From 1c16183bf58f290fd72a496f46ed0b82bd463a40 Mon Sep 17 00:00:00 2001
From: jack <jack@csrx.ru>
Date: Sun, 22 Mar 2026 20:49:35 +0700
Subject: [PATCH] fix(snappymail): set admin password explicitly via PHP after
 container start
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SNAPPYMAIL_ADMIN_PASSWORD env var may not apply if the container
started when data dir had wrong permissions. Now sets password directly
via RainLoop PHP API after every deploy — idempotent and reliable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 roles/tools/tasks/main.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/roles/tools/tasks/main.yml b/roles/tools/tasks/main.yml
index efa8c19..1ea5bc1 100644
--- a/roles/tools/tasks/main.yml
+++ b/roles/tools/tasks/main.yml
@@ -147,6 +147,27 @@
     state: present
     pull: missing
 
+# ── SnappyMail admin password (set explicitly — env var may not apply on restart) ──
+- name: Wait for SnappyMail to be ready
+  ansible.builtin.command: docker exec snappymail wget -qO- http://127.0.0.1:8888
+  register: snappymail_ready
+  changed_when: false
+  retries: 12
+  delay: 5
+  until: snappymail_ready.rc == 0
+
+- name: Set SnappyMail admin password via PHP
+  ansible.builtin.shell: |
+    docker exec snappymail php -r "
+    require '/var/www/snappymail/index.php';
+    \$oConfig = \RainLoop\Api::Config();
+    \$oConfig->Set('security', 'admin_password', \RainLoop\Utils::PasswordHash('{{ snappymail_admin_password }}'));
+    \$oConfig->Save();
+    echo 'password set';
+    "
+  register: snappymail_pw
+  changed_when: "'password set' in snappymail_pw.stdout"
+
 # ── Mail accounts (idempotent: check host-side config file) ──────────────────
 - name: Wait for mailserver to be ready
   ansible.builtin.command: docker exec mailserver postfix status