Fix SRAM conditional container restart

roles/sram_ldap/handlers/main.yml

@@ -4,3 +4,4 @@
     name: "sram-ldap"
     restart: true
     state: started
+  when: ldap_container is success and ldap_container is not change

roles/sram_ldap/tasks/main.yml

@@ -53,18 +53,12 @@
       combine({ host.key | format(item.key): host.value | format(item.value) }) }}
   with_dict: "{{ sram_ldap_hosts }}"
 
-- name: "Pull ldap image"
-  community.docker.docker_image_pull:
-    name: "{{ sram_ldap_image }}"
-  register: "ldap_image"
-
 - name: Create the ldap container
   community.docker.docker_container:
     name: "sram-ldap"
     image: "{{ sram_ldap_image }}"
     restart_policy: "always"
     state: started
-    restart: "{{ ldap_image is changed }}"
     pull: never
     ports:
       - 0.0.0.0:389:389
@@ -89,7 +83,7 @@
         - "bash"
         - "-c"
         - "[[ -S /var/run/slapd/ldapi ]]"
-  register: "ldap_container"
+  register: ldap_container
 
 - name: Wait for LDAP initialization
   ansible.builtin.wait_for:

roles/sram_midproxy/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart the satosa container
+  community.docker.docker_container:
+    name: sram-satosa
+    restart: true
+    state: started
+  when: satosa_container is success and satosa_container is not change

roles/sram_midproxy/tasks/main.yml

@@ -38,6 +38,7 @@
     group: "{{ sram_midproxy_group }}"
     # mkdir: cannot create directory '.': Permission denied
     mode: "0644"
+  notify: Restart the satosa container
 
 - name: Copy SATOSA conf files
   ansible.builtin.copy:
@@ -49,20 +50,16 @@
     - internal_attributes.yaml
     - proxy_conf.yaml
     - plugins/
-
-- name: "Pull satosa image"
-  community.docker.docker_image_pull:
-    name: "{{ sram_midproxy_satosa_image }}"
-  register: "satosa_image"
+  notify: Restart the satosa container
 
 - name: Create the SATOSA container
   community.docker.docker_container:
     name: sram-midproxy
     image: "{{ sram_midproxy_satosa_image }}"
-    pull: never
+    pull: true
     restart_policy: "always"
     state: started
-    restart: "{{ satosa_image is changed }}"
+    # restart: "{{ satosa_image is changed }}"
     # 2026-05-21 07:25:44 +0000] [1] [ERROR] Control server error: [Errno 13] Permission denied: '/.gunicorn'
     # user: "{{ midproxy_user_uid }}"
     networks:
@@ -88,3 +85,4 @@
     #   timeout: 10s
     #   retries: 3
     #   start_period: 10s
+  register: satosa_container

roles/sram_plsc/handlers/main.yml

@@ -4,3 +4,4 @@
     name: sram-plsc
     restart: true
     state: started
+  when: plsc_container is success and plsc_container is not change

roles/sram_plsc/tasks/main.yml

@@ -13,23 +13,18 @@
   no_log: "{{ sram_plsc_ansible_nolog }}"
   notify: "Restart the plsc container"
 
-- name: "Pull plsc image"
-  community.docker.docker_image_pull:
-    name: "{{ sram_plsc_image }}"
-  register: "plsc_image"
-
 - name: Create the plsc container
   community.docker.docker_container:
     name: "sram-plsc"
     image: "{{ sram_plsc_image }}"
     restart_policy: "always"
-    state: started
-    restart: "{{ plsc_image is changed }}"
-    pull: never
+    state: "started"
+    pull: true
     mounts:
       - type: bind
         source: "{{ sram_plsc_conf_dir }}/plsc.yml"
         target: "/opt/plsc/plsc.yml"
     networks:
       # TODO: Should this not be parametrized?
       - name: "loadbalancer"
+  register: "plsc_container"

roles/sram_redis/handlers/main.yml

@@ -4,3 +4,4 @@
     name: sram-redis
     state: started
     restart: true
+  when: redis_container is success and redis_container is not change

roles/sram_redis/tasks/main.yml

@@ -45,18 +45,13 @@
     mode: "0644"
   notify: "Restart redis container"
 
