Restructured server config

filter_plugins/alias_domains_map.py

@@ -39,7 +39,7 @@ class FilterModule(object):
         # 1) Precompute canonical domains per app (fallback to default)
         canonical_map = {}
         for app_id, cfg in apps.items():
-            domains_cfg = cfg.get('domains') or {}
+            domains_cfg = cfg.get('server',{}).get('domains',{})
             entry = domains_cfg.get('canonical')
             if entry is None:
                 canonical_map[app_id] = [default_domain(app_id, primary_domain)]
@@ -49,13 +49,13 @@ class FilterModule(object):
                 canonical_map[app_id] = list(entry)
             else:
                 raise AnsibleFilterError(
-                    f"Unexpected type for 'domains.canonical' in application '{app_id}': {type(entry).__name__}"
+                    f"Unexpected type for 'server.domains.canonical' in application '{app_id}': {type(entry).__name__}"
                 )
 
         # 2) Build alias list per app
         result = {}
         for app_id, cfg in apps.items():
-            domains_cfg = cfg.get('domains')
+            domains_cfg = cfg.get('server',{}).get('domains')
 
             # no domains key → no aliases
             if domains_cfg is None:

filter_plugins/canonical_domains_map.py

@@ -28,7 +28,7 @@ class FilterModule(object):
                     f"expected a dict, got {cfg!r}"
                 )
                 
-                domains_cfg = cfg.get('domains')
+                domains_cfg = cfg.get('server',{}).get('domains',{})
                 if not domains_cfg or 'canonical' not in domains_cfg:
                     self._add_default_domain(app_id, primary_domain, seen_domains, result)
                     continue
@@ -64,7 +64,7 @@ class FilterModule(object):
             self._process_canonical_domains_list(app_id, canonical_domains, seen_domains, result)
         else:
             raise AnsibleFilterError(
-                f"Unexpected type for 'domains.canonical' in application '{app_id}': "
+                f"Unexpected type for 'server.domains.canonical' in application '{app_id}': "
                 f"{type(canonical_domains).__name__}"
             )
 

filter_plugins/domain_redirect_mappings.py

@@ -36,7 +36,7 @@ class FilterModule(object):
         # 1) Compute canonical domains per app (always as a list)
         canonical_map = {}
         for app_id, cfg in apps.items():
-            domains_cfg = cfg.get('domains') or {}
+            domains_cfg = cfg.get('server',{}).get('domains',{})
             entry = domains_cfg.get('canonical')
             if entry is None:
                 canonical_map[app_id] = [default_domain(app_id, primary_domain)]
@@ -46,13 +46,13 @@ class FilterModule(object):
                 canonical_map[app_id] = list(entry)
             else:
                 raise AnsibleFilterError(
-                    f"Unexpected type for 'domains.canonical' in application '{app_id}': {type(entry).__name__}"
+                    f"Unexpected type for 'server.domains.canonical' in application '{app_id}': {type(entry).__name__}"
                 )
 
         # 2) Compute alias domains per app
         alias_map = {}
         for app_id, cfg in apps.items():
-            domains_cfg = cfg.get('domains')
+            domains_cfg = cfg.get('server',{}).get('domains',{})
             if domains_cfg is None:
                 alias_map[app_id] = []
                 continue

roles/web-app-akaunting/config/main.yml

@@ -8,7 +8,8 @@ features:
   port-ui-desktop:  true
   central_database: true
   logout:           true 
-domains:
+server:
+  domains:
     canonical:
       - "accounting.{{ primary_domain }}"
 docker:

roles/web-app-attendize/config/main.yml

@@ -13,6 +13,7 @@ docker:
       enabled: true
     database: 
       enabled: true
-domains:
+server:
+  domains:
     canonical:
       - "tickets.{{ primary_domain }}"

roles/web-app-baserow/config/main.yml

@@ -18,7 +18,7 @@ docker:
       name:               "baserow"
     volumes:
       data:               "baserow_data"
-
+server:
-domains:
+  domains:
     canonical:
       - baserow.{{ primary_domain }}

