TODO

• Credentials in argv: tasks/01_wait_for_api.yml (“Wait until Stalwart leaves bootstrap mode”) and tasks/11_oidc_restart.yml pass -u STALWART_ADMIN_USER:STALWART_ADMIN_PASSWORD to curl inside container exec, so the recovery admin password sits in the rendered shell command (printed as cmd at -vv while MASK_CREDENTIALS_IN_LOGS is off) and in the process list of the container; tasks/jmap_call.yml already feeds the same pair through curl -K - on stdin. Option: route both waits through jmap_call.yml or the same stdin config pattern.

• System Administrator reaches only the accounts the deploy provisions: v0.16.26 maps no group to a role, so tasks/admin_role.yml stamps roles on each STALWART_ADMIN_ACCOUNT_NAMES account instead. A user who is added to the Keycloak group administrator without a mailbox account signs in through the OIDC just-in-time path, which hard-codes UserRoles::User, and stays an ordinary user until the next deploy gives it an account. Option: re-run the grant from a Keycloak group read rather than from STALWART_USERS, once Stalwart maps claim groups to roles.