-- name: "Pull redis image"
-  community.docker.docker_image_pull:
-    name: "{{ sram_redis_image }}"
-  register: "redis_image"
-
 - name: "Create redis container"
   community.docker.docker_container:
     name: "sram-redis"
     image: "{{ sram_redis_image }}"
+    pull: true
     restart_policy: "always"
     state: "started"
-    restart: "{{ redis_image is changed }}"
     user: "{{ redis_user_uid }}:{{ redis_group_gid }}"
     command: |
       redis-server /usr/local/etc/redis/redis.conf
@@ -66,3 +61,4 @@
     networks:
       # TODO: Should this not be parametrized?
       - name: loadbalancer
+  register: redis_container

roles/sram_sbs/handlers/main.yml

@@ -7,3 +7,4 @@
   loop:
     - sram-sbs-client
     - sram-sbs-server
+  when: sbs_container is success and sbs_container is not change

roles/sram_sbs/tasks/main.yml

@@ -66,24 +66,16 @@
   no_log: "{{ sram_sbs_ansible_nolog }}"
   notify: "Restart sbs containers"
 
-- name: "Pull sbs image"
-  community.docker.docker_image_pull:
-    name: "{{ item }}"
-  with_items:
-    - "{{ sram_sbs_client_image }}"
-    - "{{ sram_sbs_server_image }}"
-  register: "sbs_images"
-
 - name: "Migration"
   # For some reason --check breaks this block
-  when: "sbs_images is changed and not ansible_check_mode"
+  when: "not ansible_check_mode"
   block:
     - name: "Run SBS migrations"
       throttle: 1
       community.docker.docker_container:
         name: "sram-sbs-migration"
         image: "{{ sram_sbs_server_image }}"
-        pull: "never"
+        pull: true
         state: "started"
         restart_policy: "no"
         detach: false
@@ -99,7 +91,7 @@
         networks:
           # TODO: Should we parametrize this?
           - name: "loadbalancer"
-      register: "result"
+      register: "sbs_container"
       failed_when: "'container' not in result or result.container.State.ExitCode != 0"
       changed_when: "'[alembic.runtime.migration] Running upgrade' in result.container.Output | default('')"
       notify: "Restart sbs containers"
@@ -115,10 +107,9 @@
   community.docker.docker_container:
     name: "sram-sbs-client"
     image: "{{ sram_sbs_client_image }}"
-    pull: "never"
+    pull: true
     restart_policy: "always"
     state: "started"
-    restart: "{{ sbs_images is changed}}"
     volumes:
       - "{{ sram_sbs_conf_dir }}/sbs-apache.conf:/etc/apache2/sites-enabled/sbs.conf:ro"
       - "{{ sram_sbs_conf_dir }}/disclaimer.css:/opt/sbs/client/dist/disclaimer.css:ro"
@@ -128,14 +119,14 @@
       traefik.http.routers.sbsclient.rule: "Host(`{{ sram_sbs_base_domain }}`)"
       traefik.http.routers.sbsclient.tls: "true"
       traefik.enable: "true"
+  notify: "Restart sbs containers"
 
 - name: "Start SBS server container"
   community.docker.docker_container:
     name: "sram-sbs-server"
     image: "{{ sram_sbs_server_image }}"
     restart_policy: "always"
     state: "started"
-    restart: "{{ sbs_images is changed}}"
     env:
       RUNAS_UID: "{{ sbs_user_uid | string }}"
       RUNAS_GID: "{{ sbs_group_gid | string }}"
@@ -151,3 +142,4 @@
       - name: "loadbalancer"
     etc_hosts:
       host.docker.internal: host-gateway
+  notify: "Restart sbs containers"