roles/web-app-bigbluebutton/config/main.yml

@@ -12,13 +12,14 @@ features:
   oidc:               true
   central_database:   false
   logout:             true
-domains:
+server:
-  canonical:
+  csp:
-    - "meet.{{ primary_domain }}"
-csp:  
     flags:
       script-src-elem:
         unsafe-inline:  true
       style-src:
         unsafe-inline:  true
+  domains:
+    canonical:
+      - "meet.{{ primary_domain }}"
 credentials: {}

roles/web-app-bluesky/config/main.yml

@@ -8,7 +8,8 @@ features:
   port-ui-desktop:  true
   central_database: true
   logout:           true
-domains:
+server:
+  domains:
     canonical:
       web:  "bskyweb.{{ primary_domain }}"
       api:  "bluesky.{{ primary_domain }}"

roles/web-app-collabora/config/main.yml

@@ -1,4 +1,5 @@
-domains:
+server:
+  domains:
     canonical:
       - "collabora.{{ primary_domain }}"
 docker:

roles/web-app-discourse/config/main.yml

@@ -7,7 +7,8 @@ features:
   central_database:   true
   ldap:               false         # @todo implement and activate
   logout:   true
-csp:
+server:
+  csp:
     flags:
       style-src:
         unsafe-inline: true
@@ -16,7 +17,7 @@ csp:
     whitelist:
       font-src:
         - "http://*.{{primary_domain}}"
-domains:
+  domains:
     canonical:
       - "forum.{{ primary_domain }}"
 docker:

roles/web-app-elk/config/main.yml

@@ -1,6 +1,6 @@
 features:
   logout: false # Just deactivated to oppress warnings, elk is anyhow not running
-
+server:
-domains:
+  domains:
     canonical:
       - elk.{{ primary_domain }}

roles/web-app-espocrm/config/main.yml

@@ -6,7 +6,8 @@ features:
   oidc:               true
   central_database:   true
   logout:   true
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline:  true
@@ -21,7 +22,7 @@ csp:
         - "data:"
       frame-src:
         - https://s.espocrm.com/
-domains:
+  domains:
     aliases:
       - "crm.{{ primary_domain }}"
     canonical:

roles/web-app-friendica/config/main.yml

@@ -9,10 +9,11 @@ features:
   ldap:               true
   oauth2:             false # No special login side which could be protected, use 2FA of Friendica instead
   logout:   true
-domains:
+server:
+  domains:
     canonical:
       - "social.{{ primary_domain }}"
-csp:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline:  true

roles/web-app-funkwhale/config/main.yml

@@ -20,13 +20,14 @@ features:
   central_database:   true
   oauth2:             false # Doesn't make sense to activate it atm, because login is possible on homepage
   logout:   true
-domains:
+server:
+  domains:
     canonical:
       - "audio.{{ primary_domain }}"
     aliases:
       - "music.{{ primary_domain }}"
       - "sound.{{ primary_domain }}"
-csp:  
+  csp:  
     flags:
       style-src:
         unsafe-inline:  true

roles/web-app-gitea/config/main.yml

@@ -19,7 +19,8 @@ oauth2_proxy:
   acl:
     blacklist:
       - "/user/login"
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline:              true
@@ -33,7 +34,7 @@ csp:
         - "blob:"
       manifest-src:
         - "data:"
-domains:
+  domains:
     aliases:
       - "git.{{ primary_domain }}"
     canonical:

roles/web-app-gitlab/config/main.yml

@@ -15,7 +15,7 @@ docker:
       version:  "latest"
 credentials:
   initial_root_password: "{{ users.administrator.password }}"
-
+server:
-domains:
+  domains:
     canonical:
       - gitlab.{{ primary_domain }}

roles/web-app-jenkins/config/main.yml

@@ -1,6 +1,6 @@
 features:
   logout: true # Same like with elk, anyhow not active atm
-
+server:
-domains:
+  domains:
     canonical:
       - jenkins.{{ primary_domain }}

