fix(roles/graylog_server): enforce a key marked as mandatory in the role readme

Author: bhatti-lf

CHANGELOG.md

@@ -65,6 +65,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **role:graylog_server**: Validate that each `graylog_server__system_inputs` entry sets `global: true` or assigns a `node`. Key was marked as mandatory but not enforced. The role now aborts the `graylog_server:configure_defaults` run with a clear message.
 * **role:graylog_server**: Fix the `graylog_server:configure_defaults` run aborting on Graylog 7.0+ with `Status code was 400 and not [200]` / `Unable to map property can_be_default` while creating the default index set, by removing the property from the role. Graylog 7.x dropped it and 6.x ignored it.
 * **role:keycloak**: Fix ownership under `/opt/keycloak/data/`. Previously the post-install build step ran as `root` and left `/opt/keycloak/data/` and `/opt/keycloak/data/tmp/` owned by `root:root`, which the `keycloak` service user could not write into (no `data/cache/` was ever created). The build now runs as the `keycloak` service user, and existing installations get the ownership corrected on the next role run.
 * **role:nodejs**: Fix `@nodejs:<stream>` install failing with `broken groups or modules: nodejs:<stream>`. Two issues compounded: DNF refuses to silently switch an already-enabled module stream, and some modules ship without a `[d]efault` profile, so `@nodejs:<stream>` (no profile specified) cannot be resolved. The role now runs `dnf -y module reset nodejs` first when `nodejs__dnf_module_stream` is set, and installs the explicit `/common` profile.

roles/graylog_server/tasks/main.yml

@@ -116,6 +116,16 @@
 
 - block:
 
+  - name: 'Validate that each graylog_server__system_inputs entry is global or assigned to a node'
+    ansible.builtin.assert:
+      that:
+        - '(item["global"] | default(false) | bool) or (item["node"] | default("") | length > 0)'
+      fail_msg: 'Each graylog_server__system_inputs entry must set "global: true" or assign a "node", otherwise Graylog creates the input but never starts it'
+      quiet: true
+    loop: '{{ graylog_server__system_inputs }}'
+    loop_control:
+      label: '{{ item["title"] | default(item["type"]) }}'
+
   - name: 'Get all inputs'
     ansible.builtin.uri:
       url: 'http://{{ graylog_server__http_bind_address }}:{{ graylog_server__http_bind_port }}/api/system/inputs'