From a9a87f70f787fbc0d47d7138996e31294f172bea Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Fri, 31 Jul 2026 14:31:51 -0500 Subject: soju: gate the admin password reset behind soju_reset_password The unconditional change-password re-keyed the account on every run, clobbering any password changed in-band and locking out clients. --- soju/tasks/main.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'soju/tasks/main.yaml') diff --git a/soju/tasks/main.yaml b/soju/tasks/main.yaml index 742a665..cdc9ad4 100644 --- a/soju/tasks/main.yaml +++ b/soju/tasks/main.yaml @@ -72,12 +72,15 @@ failed_when: soju_create_user.rc != 0 and 'duplicate key' not in soju_create_user.stderr no_log: true +# Gated: an unconditional reset re-keys the account on every run, clobbering +# any password changed in-band and locking out logged-in clients. - name: update soju admin password become: yes become_user: "{{soju_user}}" shell: "echo '{{soju_admin_password}}' | sojudb -config /etc/soju/config change-password {{soju_admin_user}}" - changed_when: false + changed_when: true no_log: true + when: soju_reset_password | default(false) | bool - name: install nginx stream config become: yes -- cgit v1.2.3