roles/web-app-joomla/config/main.yml

@@ -6,7 +6,8 @@ features:
   port-ui-desktop:    true
   central_database:   true
   logout:   true
-domains:
+server:
+  domains:
     canonical:
       - "cms.{{ primary_domain }}"
 docker:

roles/web-app-keycloak/config/main.yml

@@ -7,7 +7,8 @@ features:
   central_database:   true
   recaptcha:          true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline: true
@@ -18,7 +19,7 @@ csp:
     whitelist:
       frame-src:
         - "*" # For frontend channel logout it's necessary that iframes can be loaded
-domains:
+  domains:
     canonical:
       - "auth.{{ primary_domain }}"
 scopes:

roles/web-app-lam/config/main.yml

@@ -13,7 +13,8 @@ features:
   central_database:             false
   oauth2:                       true
   logout:                       true
-csp:
+server:
+  csp:
     flags:
       style-src:
         unsafe-inline:            true
@@ -22,7 +23,7 @@ csp:
         unsafe-eval:              true
       script-src:
         unsafe-inline:            true
-domains:
+  domains:
     aliases:
       - "ldap.{{primary_domain}}"
     canonical:

roles/web-app-libretranslate/config/main.yml

@@ -18,10 +18,11 @@ features:
   oauth2:           false   # Enable the OAuth2-Proy
   javascript:       false   # Enables the custom JS in the javascript.js.j2 file
   logout: false   # With this app I assume that it's a service, so should be renamed and logging is unneccessary
-csp:
+server:
+  csp:
     whitelist:        {}      # URL's which should be whitelisted
     flags:            {}      # Flags which should be set
-domains:
+  domains:
     canonical:
       - "libretranslate.{{ primary_domain }}"
     aliases:          []      # Alias redirections to the first element of the canonical domains

roles/web-app-listmonk/config/main.yml

@@ -6,7 +6,8 @@ features:
   central_database:         true
   oidc:                     true
   logout:                   true
-domains:
+server:
+  domains:
     canonical:
       - "newsletter.{{ primary_domain }}"
 docker:

roles/web-app-mailu/config/main.yml

@@ -9,10 +9,11 @@ features:
   oidc:                   true
   central_database:       false                 # Deactivate central database for mailu, I don't know why the database deactivation is necessary
   logout:                 true
-domains:
+server:
+  domains:
     canonical:
       - "mail.{{ primary_domain }}"
-csp:
+  csp:
     flags:
       style-src:
         unsafe-inline:        true

roles/web-app-mastodon/config/main.yml

@@ -7,10 +7,11 @@ features:
   oidc:               true
   central_database:   true
   logout:             true
-domains:
+server:
+  domains:
     canonical:
       - "microblog.{{ primary_domain }}"
-csp:
+  csp:
     whitelist:
       frame-src:
         - "*"

roles/web-app-matomo/config/main.yml

@@ -9,7 +9,8 @@ features:
   central_database:   true
   oauth2:             false
   logout:             true
-csp:
+server:
+  csp:
     whitelist:
       script-src-elem:
         - https://cdn.matomo.cloud
@@ -24,7 +25,7 @@ csp:
       style-src:
         unsafe-inline: true
         unsafe-eval:   true
-domains:
+  domains:
     aliases:
       - "analytics.{{ primary_domain }}"
     canonical:

roles/web-app-matrix/config/main.yml

@@ -24,7 +24,8 @@ features:
   oidc:               true                               # Deactivated OIDC due to this issue https://github.com/matrix-org/synapse/issues/10492
   central_database:   true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       script-src:
         unsafe-eval:   true
@@ -39,6 +40,11 @@ csp:
       script-src-elem:
         - "element.{{ primary_domain }}"
         - "https://cdn.jsdelivr.net"
+  domains:
+    canonical:
+      synapse: "matrix.{{ primary_domain }}"
+      element: "element.{{ primary_domain }}"
+  client_max_body_size: "15M"
 
 plugins:
 # You need to enable them in the inventory file
@@ -50,10 +56,3 @@ plugins:
   slack:      false
   telegram:   false
   whatsapp:   false
-
-client_max_body_size: "15M"
-
-domains:
-  canonical:
-    synapse: "matrix.{{ primary_domain }}"
-    element: "element.{{ primary_domain }}"

