PATH: "{{ nextcloud_mm_redirect_path }}"
MM_HOMEPAGE: "{{ NEXTCLOUD_URL }}"
delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
register: nextcloud_mm_provision
changed_when: false
retries: 5
delay: 5
until: nextcloud_mm_provision is succeeded
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: 🔎 Parse Mattermost OAuth client credentials
set_fact:
nextcloud_mm_client_id: "{{ nextcloud_mm_provision.stdout | regex_search('CLIENT_ID=(.+)', '\\1') | first }}"
nextcloud_mm_client_secret: "{{ nextcloud_mm_provision.stdout | regex_search('CLIENT_SECRET=(.+)', '\\1') | first }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: 🔧 Point integration_mattermost at partner instance (admin OAuth instance URL)
shell: >
{{ NEXTCLOUD_DOCKER_EXEC_OCC }}
config:app:set integration_mattermost oauth_instance_url
--value '{{ nextcloud_mm_base_url }}'
register: nextcloud_mm_oauth_url_set
changed_when: "' set to ' in nextcloud_mm_oauth_url_set.stdout"
# nocheck: container-exec-resolver NEXTCLOUD_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
- name: 🔐 Store integration_mattermost OAuth credentials Nextcloud-encrypted (lazy)
ansible.builtin.shell:
cmd: >-
container exec -i -u {{ NEXTCLOUD_DOCKER_USER }}
-e NC_APP_ID=integration_mattermost
-e NC_ENC_MODE=sensitive
-e NC_ENC_B64
{{ NEXTCLOUD_LOCAL_CID | quote }} php
stdin: "{{ lookup('file', 'php/utils/set_encrypted_appconfig.php') }}"
environment:
NC_ENC_B64: "{{ {'client_id': nextcloud_mm_client_id, 'client_secret': nextcloud_mm_client_secret} | to_json | b64encode }}"
register: nextcloud_mm_enc_set
changed_when: "'OK' in nextcloud_mm_enc_set.stdout"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: 🚫 Revoke the short-lived admin personal access token
shell: >- # nocheck: container-exec-resolver NEXTCLOUD_MM_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
container exec -i {{ NEXTCLOUD_MM_LOCAL_CID | quote }}
{{ lookup('config', 'web-app-mattermost', 'services.mattermost.mmctl') }} --local token revoke {{ nextcloud_mm_token_id }}
args:
chdir: "{{ nextcloud_mm_exec_chdir | default(omit) }}"
delegate_to: "{{ NEXTCLOUD_MM_HOST_NODE }}"
changed_when: true
failed_when: false
