---
- name: "🔍 Resolve openproject web hosting node + container id"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
vars:
resolve_service_key: web
resolve_output_prefix: OPENPROJECT_WEB
resolve_compose_cid: "{{ OPENPROJECT_WEB_CONTAINER_ADDRESS }}"
- name: ✅ Ensure administrator user exists and is admin
ansible.builtin.command:
argv:
- container
- exec
- -i
- -e
- "OPENPROJECT_ADMIN_PASSWORD={{ OPENPROJECT_ADMINISTRATOR_PASSWORD }}"
- -e
- "OPENPROJECT_ADMIN_LOGIN={{ OPENPROJECT_ADMINISTRATOR_USERNAME }}"
- -e
- "OPENPROJECT_ADMIN_EMAIL={{ OPENPROJECT_ADMINISTRATOR_EMAIL }}"
- "{{ OPENPROJECT_WEB_LOCAL_CID }}" # nocheck: container-exec-resolver CID resolved at delegate_to runtime; container_address targets a manager-only subshell
- bash
- -lc
- "cd /app && bundle exec rails runner -"
stdin: "{{ lookup('file', 'ruby/ensure_admin_user.rb') }}"
delegate_to: "{{ OPENPROJECT_WEB_HOST_NODE }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: 🔧 Link admin to LDAP auth source so trusted-header bridge can resolve it
ansible.builtin.command:
argv:
- container
- exec
- -i
- -e
- "OPENPROJECT_LDAP_NAME={{ OPENPROJECT_LDAP.name }}"
- -e
- "OPENPROJECT_ADMIN_LOGIN={{ OPENPROJECT_ADMINISTRATOR_USERNAME }}"
- "{{ OPENPROJECT_WEB_LOCAL_CID }}" # nocheck: container-exec-resolver CID resolved at delegate_to runtime; container_address targets a manager-only subshell
- bash
- -lc
- "cd /app && bundle exec rails runner -"
stdin: "{{ lookup('file', 'ruby/link_admin_to_ldap.rb') }}"
delegate_to: "{{ OPENPROJECT_WEB_HOST_NODE }}"
when: OPENPROJECT_HEADER_SSO_ENABLED | bool
register: openproject_ldap_link
changed_when: "'Linked' in openproject_ldap_link.stdout"