roles/web-app-matrix/vars/main.yml

@@ -17,4 +17,4 @@ matrix_project:           "{{ application_id | get_entity_name }}"
 # Webserver
 well_known_directory:     "{{nginx.directories.data.well_known}}/matrix/"
 location_upload:          "~ ^/_matrix/media/v3/"
-client_max_body_size:     "{{ applications | get_app_conf(application_id, 'client_max_body_size') }}"
+client_max_body_size:     "{{ applications | get_app_conf(application_id, 'server.client_max_body_size') }}"

roles/web-app-mediawiki/config/main.yml

@@ -1,4 +1,5 @@
-domains:
+server:
+  domains:
     canonical:
       - "wiki.{{ primary_domain }}"
 docker:

roles/web-app-mig/config/main.yml

@@ -9,7 +9,8 @@ features:
   css:                true  # use custom infinito stile 
   port-ui-desktop:    true  # Enable in port-ui
   logout:             false
-csp:
+server:
+  csp:
     whitelist:
       script-src-elem:
         - https://cdn.jsdelivr.net
@@ -30,7 +31,7 @@ csp:
     flags:
       style-src:
         unsafe-inline: true
-domains:
+  domains:
     canonical:
       - "mig.{{ primary_domain }}"
     aliases:

roles/web-app-mobilizon/config/main.yml

@@ -5,13 +5,14 @@ features:
   matomo:           true
   port-ui-desktop:  true
   logout: true
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline:  true
       script-src:
         unsafe-eval:  true
-domains:
+  domains:
     canonical:
       - "event.{{ primary_domain }}"
     aliases:

roles/web-app-moodle/config/main.yml

@@ -6,7 +6,8 @@ features:
   central_database:   true
   oidc:               true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline:  true
@@ -22,7 +23,7 @@ csp:
         - "blob:"
       script-src-elem:
         - "https://cdn.jsdelivr.net"
-domains:
+  domains:
     canonical:
       - "academy.{{ primary_domain }}"
 docker:

roles/web-app-mybb/config/main.yml

@@ -15,7 +15,7 @@ docker:
       name:     "mybb"
   volumes:
     data:       "mybb_data"
-
+server:
-domains:
+  domains:
     canonical:
       - mybb.{{ primary_domain }}

roles/web-app-navigator/config/main.yml

@@ -3,7 +3,8 @@ features:
   css:              true
   port-ui-desktop:  true
   logout:           false
-csp:
+server:
+  csp:
     whitelist:
       script-src-elem:
         - https://cdnjs.cloudflare.com
@@ -23,6 +24,6 @@ csp:
         unsafe-eval:  true
       script-src-elem:
         unsafe-inline: true
-domains:
+  domains:
     canonical:
       - "slides.{{ primary_domain }}"

roles/web-app-nextcloud/config/main.yml

@@ -1,5 +1,6 @@
 version:                      "production" # @see https://nextcloud.com/blog/nextcloud-release-channels-and-how-to-track-them/
-csp:
+server:
+  csp:
     flags:
       style-src:
         unsafe-inline: true
@@ -8,7 +9,7 @@ csp:
     whitelist:
       font-src:
         - "data:"
-domains:
+  domains:
     canonical:
       - "cloud.{{ primary_domain }}"
       # nextcloud:  "cloud.{{ primary_domain }}"

roles/web-app-oauth2-proxy/config/main.yml

@@ -6,7 +6,7 @@ features:
   css: true
   port-ui-desktop: false
   logout: true
-
+server:
-domains:
+  domains:
     canonical:
       - oauth2-proxy.{{ primary_domain }}

roles/web-app-openproject/config/main.yml

@@ -18,13 +18,14 @@ features:
   central_database:   true
   oauth2:             true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline: true
       style-src:
         unsafe-inline: true  
-domains:
+  domains:
     canonical:
       - "project.{{ primary_domain }}"
 

roles/web-app-peertube/config/main.yml

@@ -5,7 +5,8 @@ features:
   central_database:   true
   oidc:               true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline:  true
@@ -20,7 +21,7 @@ csp:
         - "blob:"
       font-src:
         - "data:"
-domains:
+  domains:
     canonical:
       - "video.{{ primary_domain }}"
     aliases:

roles/web-app-pgadmin/config/main.yml

@@ -13,7 +13,8 @@ features:
   central_database:       true
   oauth2:                 true
   logout:       true
-csp:
+server:
+  csp:
     flags:
       style-src:
         unsafe-inline: true
@@ -22,11 +23,10 @@ csp:
     whitelist:
       font-src:
         - "data:"
+  domains:
+    canonical:
+      - pgadmin.{{ primary_domain }}
 docker:
   services:
     database:
       enabled: true
-
-domains:
-  canonical:
-    - pgadmin.{{ primary_domain }}

roles/web-app-phpldapadmin/config/main.yml

@@ -11,7 +11,7 @@ features:
   ldap:               true
   oauth2:             true
   logout:   true
-
+server:
-domains:
+  domains:
     canonical:
       - phpldapadmin.{{ primary_domain }}

roles/web-app-phpmyadmin/config/main.yml

@@ -12,13 +12,14 @@ features:
   central_database:   true
   oauth2:             true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       style-src:
         unsafe-inline: true
       script-src-elem:
         unsafe-inline: true
-domains:
+  domains:
     aliases:
       - "mysql.{{ primary_domain }}"
       - "mariadb.{{ primary_domain }}"

roles/web-app-pixelfed/config/main.yml

@@ -6,7 +6,8 @@ features:
   central_database:   true
   oidc:               true
   logout:             true
-csp:
+server:
+  csp:
     flags:
       script-src:
         unsafe-eval:   true
@@ -19,7 +20,7 @@ csp:
     whitelist:
       frame-ancestors:
         - "*"
-domains:
+  domains:
     canonical:
       - "picture.{{ primary_domain }}"
     aliases:

roles/web-app-port-ui/config/main.yml

@@ -5,7 +5,8 @@ features:
   simpleicons:      true  # Activate Brand Icons for your groups
   javascript:       true  # Necessary for URL sync
   logout:           false # Doesn't have own user data. Just a frame.
-csp:
+server:
+  csp:
     whitelist:
       script-src-elem:
         - https://cdn.jsdelivr.net
@@ -27,7 +28,7 @@ csp:
         unsafe-inline: true
       script-src-elem:
         unsafe-inline: true
-domains:
+  domains:
     canonical:
       - "{{ primary_domain }}"
 

roles/web-app-pretix/config/main.yml

@@ -18,10 +18,11 @@ features:
   oauth2:           false   # Enable the OAuth2-Proy
   javascript:       false   # Enables the custom JS in the javascript.js.j2 file   
   logout:           true
-csp:
+server:
+  csp:
     whitelist:        {}      # URL's which should be whitelisted
     flags:            {}      # Flags which should be set
-domains:
+  domains:
     canonical:
       - "pretix.{{ primary_domain }}"
     aliases:          []      # Alias redirections to the first element of the canonical domains

roles/web-app-roulette-wheel/config/main.yml

@@ -1,5 +1,6 @@
 features:
   logout: false
-domains:
+server:
+  domains:
     canonical:
       - "wheel.{{ primary_domain }}"

roles/web-app-snipe-it/config/main.yml

@@ -6,10 +6,11 @@ features:
   ldap:               true
   oauth2:             true
   logout:             true
-domains:
+server:
+  domains:
     canonical:
       - "inventory.{{ primary_domain }}"
-csp:
+  csp:
     flags:
       script-src:
         unsafe-inline:  true

roles/web-app-sphinx/config/main.yml

@@ -3,7 +3,8 @@ features:
   css:              true
   port-ui-desktop:  true
   logout:           false
-csp:
+server:
+  csp:
     flags:
       script-src:
         unsafe-eval:    true
@@ -12,6 +13,6 @@ csp:
         unsafe-eval:    true
       style-src:
         unsafe-inline:  true
-domains:
+  domains:
     canonical:
       - "docs.{{ primary_domain }}"

