Containers are created with `--rm`, so Docker removes them asynchronously after they stop.
The pre-start `docker rm` returns immediately while that removal is still in progress
(its error is suppressed), and the following `docker create --name` can fail with
"The container name ... is already in use".
This is easy to hit since systemd_service_manager switched its default restart mode to `all-at-once`:
many containers stop and start at the same time and Docker falls behind on removals.
The playbook then fails at "Restart systemd services needing restart at once",
even though the services recover on their own (`Restart=always`) a little later.
The external roles (MASH, devture) were hardened against this in 2026-03
(see mother-of-all-self-hosting/ansible-role-valkey@0ba79c0), but the roles in `roles/custom` never were.
This ports the same bounded cleanup loop to them: stop, force-remove,
and wait until Docker releases the name, failing explicitly after a timeout.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The role replaced the `jitsi_web_framing_ancestors*` variables with `jitsi_web_http_header_content_security_policy_frame_ancestors*`.
Embedding is still allowed from anywhere, now via `jitsi_web_http_header_content_security_policy_frame_ancestors_enabled: false`.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The role replaced `jitsi_web_framing_enabled` with `jitsi_web_framing_ancestors`.
Embedding is still allowed from anywhere, now via `jitsi_web_framing_ancestors_default: ['*']`.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* set inventory from $ANSIBLE_INVENTORY if set, otherwise set the default
* Use env() instead of the deprecated env_var_or_default() in justfile
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Adds ansible-role-cleanup from the MASH project. It can remove superseded
Docker images and stopped containers on every playbook run (unlike
`docker image prune -a`, keeping the images of stopped services), vacuum
old logs, remove paths and, on Debian-based distributions, upgrade
packages and purge old kernels. Everything is off by default.
The role runs after systemd_service_manager, once every service is
running, so the Docker cleanup can tell which images are still needed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
