kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(nextcloud): give peertube a clearnet variant

Browse Source 
Variant 7 pinned sso, tor and peertube together, and since 8ffb1f567 those three
cannot coexist. test_sso_variant_requires_tor forbids sso: true without
tor: true, so tor cannot give way. With tor on, keycloak is published onion-only
- auth.infinito.example does not appear once in the job log - and
align_domain_to_consumer falls through to `return primary_domain` because there
is no clearnet sibling to align to. PeerTube therefore receives
http://auth.<onion>/realms/.../.well-known/openid-configuration, oauth4webapi
rejects it on scheme before any request leaves ("only requests to HTTPS are
allowed", OAUTH_HTTP_REQUEST_FORBIDDEN), the plugin registers without building a
client, and the gate at oidc/enable.yml:105 fails the deploy. Both deploy modes
reproduced it, with different onions, which rules out routing: the SSO
back-channel pin from container_extra_hosts is emitted for peertube and fixes
where a name points, not which scheme a library will accept.

peertube is the only one of the three that can move, so it moves to a variant of
its own with tor off. sso follows tor off, which costs nothing here: the addon
gate is services.peertube.enabled alone and the spec signs in with a direct
password, not through Keycloak. PeerTube keeps its OIDC coverage in its own
variant 0, which is sso-on and clearnet - the topology where the plugin works.

The slot is paid for by folding xwiki into variant 7 rather than adding a tenth
variant. This does not undo f1dff50fb: that commit moved xwiki out of variant 0
because job 94319317296 was cancelled at exactly the 355-minute ceiling, and
variant 0 is untouched here. Nor does it grow a round - variant 7 carried two
partners before (discourse + peertube) and carries two now (discourse + xwiki),
while variant 3 already carries three. Measured: the merged variant 7 resolves to
20.26GB reservation / 48.01GB limit against caps of 32/64, the lightest
non-baseline variant in the file, and the two-partner variant 7 of run
31823845576 spent 101.4 minutes against a 355-minute box.

mariadb and redis stay shared: true in the new variant because
variants-shared-false-once allows exactly one shared: false pin each and variant
1 already holds both.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kevinveenbirkenbachandClaude Opus 5 committed 2026-08-15 06:09:01 +02:00
1 parent 040955ebf2
commit 65538c40da
1 file changed
+94 -93
Download Patch File Download Diff File Expand all files Collapse all files
roles/web-app-nextcloud/meta/variants.yml
+94 -93
View File
@@ -2,7 +2,7 @@
# Matrix-deploy variant overrides for web-app-nextcloud.
# See docs/contributing/artefact/files/role/variants.md for the file format.
#
# nocheck: comments-valid: eight variants of ~90 near-identical service lines are
# nocheck: comments-valid: nine variants of ~90 near-identical service lines are
# unreadable without a heading naming what each one adds.
#
# nocheck: variant-limit: the loosely-coupled (bond<1) bridge partners are too heavy
@@ -678,96 +678,7 @@
tor:
enabled: true
addons: *addons_static_off
# Variant 7: discourse + peertube
- services:
container_backup:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
sso:
enabled: true
shared: true
coturn:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
logout:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
ldap:
enabled: true
shared: true
dashboard:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
matomo:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
email:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
mariadb:
shared: true
redis:
shared: true
talk:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
talk_recording:
enabled: false
onlyoffice:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
collabora:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
bigbluebutton:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
xwiki:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
seaweedfs:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
css:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
prometheus:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
openproject:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
gitlab:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
discourse:
enabled: true
shared: true
mattermost:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
matrix:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
zammad:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
openwebui:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
flowise:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
mastodon:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
peertube:
enabled: true
shared: true
tor:
enabled: true
addons: *addons_static_off
# Variant 8: xwiki
# Variant 7: discourse + xwiki
- services:
container_backup:
enabled: false
@@ -830,8 +741,8 @@
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
discourse:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
enabled: true
shared: true
mattermost:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -856,3 +767,93 @@
tor:
enabled: true
addons: *addons_static_off
# Variant 8: peertube - clearnet, because the OIDC plugin rejects a plaintext onion issuer
- services:
container_backup:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
sso:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
coturn:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
logout:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
ldap:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
dashboard:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
matomo:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
email:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
mariadb:
shared: true
redis:
shared: true
talk:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
talk_recording:
enabled: false
onlyoffice:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
collabora:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
bigbluebutton:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
xwiki:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
seaweedfs:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
css:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
prometheus:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
openproject:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
gitlab:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
discourse:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
mattermost:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
matrix:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
zammad:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
openwebui:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
flowise:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
mastodon:
enabled: false
shared: false # nocheck: variants-static-override backup shared stays literally true
peertube:
enabled: true
shared: true
tor:
enabled: false
shared: false # nocheck: variants-static-override
addons: *addons_static_off