roles/web-app-syncope/config/main.yml

@@ -13,7 +13,7 @@ features:
 #     users:
 #       administrator:
 #         username:     "{{ users.administrator.username }}"
-
+server:
-domains:
+  domains:
     canonical:
       - syncope.{{ primary_domain }}

roles/web-app-taiga/config/main.yml

@@ -18,7 +18,8 @@ docker:
       enabled: true
     taiga: 
       version: "latest"
-csp:
+server:
+  csp:
     flags:
       script-src-elem:
         unsafe-inline: true
@@ -27,6 +28,6 @@ csp:
         unsafe-inline: true
       script-src:
         unsafe-eval:   true
-domains:
+  domains:
     canonical:
       - "kanban.{{ primary_domain }}"

roles/web-app-wordpress/config/main.yml

@@ -14,7 +14,8 @@ features:
   oidc:               true
   central_database:   true
   logout:   true
-csp:
+server:
+  csp:
     flags:
       style-src:
         unsafe-inline:  true
@@ -37,7 +38,7 @@ csp:
       frame-src:
         - "blob:"
         - "*"
-domains:
+  domains:
     canonical:
       - "blog.{{ primary_domain }}"
 docker:

roles/web-app-wordpress/tasks/main.yml

@@ -6,7 +6,7 @@
 - name: "Include role srv-proxy-6-6-domain for {{ application_id }}"
   include_role:
     name: srv-proxy-6-6-domain
-  loop: "{{ applications | get_app_conf(application_id, 'domains.canonical', True) }}"
+  loop: "{{ applications | get_app_conf(application_id, 'server.domains.canonical', True) }}"
   loop_control:
     loop_var: domain
   vars:

roles/web-app-xmpp/config/main.yml

@@ -1,7 +1,7 @@
 # xmpp is more a service then a app with ui interface. @todo Rename it 
 features:
   logout: false # Reactivated as soon as xmpp is fully implemented
-
+server:
-domains:
+  domains:
     canonical:
       - xmpp.{{ primary_domain }}

roles/web-app-yourls/config/main.yml

@@ -13,11 +13,20 @@ features:
   central_database:   true
   oauth2:             true
   logout:             true
-domains:
+server:
+  domains:
     canonical:
       - "s.{{ primary_domain }}"
     aliases:
       - "short.{{ primary_domain }}"
+  csp:
+    flags:
+      style-src:
+        unsafe-inline:  true
+      script-src-elem:
+        unsafe-inline:  true
+      script-src:
+        unsafe-inline:  true
 docker:
   services:
     database:
@@ -26,11 +35,3 @@ docker:
       version:    "latest"
       name:       "yourls"
       image:      "yourls"
-csp:
-  flags:
-    style-src:
-      unsafe-inline:  true
-    script-src-elem:
-      unsafe-inline:  true
-    script-src:
-      unsafe-inline:  true

roles/web-svc-asset/config/main.yml

@@ -1,6 +1,6 @@
 source_directory: "{{ playbook_dir }}/assets"
-url: "{{ web_protocol }}://<< defaults_applications['web-svc-file']domains.canonical[0] >>/assets"
+url:              "{{ web_protocol }}://<< defaults_applications['web-svc-file']server.domains.canonical[0] >>/assets"
-
+server:
-domains:
+  domains:
     canonical:
       - asset.{{ primary_domain }}

roles/web-svc-cdn/config/main.yml

@@ -2,6 +2,7 @@ features:
   matomo:           true
   css:              true
   port-ui-desktop:  true
-domains:
+server:
+  domains:
     canonical:
       - "cdn.{{ primary_domain }}"

roles/web-svc-file/config/main.yml

@@ -2,7 +2,8 @@ features:
   matomo:           true
   css:              true
   port-ui-desktop:  true
-domains:
+server:
+  domains:
     canonical:
       - "file.{{ primary_domain }}"
     alias:

roles/web-svc-html/config/main.yml

@@ -2,6 +2,7 @@ features:
   matomo:           true
   css:              true
   port-ui-desktop:  true
-domains:
+server:
+  domains:
     canonical:
       - "html.{{ primary_domain }}"

