---
- name: "🔑 Grant the mcp group read access to every MCP tool server"
ansible.builtin.command:
argv:
- container
- exec
- -i
- -e
- "OPENWEBUI_BASE=http://localhost:{{ OPENWEBUI_INTERNAL_HTTP_PORT }}"
- -e
- "OPENWEBUI_ADMIN_EMAIL={{ OPENWEBUI_API_BOT_USER.email }}"
- -e
- "OPENWEBUI_ADMIN_NAME={{ OPENWEBUI_API_BOT_USER.username }}"
- -e
- OPENWEBUI_ADMIN_PASSWORD
- -e
- "OPENWEBUI_MCP_GROUPS={{ openwebui_mcp_groups | to_json }}"
- -e
- "OPENWEBUI_MCP_MEMBERS={{ OPENWEBUI_MCP_MEMBERS | to_json }}"
- -e
- OPENWEBUI_MCP_CONNECTIONS
- "{{ OPENWEBUI_LOCAL_CID }}" # nocheck: container-exec-resolver
- python3
- "-"
stdin: "{{ lookup('file', 'python/provision_mcp_grants.py') }}"
environment:
OPENWEBUI_ADMIN_PASSWORD: "{{ OPENWEBUI_API_BOT_USER.password }}"
OPENWEBUI_MCP_CONNECTIONS: "{{ OPENWEBUI_MCP_SERVERS | mcp_tool_server_connections(OPENWEBUI_MCP_GROUP_IDS) | to_json }}"
register: openwebui_mcp_grants
retries: 30
delay: 10
until: openwebui_mcp_grants.rc == 0
changed_when: openwebui_mcp_grants.stdout.startswith('CHANGED')
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
delegate_to: "{{ OPENWEBUI_HOST_NODE }}"
run_once: true
- name: "💾 Persist each resolved group id so a bare restart keeps the grant"
ansible.builtin.include_role:
name: sys-token-store
tasks_from: write.yml
vars:
sys_token_store_user_key: "{{ OPENWEBUI_MCP_GROUP_OWNER }}"
sys_token_store_app: "{{ grant_group.key }}"
sys_token_store_token: "{{ grant_group.value }}"
loop: "{{ (openwebui_mcp_grants.stdout_lines | last | from_json) | dict2items }}"
loop_control:
loop_var: grant_group
label: "{{ grant_group.key }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "♻️ Re-render the env now that the group ids are known"
stack_host_template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ lookup('container', application_id, 'files.env') }}"
mode: "0640"
force: true
notify: compose-up
vars:
OPENWEBUI_MCP_GROUP_IDS: "{{ openwebui_mcp_grants.stdout_lines | last | from_json }}"
- name: "🚿 Restart Open WebUI so it reads the grants it was just given"
ansible.builtin.meta: flush_handlers
