From b7196c3fc6c58a0a5c8734bd49ccc4c2b5b564d9 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Tue, 21 Apr 2026 01:41:43 +0000
Subject: [PATCH] Run op CLI on controller and silence secret output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The target host does not have the op CLI installed, so op invocations
must run on the Semaphore controller (delegate_to: localhost, become:
false — the controller runs rootless). Generated/loaded secrets also
leak into task logs on failure, so mark the three op tasks and the
set_fact tasks with no_log: true.
---
 playbooks/n8n.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/playbooks/n8n.yml b/playbooks/n8n.yml
index 950c613..59ac55d 100644
--- a/playbooks/n8n.yml
+++ b/playbooks/n8n.yml
@@ -25,6 +25,9 @@
       failed_when: false
       changed_when: false
       check_mode: no
+      delegate_to: localhost
+      become: false
+      no_log: true
       environment:
         OP_SERVICE_ACCOUNT_TOKEN: "{{ lookup('env','OP_SERVICE_ACCOUNT_TOKEN') }}"
 
@@ -35,11 +38,15 @@
         op item get "{{ stack_name }}" --vault="Automation" --format json
       register: op_item
       check_mode: no
+      delegate_to: localhost
+      become: false
+      no_log: true
       environment:
         OP_SERVICE_ACCOUNT_TOKEN: "{{ lookup('env','OP_SERVICE_ACCOUNT_TOKEN') }}"
 
     - name: Set secrets from 1Password
       when: op_check.rc == 0
+      no_log: true
       set_fact:
         n8n_postgres_password: "{{ (op_item.stdout | from_json).fields | selectattr('label','equalto','postgres_password') | map(attribute='value') | first }}"
         n8n_encryption_key: "{{ (op_item.stdout | from_json).fields | selectattr('label','equalto','encryption_key') | map(attribute='value') | first }}"
@@ -47,17 +54,22 @@
     # 🔑 Generate if new
     - name: Generate postgres password
       when: op_check.rc != 0
+      no_log: true
       set_fact:
         n8n_postgres_password: "{{ lookup('password','/dev/null length=32 chars=ascii_letters') }}"
 
     - name: Generate encryption key
       when: op_check.rc != 0
+      no_log: true
       set_fact:
         n8n_encryption_key: "{{ lookup('password','/dev/null length=64 chars=hexdigits') }}"
 
     # 📦 Store in 1Password
     - name: Create 1Password item
       when: op_check.rc != 0
+      delegate_to: localhost
+      become: false
+      no_log: true
       shell: |
         op item create \
           --category="Server" \