From fe2fa6eacae1bde0fd6ab81fbe7938999d85b24d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 27 Aug 2026 16:54:26 +0300 Subject: [PATCH] Don't reset Hookshot's crypto store on a run that selects no tags `tasks/main.yml` opens with a block tagged `reset-hookshot-encryption`, and Ansible runs tagged tasks unless tags are actually selected. A run that selects no tags therefore reaches `tasks/reset_encryption.yml`: on a host where the service does not exist yet it fails outright, and on one where it does it stops the bridge and resets its crypto store without being asked to. Users of the playbook are shielded from this only because the documented way to run it always passes `--tags=setup-all,start`. Adding `never` makes the block reachable only when its tag is explicitly selected, which is what `--tags=reset-hookshot-encryption` in docs/configuring-playbook-bridge-hookshot.md already does - that keeps working unchanged, as selecting a tag by name overrides `never`. The Molecule scenario no longer needs its `skip-tags` workaround, which is what makes this verifiable: the scenario runs with no tags selected, and is green with the workaround gone. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT --- .../molecule/default/molecule.yml | 11 ----------- roles/custom/matrix-bridge-hookshot/tasks/main.yml | 6 ++++++ 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml b/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml index de61f61d0..6e027fefc 100644 --- a/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml +++ b/roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml @@ -24,17 +24,6 @@ provisioner: config_options: defaults: callback_result_format: yaml - options: - # The role's `tasks/main.yml` opens with a block tagged - # `reset-hookshot-encryption`, and Ansible runs tagged tasks unless tags are - # actually selected - so a tagless play (which is what Molecule runs) hits - # it. It stops `matrix-hookshot.service` before that service exists, which - # fails on a fresh host. Skipping the tag is what the playbook effectively - # does by always running with `--tags=setup-all,start`. - # - # `molecule-notest,notest` are Molecule's own defaults, repeated here - # because this key replaces them rather than adding to them. - skip-tags: molecule-notest,notest,reset-hookshot-encryption inventory: group_vars: all: diff --git a/roles/custom/matrix-bridge-hookshot/tasks/main.yml b/roles/custom/matrix-bridge-hookshot/tasks/main.yml index 34ddee40b..c6b09ff60 100644 --- a/roles/custom/matrix-bridge-hookshot/tasks/main.yml +++ b/roles/custom/matrix-bridge-hookshot/tasks/main.yml @@ -7,6 +7,12 @@ --- - tags: + # Resetting the crypto store is destructive and is only ever meant to happen + # when explicitly asked for. Without `never`, a playbook run that does not + # select tags at all runs this block along with everything else - which fails + # on a host where the service does not exist yet, and silently resets the + # crypto store on one where it does. + - never - reset-hookshot-encryption block: - when: matrix_bridge_hookshot_enabled | bool