From 1b3f3e62b9294253045ce477df3e538b255d91f5 Mon Sep 17 00:00:00 2001
From: jack <jack@csrx.ru>
Date: Sun, 22 Mar 2026 21:45:17 +0700
Subject: [PATCH] fix(snappymail): correct admin password setup and network
 config

- Replace broken PHP require path with docker restart to let entrypoint
  apply SNAPPYMAIL_ADMIN_PASSWORD env var (path /var/www/snappymail/index.php
  does not exist in djmaze/snappymail image)
- Move snappymail from webmail-internal to mail-internal so it can reach
  mailserver for IMAP/SMTP connections
- Remove unused webmail-internal network

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 roles/tools/tasks/main.yml                  | 26 +++++----------------
 roles/tools/templates/docker-compose.yml.j2 |  7 ++----
 2 files changed, 8 insertions(+), 25 deletions(-)

diff --git a/roles/tools/tasks/main.yml b/roles/tools/tasks/main.yml
index 1ea5bc1..056b23a 100644
--- a/roles/tools/tasks/main.yml
+++ b/roles/tools/tasks/main.yml
@@ -147,26 +147,12 @@
     state: present
     pull: missing
 
-# ── SnappyMail admin password (set explicitly — env var may not apply on restart) ──
-- name: Wait for SnappyMail to be ready
-  ansible.builtin.command: docker exec snappymail wget -qO- http://127.0.0.1:8888
-  register: snappymail_ready
-  changed_when: false
-  retries: 12
-  delay: 5
-  until: snappymail_ready.rc == 0
-
-- name: Set SnappyMail admin password via PHP
-  ansible.builtin.shell: |
-    docker exec snappymail php -r "
-    require '/var/www/snappymail/index.php';
-    \$oConfig = \RainLoop\Api::Config();
-    \$oConfig->Set('security', 'admin_password', \RainLoop\Utils::PasswordHash('{{ snappymail_admin_password }}'));
-    \$oConfig->Save();
-    echo 'password set';
-    "
-  register: snappymail_pw
-  changed_when: "'password set' in snappymail_pw.stdout"
+# ── SnappyMail: force restart so entrypoint applies SNAPPYMAIL_ADMIN_PASSWORD ──
+# The env var is processed by the container entrypoint on every start.
+# Explicit restart ensures the password is always written to config correctly.
+- name: Restart SnappyMail to apply admin password from env
+  ansible.builtin.command: docker restart snappymail
+  changed_when: true
 
 # ── Mail accounts (idempotent: check host-side config file) ──────────────────
 - name: Wait for mailserver to be ready
diff --git a/roles/tools/templates/docker-compose.yml.j2 b/roles/tools/templates/docker-compose.yml.j2
index e4b1670..0be2560 100644
--- a/roles/tools/templates/docker-compose.yml.j2
+++ b/roles/tools/templates/docker-compose.yml.j2
@@ -15,9 +15,6 @@ networks:
   mail-internal:
     driver: bridge
     internal: true
-  webmail-internal:
-    driver: bridge
-    internal: true
 
 volumes:
   outline_db_data:
@@ -180,8 +177,8 @@ services:
     container_name: snappymail
     restart: unless-stopped
     networks:
-      - webmail-internal
-      - front
+      - mail-internal   # reach mailserver for IMAP/SMTP
+      - front           # expose port 8888 to host
     ports:
       - "{{ ip_tools }}:8888:8888"
     volumes: