Jack Carter 0ae9f8c657 fix(roles): add no_log to uri tasks to prevent bearer token leak under -vvvv ...

The three ansible.builtin.uri tasks in the export and configure roles
interpolate the PAT directly into the Authorization header. Under -vvvv
(or any inspection of the registered result), Ansible prints the
rendered task args dict including those headers, leaking the bearer
token in cleartext.

The remaining API calls in both roles go through
community.ansible_netbird.netbird_info, which already masks the token.
The three bare uri tasks were the only leak surface in the roles.

Adding no_log: true suppresses the rendered task args and the
registered response. loop_control.label is exempt from no_log, so the
per-iteration "name" still prints for progress visibility.

Detected by a token-leak audit that decrypts the vault and greps for
the actual token values across smoke + invariant runs under -vvvv on
both self-hosted and Cloud environments. Before this change, the audit
flagged 2 occurrences per invariant run; after, 0.

Fixes 3 leak sites:
  - roles/export/tasks/main.yml: "Fetch routers for each network"
  - roles/export/tasks/main.yml: "Fetch resources for each network"
  - roles/configure/tasks/main.yml: "Fetch routers for each network (preview diff)"

2026-05-19 12:16:04 +02:00

..

configure

fix(roles): add no_log to uri tasks to prevent bearer token leak under -vvvv

2026-05-19 12:16:04 +02:00

export

fix(roles): add no_log to uri tasks to prevent bearer token leak under -vvvv

2026-05-19 12:16:04 +02:00