Repository navigation
fix(ansible): write SLM_AUTH_TOKEN to autobot-backend.env — stops WS 403 storm (#7689) - #7707
Merged
Merged
Conversation
…ager role (#7689) Root cause: SLM_AUTH_TOKEN was never written to /etc/autobot/autobot-backend.env, causing SLMClient to connect with no Authorization header, triggering 4400+ WebSocket 403 errors/day from the 60s reconnect loop. Changes: - slm_manager/defaults: add slm_auth_token default (empty = auto-generate) - slm_manager/tasks: generate slm_auth_token on fresh install; idempotent lineinfile to add SLM_AUTH_TOKEN to existing slm-secrets.env on upgrade - slm_manager/templates/slm-secrets.env.j2: persist SLM_AUTH_TOKEN in the secrets file so it survives redeployments unchanged - backend/tasks: shell + set_fact to read SLM_AUTH_TOKEN from slm-secrets.env on the target host before the env template renders (fails-safe to empty string) - backend/templates/backend.env.j2: emit SLM_AUTH_TOKEN= line in SLM section - backend/defaults: document backend_slm_auth_tok default Co-Authored-By: Paperclip <noreply@paperclip.ing>
3 tasks
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No hardcoded values detected that have SSOT config equivalents! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the root cause of 4400+ WebSocket 403 errors/day (GH#7689 / MVA-312).
Root cause chain:
SLM_AUTH_TOKENunset in/etc/autobot/autobot-backend.env→SLMClient(auth_token=None)→ noAuthorizationheader on WS connection →SERVICE_AUTH_ENFORCEMENT_MODE=trueon SLM → HTTP 403 → 60s reconnect loop → 4400+ 403s/day.Changes:
slm_manager/defaults/main.yml— addslm_auth_token: ""(auto-generated when empty)slm_manager/tasks/main.yml— generateslm_auth_tokenon fresh installs; idempotentlineinfileto injectSLM_AUTH_TOKENinto existingslm-secrets.envon upgrade (handles already-deployed machines)slm_manager/templates/slm-secrets.env.j2— persistSLM_AUTH_TOKENso it survives redeploymentsbackend/tasks/main.yml—shell+set_factto read the token from/etc/autobot/slm-secrets.envon the target host before the env template renders; fails-safe to empty string if file absentbackend/templates/backend.env.j2— emitSLM_AUTH_TOKEN=line in the SLM connection sectionbackend/defaults/main.yml— documentbackend_slm_auth_tokdefaultTest plan
slm_managerrole generatesSLM_AUTH_TOKENand writes toslm-secrets.env;backendrole reads it and writes toautobot-backend.env;SLMClientconnects withAuthorization: Bearer <token>; WS 403 errors stopslm-secrets.env): lineinfile idempotently addsSLM_AUTH_TOKENonly when absent; subsequent backend deploy picks it upautobot-backend.envunchanged → no spurious restartCloses #7689
🤖 Generated with Claude Code