---
- name: "⚙️ Load OIDC Settings for Peertube"
include_vars: vars/oidc-settings.yml
changed_when: false
- name: "🧭 Resolve PeerTube host node + local container id"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
vars:
resolve_service_key: "{{ entity_name }}"
resolve_output_prefix: PEERTUBE
resolve_compose_cid: "{{ PEERTUBE_CONTAINER }}"
- name: 🔎 Check if OIDC plugin is already installed
shell: |
# nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ PEERTUBE_LOCAL_CID | quote }} test -d /data/plugins/node_modules/{{ PEERTUBE_OIDC_PLUGIN }}
register: peertube_oidc_plugin_check
failed_when: false
changed_when: false
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
- name: "📦 Install auth-openid-connect plugin for Peertube (mem_limit bump + diagnostics)"
when: peertube_oidc_plugin_check.rc != 0
block:
- name: "📦 PEERTUBE | Raise mem_limit for plugin install"
ansible.builtin.shell: |
container update \
--memory {{ PEERTUBE_OIDC_PLUGIN_INSTALL_MEM_LIMIT }} \
--memory-swap -1 \
{{ PEERTUBE_LOCAL_CID | quote }}
changed_when: true
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
- name: "📦 Install auth-openid-connect plugin for Peertube"
ansible.builtin.shell: >
container exec
-e NODE_OPTIONS=--max-old-space-size={{ PEERTUBE_OIDC_PLUGIN_INSTALL_MAX_OLD_SPACE_MB }}
{{ PEERTUBE_LOCAL_CID | quote }} npm run plugin:install -- --npm-name {{ PEERTUBE_OIDC_PLUGIN }}
register: peertube_oidc_install
changed_when: peertube_oidc_install.rc == 0
retries: 3
delay: 15
until: peertube_oidc_install.rc == 0
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
notify: container-recreate
- name: "♻️ PEERTUBE | Restore compose-defined mem_limit"
ansible.builtin.shell: |
container update \
--memory {{ PEERTUBE_MEM_LIMIT }} \
--memory-swap {{ PEERTUBE_MEM_LIMIT }} \
{{ PEERTUBE_LOCAL_CID | quote }}
changed_when: true
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
- name: "🔄 Update the settings column of the auth-openid-connect plugin"
database_query:
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
config: "{{ lookup('database', application_id) }}"
query: "{{ lookup('file', role_path ~ '/files/sql/upsert-oidc-plugin.sql') }}" # nocheck: database-query-raw controller-read so the SQL travels to the remote swarm host that lacks the repo files
named_args:
settings: "{{ oidc_settings | to_json }}"
expect_rows: true
register: _peertube_oidc_update
retries: 5
delay: 3
until: _peertube_oidc_update is succeeded
changed_when: _peertube_oidc_update.rows | default([]) | length > 0
notify: container-recreate
- name: "🔎 Check if the running PeerTube has registered the OIDC plugin"
shell: |
# nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ PEERTUBE_LOCAL_CID | quote }} test -d /data/plugins/data/{{ PEERTUBE_OIDC_PLUGIN }}
register: _peertube_oidc_registered
failed_when: false
changed_when: _peertube_oidc_registered.rc != 0
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
notify: container-recreate
- name: "🚿 Flush the container recreation before verifying the OIDC registration"
meta: flush_handlers
- name: "🧭 Re-resolve PeerTube host node + local container id after the recreation"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
vars:
resolve_service_key: "{{ entity_name }}"
resolve_output_prefix: PEERTUBE
resolve_compose_cid: "{{ PEERTUBE_CONTAINER }}"
- name: "🛑 Fail if the running PeerTube has still not registered the OIDC plugin"
shell: |
# nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ PEERTUBE_LOCAL_CID | quote }} test -d /data/plugins/data/{{ PEERTUBE_OIDC_PLUGIN }}
register: _peertube_oidc_verified
retries: 30
delay: 10
until: _peertube_oidc_verified.rc == 0
changed_when: false
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
- name: "🔎 Read when the running PeerTube process started"
shell: |
# nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container inspect --type container --format '{{ "{{.State.StartedAt}}" }}' {{ PEERTUBE_LOCAL_CID | quote }}
register: _peertube_started_at
changed_when: false
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
- name: "🛑 Fail if the OIDC plugin registered but never built a client"
shell: |
# nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container logs --since {{ _peertube_started_at.stdout | trim | quote }} {{ PEERTUBE_LOCAL_CID | quote }} 2>&1 | grep -qE 'Initial OpenID discovery failed|Cannot load settings and create open id client'
register: _peertube_oidc_discovery_failed
failed_when: _peertube_oidc_discovery_failed.rc == 0
changed_when: false
delegate_to: "{{ PEERTUBE_HOST_NODE }}"
