updated multica deployment

ansible/roles/multica_docker/tasks/multica.yml

@@ -61,6 +61,16 @@
     label: "{{ item.key }}"
   no_log: "{{ multica_no_log }}"
 
+# .env.example ships a DATABASE_URL with the default password embedded. POSTGRES_PASSWORD alone does not
+# change it, so keep the URL's password in step (no-op if the line is absent or already matches).
+- name: Sync password inside DATABASE_URL
+  ansible.builtin.replace:
+    path: "{{ multica_install_dir }}/.env"
+    regexp: '^(DATABASE_URL=[a-z]+://[^:/@]+:)[^@]*(@.*)$'
+    replace: '\g<1>{{ multica_postgres_password }}\g<2>'
+    mode: "0600"
+  no_log: "{{ multica_no_log }}"
+
 # Compose re-reads .env and recreates containers whose config changed (equivalent of `up -d`).
 - name: Start / update Multica stack
   community.docker.docker_compose_v2:
@@ -73,6 +83,55 @@
     recreate: auto
   register: _multica_up
 
+# Postgres only reads POSTGRES_PASSWORD when the data volume is first initialised. If the volume pre-dates this
+# run (or the vault value changed), the DB user keeps the old password and the backend can't log in.
+# Test over TCP (the local socket is trust-auth and proves nothing) and repair via the socket if needed.
+- name: Wait for Postgres to accept connections
+  ansible.builtin.command:
+    argv: ["docker", "compose", "-p", "{{ multica_compose_project }}", "-f", "{{ _multica_compose_file }}",
+           "exec", "-T", "postgres", "pg_isready", "-U", "{{ multica_postgres_user }}", "-d", "{{ multica_postgres_db }}"]
+    chdir: "{{ multica_install_dir }}"
+  register: _multica_pg_ready
+  until: _multica_pg_ready.rc == 0
+  retries: 24
+  delay: 5
+  changed_when: false
+
+- name: Test database login with the configured password (over TCP)
+  ansible.builtin.command:
+    argv: ["docker", "compose", "-p", "{{ multica_compose_project }}", "-f", "{{ _multica_compose_file }}",
+           "exec", "-T", "-e", "PGPASSWORD", "postgres", "sh", "-c",
+           "psql -h \"$(hostname -i | cut -d' ' -f1)\" -U {{ multica_postgres_user }} -d {{ multica_postgres_db }} -tAc 'select 1'"]
+    chdir: "{{ multica_install_dir }}"
+  environment:
+    PGPASSWORD: "{{ multica_postgres_password }}"
+  register: _multica_pg_auth
+  changed_when: false
+  failed_when:
+    - _multica_pg_auth.rc != 0
+    - "'password authentication failed' not in _multica_pg_auth.stderr"
+  no_log: "{{ multica_no_log }}"
+
+- name: Reset database user password to match .env
+  when: _multica_pg_auth.rc != 0
+  block:
+    - name: ALTER USER via local socket (password passed on stdin)
+      ansible.builtin.command:
+        argv: ["docker", "compose", "-p", "{{ multica_compose_project }}", "-f", "{{ _multica_compose_file }}",
+               "exec", "-T", "postgres", "psql", "-v", "ON_ERROR_STOP=1",
+               "-U", "{{ multica_postgres_user }}", "-d", "{{ multica_postgres_db }}"]
+        chdir: "{{ multica_install_dir }}"
+        stdin: "ALTER USER {{ multica_postgres_user }} PASSWORD '{{ multica_postgres_password }}';"
+      changed_when: true
+      no_log: "{{ multica_no_log }}"
+
+    - name: Restart backend so it reconnects
+      ansible.builtin.command:
+        argv: ["docker", "compose", "-p", "{{ multica_compose_project }}", "-f", "{{ _multica_compose_file }}",
+               "restart", "backend"]
+        chdir: "{{ multica_install_dir }}"
+      changed_when: true
+
 - name: Wait for backend /readyz (db + migrations ok)
   ansible.builtin.uri:
     url: "http://127.0.0.1:{{ _multica_backend_port }}/readyz"