110 lines
3.4 KiB
YAML
110 lines
3.4 KiB
YAML
---
|
|
# Reconcile super_sdn.sso_login_enabled on the UniFi controller DB.
|
|
# Idempotent: reads the current value, reports compliance when it already
|
|
# matches the target, and only mutates with explicit confirmation.
|
|
|
|
- name: Require a boolean target value
|
|
ansible.builtin.assert:
|
|
that:
|
|
- unifi_sso_target_value | type_debug == 'bool'
|
|
fail_msg: "unifi_sso_target_value must be a boolean (true or false)."
|
|
|
|
- name: Read current SSO login setting
|
|
ansible.builtin.command:
|
|
argv:
|
|
- docker
|
|
- exec
|
|
- "{{ unifi_container }}"
|
|
- mongo
|
|
- --port
|
|
- "{{ unifi_mongo_port }}"
|
|
- --quiet
|
|
- ace
|
|
- --eval
|
|
- 'db.setting.findOne({key:"super_sdn"}).sso_login_enabled'
|
|
register: unifi_sso_current
|
|
changed_when: false
|
|
failed_when: unifi_sso_current.rc != 0
|
|
check_mode: false
|
|
|
|
- name: Report current setting
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
sso_login_enabled={{ unifi_sso_current.stdout | trim }}
|
|
(target={{ unifi_sso_target_value | string | lower }})
|
|
|
|
- name: Report already compliant
|
|
ansible.builtin.debug:
|
|
msg: "Already compliant; no change needed."
|
|
when: unifi_sso_current.stdout | trim | lower == unifi_sso_target_value | string | lower
|
|
|
|
- name: Refuse to change without explicit confirmation
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
Change required (sso_login_enabled={{ unifi_sso_current.stdout | trim }}
|
|
!= target {{ unifi_sso_target_value | string | lower }}) but
|
|
unifi_sso_confirm is not true. Supply unifi_sso_confirm=true to apply.
|
|
when:
|
|
- unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
|
|
- not (unifi_sso_confirm | bool)
|
|
|
|
- name: Apply SSO login setting change
|
|
ansible.builtin.command:
|
|
argv:
|
|
- docker
|
|
- exec
|
|
- "{{ unifi_container }}"
|
|
- mongo
|
|
- --port
|
|
- "{{ unifi_mongo_port }}"
|
|
- --quiet
|
|
- ace
|
|
- --eval
|
|
- >-
|
|
db.setting.updateOne({key:"super_sdn"},
|
|
{$set:{sso_login_enabled: {{ unifi_sso_target_value | string | lower }}}})
|
|
when:
|
|
- unifi_sso_confirm | bool
|
|
- unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
|
|
changed_when: true
|
|
register: unifi_sso_update
|
|
|
|
- name: Restart controller to apply setting when requested
|
|
ansible.builtin.command:
|
|
argv: [docker, restart, "{{ unifi_container }}"]
|
|
when:
|
|
- unifi_sso_restart_controller | bool
|
|
- unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
|
|
changed_when: true
|
|
|
|
- name: Verify setting after change
|
|
ansible.builtin.command:
|
|
argv:
|
|
- docker
|
|
- exec
|
|
- "{{ unifi_container }}"
|
|
- mongo
|
|
- --port
|
|
- "{{ unifi_mongo_port }}"
|
|
- --quiet
|
|
- ace
|
|
- --eval
|
|
- 'db.setting({key:"super_sdn"}).sso_login_enabled'
|
|
register: unifi_sso_verify
|
|
changed_when: false
|
|
check_mode: false
|
|
when:
|
|
- unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
|
|
- not ansible_check_mode
|
|
|
|
- name: Assert verified value matches target
|
|
ansible.builtin.assert:
|
|
that:
|
|
- unifi_sso_verify.stdout | trim | lower == unifi_sso_target_value | string | lower
|
|
fail_msg: >-
|
|
Verification failed: sso_login_enabled is
|
|
{{ unifi_sso_verify.stdout | trim }} but expected
|
|
{{ unifi_sso_target_value | string | lower }}.
|
|
when:
|
|
- unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
|
|
- not ansible_check_mode |