---
# Persist the OIDC mapping for the Pixelfed administrator user. SQL
# bodies live in roles/web-app-pixelfed/files/sql/*.sql and are loaded
# via `query_file:` so the same task shape works whether Pixelfed's DB
# runs in a central `svc-db-*` container or a per-role
# `<entity>-database` container — the database_query module hands the
# query off to whichever the `database` lookup resolves to.
- name: "⏳ Wait until the Pixelfed OIDC mapping table exists"
database_query:
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc-mapping/select-table.sql"
named_args:
db_name: "{{ PIXELFED_DB_NAME }}"
expect_rows: true
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
register: pixelfed_admin_oidc_table
changed_when: false
retries: 60
delay: 5
until: pixelfed_admin_oidc_table.rows | length > 0
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "✅ Verify the Pixelfed OIDC mapping table contains the expected columns"
database_query:
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc-mapping/count-columns.sql"
named_args:
db_name: "{{ PIXELFED_DB_NAME }}"
expect_rows: true
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
register: pixelfed_admin_oidc_columns
changed_when: false
failed_when: (pixelfed_admin_oidc_columns.rows[0][0] | int) != 4
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "✅ Ensure the Pixelfed administrator OIDC mapping exists"
database_query:
config: "{{ lookup('database', application_id) }}"
query_file: "{{ role_path }}/files/sql/oidc-mapping/upsert.sql"
named_args:
user_id: "{{ pixelfed_admin_id.rows[0][0] | int }}"
oidc_id: "{{ PIXELFED_ADMIN_OIDC_ID }}"
expect_rows: true
mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
register: pixelfed_admin_oidc_mapping
changed_when: (pixelfed_admin_oidc_mapping.rows[-1][0] | int) > 0
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
