linderhof/roles/mail/tasks/users.yml

# read-only docker exec always reports changed; changed_when: false suppresses spurious output
# failed_when: false — postfix-accounts.cf may not exist on first run (seeded separately)
- name: Check if mail user exists
  command: docker exec mailserver setup email list
  register: mail_user_list
  changed_when: false
  failed_when: false
  tags:
    - users

- name: Create mail users if missing
  ansible.builtin.command:
    argv:
      - docker
      - exec
      - mailserver
      - setup
      - email
      - add
      - "{{ item.address }}"
      - "{{ item.password }}"
  loop: "{{ mail_users }}"
  when: item.address not in mail_user_list.stdout
  no_log: true
  ignore_errors: yes
  tags:
    - users