roles/web-svc-logout/config/main.yml

@@ -4,10 +4,11 @@ features:
   port-ui-desktop:  true
   javascript:       false
   logout:           false
-domains:
+server:
+  domains:
     canonical:
       - "logout.{{ primary_domain }}"
-csp:
+  csp:
     flags:
       style-src:
         unsafe-inline: true
@@ -22,5 +23,5 @@ csp:
       style-src:
         - https://cdn.jsdelivr.net
       frame-ancestors:
-      - "{{ web_protocol }}://<< defaults_applications[web-app-keycloak].domains.canonical[0] >>"
+        - "{{ web_protocol }}://<< defaults_applications[web-app-keycloak].server.domains.canonical[0] >>"
 

roles/web-svc-logout/filter_plugins/domain_filters.py

@@ -31,7 +31,7 @@ class FilterModule(object):
                     continue
 
                 # use canonical domains list if present
-                domains_entry = config.get('domains', {}).get('canonical', [])
+                domains_entry = config.get('server', {}).get('domains', {}).get('canonical', [])
 
                 # normalize to a list of strings
                 if isinstance(domains_entry, dict):

roles/web-svc-simpleicons/config/main.yml

@@ -16,8 +16,9 @@ features:
   central_database: false   # Enable Central Database Network
   recaptcha:        false   # Enable ReCaptcha
   oauth2:           false   # Enable the OAuth2-Proy
-csp: {}      
+server:
-domains:
+  csp: {}      
+  domains:
     canonical:
       - "icons.{{ primary_domain }}"
 rbac:

templates/roles/web-app/config/main.yml.j2

@@ -25,7 +25,8 @@ features:
   oauth2:           false   # Enable the OAuth2-Proy
   javascript:       false   # Enable the custom JS in the javascript.js.j2 file  
   logout:           true    # Enable the logout via the central logout mechanism (deleting all cookies)  
-csp:
+server:
+  csp:
     whitelist:                # URL's which should be whitelisted           
       script-src-elem:  []
       style-src:        []
@@ -39,8 +40,7 @@ csp:
         unsafe-inline:  false
       script-src-elem:
         unsafe-inline:  false
-domains:
+  domains:
-domains:
     canonical:        {}      # Urls under which the domain should be directly accessible
     aliases:          []      # Alias redirections to the first element of the canonical domains
 rbac:

tests/integration/test_domain_uniqueness.py

@@ -25,7 +25,7 @@ class TestDomainUniqueness(unittest.TestCase):
         domain_to_apps = defaultdict(set)
 
         for app_name, app_cfg in apps.items():
-            domains_cfg = app_cfg.get('domains', {})
+            domains_cfg = app_cfg.get('server',{}).get('domains',{})
 
             # canonical entries may be a list or a mapping
             canonical = domains_cfg.get('canonical', [])

tests/integration/test_domains_canonical.py

@@ -20,17 +20,17 @@ class TestWebRolesDomains(unittest.TestCase):
 
                 self.assertIsInstance(data, dict, f"YAML root is not a dict in {path}")
 
-                domains = data.get("domains")
+                domains = data.get('server',{}).get('domains',{})
                 self.assertIsNotNone(domains, f"'domains' section missing in {path}")
                 self.assertIsInstance(domains, dict, f"'domains' must be a dict in {path}")
 
                 canonical = domains.get("canonical")
-                self.assertIsNotNone(canonical, f"'domains.canonical' missing in {path}")
+                self.assertIsNotNone(canonical, f"'server.domains.canonical' missing in {path}")
 
                 # Check for emptiness
                 empty_values = [{}, [], ""]
                 self.assertNotIn(canonical, empty_values,
-                    f"'domains.canonical' in {path} must not be empty dict, list, or empty string")
+                    f"'server.domains.canonical' in {path} must not be empty dict, list, or empty string")
 
 if __name__ == "__main__":
     unittest.main()

tests/integration/test_domains_structure.py

@@ -33,7 +33,7 @@ class TestDomainsStructure(unittest.TestCase):
                 if 'domains' not in data:
                     continue
 
