From c77b82d8353e556ef3ebb542ab9b4bf6613c5fc0 Mon Sep 17 00:00:00 2001
From: ml <krotik@devt.de>
Date: Sun, 28 Jun 2026 17:20:18 +0200
Subject: [PATCH] Fix Redis persistence crash-loop and provisioning
 dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Disable Redis RDB snapshots (--save "") — Redis is cache-only for
  Nextcloud; snapshot writes failed due to directory permissions and
  blocked all Redis writes, causing background jobs to crash-loop at
  400%+ CPU
- Add passlib as a required local dependency (needed for password_hash
  filter in Ansible templates)
- Make dl role SFTP setup conditional on dl_sftp_authorized_keys being
  set in the vault
- Fix check-vault.sh stdin conflict (pipe + heredoc) by passing vault
  content via environment variable
- Remove dl_sftp_authorized_keys from required_scalars (it is optional)
---
 ansible/roles/dl/tasks/main.yml                        |  2 ++
 ansible/roles/dl/templates/docker-compose.yml.j2       |  2 ++
 .../roles/nextcloud/templates/docker-compose.yml.j2    |  2 +-
 docs/runbook-provisioning.md                           |  1 +
 scripts/check-vault.sh                                 | 10 ++++++----
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/ansible/roles/dl/tasks/main.yml b/ansible/roles/dl/tasks/main.yml
index e5f1240..c6c063c 100644
--- a/ansible/roles/dl/tasks/main.yml
+++ b/ansible/roles/dl/tasks/main.yml
@@ -24,6 +24,7 @@
     owner: root
     group: root
     mode: "0644"
+  when: dl_sftp_authorized_keys | default('') | length > 0
   notify: Restart dl
   tags: dl
 
@@ -52,6 +53,7 @@
     rule: allow
     port: "{{ dl_sftp_port }}"
     proto: tcp
+  when: dl_sftp_authorized_keys | default('') | length > 0
   tags: dl
 
 - name: Start dl stack
diff --git a/ansible/roles/dl/templates/docker-compose.yml.j2 b/ansible/roles/dl/templates/docker-compose.yml.j2
index b84b98b..f38c363 100644
--- a/ansible/roles/dl/templates/docker-compose.yml.j2
+++ b/ansible/roles/dl/templates/docker-compose.yml.j2
@@ -17,6 +17,7 @@ services:
       - "traefik.http.services.dl.loadbalancer.server.port=80"
       - "traefik.http.routers.dl.middlewares=rate-limit@docker"
 
+{% if dl_sftp_authorized_keys | default('') | length > 0 %}
   dl-sftp:
     image: atmoz/sftp
     container_name: dl-sftp
@@ -28,6 +29,7 @@ services:
       - "{{ dl_sftp_port }}:22"
     # Empty password disables password auth — key auth only
     command: "{{ dl_upload_user }}::1001:1001:files"
+{% endif %}
 
 networks:
   traefik_public:
diff --git a/ansible/roles/nextcloud/templates/docker-compose.yml.j2 b/ansible/roles/nextcloud/templates/docker-compose.yml.j2
index b052d23..c70d828 100644
--- a/ansible/roles/nextcloud/templates/docker-compose.yml.j2
+++ b/ansible/roles/nextcloud/templates/docker-compose.yml.j2
@@ -22,7 +22,7 @@ services:
     image: redis:7-alpine
     container_name: nextcloud-redis
     restart: unless-stopped
-    command: --save 60 1 --loglevel warning
+    command: --save "" --loglevel warning
     volumes:
       - {{ nextcloud_data_dir }}/redis:/data
     networks:
diff --git a/docs/runbook-provisioning.md b/docs/runbook-provisioning.md
index 4f3520e..ff5c639 100644
--- a/docs/runbook-provisioning.md
+++ b/docs/runbook-provisioning.md
@@ -11,6 +11,7 @@ setup of individual services.
 ### Local tools
 
 - Ansible installed (`pip install ansible`)
+- `passlib` installed (`pip install passlib`) — required for bcrypt/SHA-512 password hashing in templates
 - `openssl` available (for generating secrets)
 
 ### SSH keys
diff --git a/scripts/check-vault.sh b/scripts/check-vault.sh
index 948d211..17fff83 100755
--- a/scripts/check-vault.sh
+++ b/scripts/check-vault.sh
@@ -24,10 +24,13 @@ fi
 echo "==> Decrypting vault (you will be prompted for the vault password)"
 VAULT_CONTENT=$(ansible-vault view "${VAULT_FILE}")
 
-echo "${VAULT_CONTENT}" | python3 - <<'PYEOF'
-import sys, yaml
+# Pass vault content via environment variable — avoids a pipe+heredoc stdin conflict
+# where python3 - consumes stdin for the script, leaving sys.stdin.read() empty.
+export VAULT_CONTENT
+python3 - <<'PYEOF'
+import os, sys, yaml
 
-data = yaml.safe_load(sys.stdin.read())
+data = yaml.safe_load(os.environ['VAULT_CONTENT'])
 
 # Required non-empty scalar strings
 required_scalars = [
@@ -41,7 +44,6 @@ required_scalars = [
     "roundcube_db_password",
     "roundcube_des_key",
     "vaultwarden_admin_token",
-    "dl_sftp_authorized_keys",
 ]
 
 # Required non-empty lists (must contain at least one entry)