diff options
| author | Luke Hoersten <[email protected]> | 2026-07-31 14:31:51 -0500 |
|---|---|---|
| committer | Luke Hoersten <[email protected]> | 2026-07-31 14:31:51 -0500 |
| commit | a9a87f70f787fbc0d47d7138996e31294f172bea (patch) | |
| tree | c2baec7e03630d5770122c5e6738d76b884bf4ea | |
| parent | afcc3e3fe02034c536b4d24d340288c784ea840b (diff) | |
soju: gate the admin password reset behind soju_reset_password
The unconditional change-password re-keyed the account on every run,
clobbering any password changed in-band and locking out clients.
| -rw-r--r-- | soju/tasks/main.yaml | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/soju/tasks/main.yaml b/soju/tasks/main.yaml index 742a665..cdc9ad4 100644 --- a/soju/tasks/main.yaml +++ b/soju/tasks/main.yaml @@ -72,12 +72,15 @@ failed_when: soju_create_user.rc != 0 and 'duplicate key' not in soju_create_user.stderr no_log: true +# Gated: an unconditional reset re-keys the account on every run, clobbering +# any password changed in-band and locking out logged-in clients. - name: update soju admin password become: yes become_user: "{{soju_user}}" shell: "echo '{{soju_admin_password}}' | sojudb -config /etc/soju/config change-password {{soju_admin_user}}" - changed_when: false + changed_when: true no_log: true + when: soju_reset_password | default(false) | bool - name: install nginx stream config become: yes |