From 4340b894aa1c27adc13bfacb5ab4705b11d182c6 Mon Sep 17 00:00:00 2001
From: Wojciech Kozlowski <wk@wojciechkozlowski.eu>
Date: Thu, 17 Aug 2023 21:46:38 +0200
Subject: [PATCH] Fix database deploy idempotency

---
 .../services/deploy/database/tasks/main.yml   | 26 ++++++++++++++-----
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/playbooks/roles/services/deploy/database/tasks/main.yml b/playbooks/roles/services/deploy/database/tasks/main.yml
index 8b2137d..65c9117 100644
--- a/playbooks/roles/services/deploy/database/tasks/main.yml
+++ b/playbooks/roles/services/deploy/database/tasks/main.yml
@@ -4,6 +4,25 @@
     name: "services/include"
     vars_from: "user"
 
+- name: "stat the pgadmin password file"
+  ansible.builtin.stat:
+    path: "{{ services_service_user_home }}/.config/service/pgadmin.password"
+  register: services_deploy_database_pgadmin_password_file_stat
+
+- name: "configure pgadmin password"
+  ansible.builtin.template:
+    src: "./pgadmin/pgadmin.password"
+    dest: "{{ services_service_user_home }}/.config/service/pgadmin.password"
+    mode: 0600
+  # Being root allows ansible to read the file, determine the diff, and preserve the uid:gid.
+  become_user: "\
+    {% if services_deploy_database_pgadmin_password_file_stat.stat.exists %}\
+    root\
+    {% else %}\
+    {{ services_service_user_name }}\
+    {% endif %}"
+  register: services_deploy_database_pgadmin_password_file
+
 - block:
 
     - name: "configure postgres password"
@@ -13,13 +32,6 @@
         mode: 0600
       register: services_deploy_database_postgres_password_file
 
-    - name: "configure pgadmin password"
-      ansible.builtin.template:
-        src: "./pgadmin/pgadmin.password"
-        dest: "{{ services_service_user_home }}/.config/service/pgadmin.password"
-        mode: 0600
-      register: services_deploy_database_pgadmin_password_file
-
     - name: "configure systemd service"
       ansible.builtin.template:
         src: "./systemd/{{ item }}"