---
- name: "🔍 Resolve {{ application_id }} hosting node + container id"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
vars:
resolve_service_key: "{{ SNIPE_IT_SERVICE }}"
resolve_output_prefix: SNIPEIT_IDENTITY
resolve_compose_cid: "{{ SNIPE_IT_CONTAINER }}"
- name: "🔐 Hand Passport's keys to apache, as the image's startup script does"
ansible.builtin.command:
argv:
- container
- exec
- "{{ SNIPEIT_IDENTITY_LOCAL_CID }}" # nocheck: container-exec-resolver
- chown
- -R
- apache:root
- /var/lib/snipeit/keys
changed_when: false
delegate_to: "{{ SNIPEIT_IDENTITY_HOST_NODE }}"
run_once: true
- name: "🔑 Mint the read-only Snipe-IT token the MCP adapter presents"
ansible.builtin.command:
argv:
- container
- exec
- -i
- -u
- apache
- -e
- APP_KEY
- -e
- "MCP_USER={{ SNIPEIT_MCP_UPSTREAM_USER }}"
- -e
- MCP_PASSWORD
- -e
- "MCP_TOKEN_NAME={{ SNIPEIT_MCP_UPSTREAM_TOKEN_NAME }}"
- -e
- MCP_CURRENT_TOKEN
- "{{ SNIPEIT_IDENTITY_LOCAL_CID }}" # nocheck: container-exec-resolver
- php
stdin: "{{ lookup('file', 'php/provision_mcp_identity.php') }}"
environment:
APP_KEY: "{{ SNIPE_IT_APP_KEY }}"
MCP_PASSWORD: "{{ SNIPEIT_MCP_UPSTREAM_PASSWORD }}"
MCP_CURRENT_TOKEN: "{{ MCP_UPSTREAM_CURRENT_KEY }}"
register: snipeit_mcp_identity
retries: 30
delay: 10
until: snipeit_mcp_identity.rc == 0
changed_when: true
delegate_to: "{{ SNIPEIT_IDENTITY_HOST_NODE }}"
run_once: true
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🛑 Refuse an adapter whose upstream identity did not converge"
ansible.builtin.assert:
that:
- snipeit_mcp_identity.stdout_lines | length == 2
fail_msg: >-
{{ application_id }} could not mint a read-only API token for its MCP adapter.
- name: "🔑 Hand the minted token to the adapter"
ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/svc-ai-mcp-adapter/tasks/upstream_key.yml') }}"
vars:
mcp_upstream_key_path: "{{ [SNIPEIT_MCP_INSTANCE_DIR, 'upstream.env'] | path_join }}"
mcp_upstream_key: "{{ snipeit_mcp_identity.stdout_lines[1] }}"