-                domains = data['domains']
+                domains = data.get('server',{}).get('domains')
                 if not isinstance(domains, dict):
                     failed_roles.append((role_path.name, vars_file.name, "'domains' should be a dict"))
                     continue

tests/unit/filter_plugins/test_domain_filters_alias.py

@@ -33,9 +33,11 @@ class TestDomainFilters(unittest.TestCase):
     def test_alias_with_explicit_aliases(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {'aliases': ['alias.com']}
                 }
             }
+        }
         # canonical defaults to ['app1.example.com'], so alias should include alias.com and default
         expected = {'app1': ['alias.com', 'app1.example.com']}
         result = self.filter_module.alias_domains_map(apps, self.primary)
@@ -44,7 +46,7 @@ class TestDomainFilters(unittest.TestCase):
     def test_alias_with_canonical_not_default(self):
         apps = {
             'app1': {
-                'domains': {'canonical': ['foo.com']}
+                'server':{'domains': {'canonical': ['foo.com']}}
             }
         }
         # foo.com is canonical, default not in canonical so added as alias
@@ -55,12 +57,14 @@ class TestDomainFilters(unittest.TestCase):
     def test_alias_with_existing_default(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {
                         'canonical': ['foo.com'],
                         'aliases': ['app1.example.com']
                     }
                 }
             }
+        }
         # default present in aliases, should not be duplicated
         expected = {'app1': ['app1.example.com']}
         result = self.filter_module.alias_domains_map(apps, self.primary)
@@ -68,7 +72,7 @@ class TestDomainFilters(unittest.TestCase):
 
     def test_invalid_aliases_type(self):
         apps = {
-            'app1': {'domains': {'aliases': 123}}
+            'app1': {'server':{'domains': {'aliases': 123}}}
         }
         with self.assertRaises(AnsibleFilterError):
             self.filter_module.alias_domains_map(apps, self.primary)
@@ -76,9 +80,11 @@ class TestDomainFilters(unittest.TestCase):
     def test_alias_with_empty_domains_cfg(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {}
                 }
             }
+        }
         expected = apps
         result = self.filter_module.alias_domains_map(apps, self.primary)
         self.assertEqual(result, expected)
@@ -86,6 +92,7 @@ class TestDomainFilters(unittest.TestCase):
     def test_alias_with_canonical_dict_not_default(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {
                         'canonical': {
                             'one': 'one.com',
@@ -94,6 +101,7 @@ class TestDomainFilters(unittest.TestCase):
                     }
                 }
             }
+        }
         expected = {'app1': ['app1.example.com']}
         result = self.filter_module.alias_domains_map(apps, self.primary)
         self.assertEqual(result, expected)

tests/unit/filter_plugins/test_domain_filters_canonical.py

@@ -32,9 +32,11 @@ class TestDomainFilters(unittest.TestCase):
     def test_canonical_with_list(self):
         apps = {
             'web-app-app1': {
+                'server':{
                     'domains': {'canonical': ['foo.com', 'bar.com']}
                 }
             }
+        }
         result = self.filter_module.canonical_domains_map(apps, self.primary)
         self.assertCountEqual(
             result['web-app-app1'],
@@ -44,9 +46,11 @@ class TestDomainFilters(unittest.TestCase):
     def test_canonical_with_dict(self):
         apps = {
             'web-app-app1': {
+                'server':{
                     'domains': {'canonical': {'one': 'one.com', 'two': 'two.com'}}
                 }
             }
+        }
         result = self.filter_module.canonical_domains_map(apps, self.primary)
         self.assertEqual(
             result['web-app-app1'],
@@ -55,8 +59,14 @@ class TestDomainFilters(unittest.TestCase):
 
     def test_canonical_duplicate_raises(self):
         apps = {
-            'web-app-app1': {'domains': {'canonical': ['dup.com']}},
+            'web-app-app1':{
-            'web-app-app2': {'domains': {'canonical': ['dup.com']}},
+                'server':{'domains': {'canonical': ['dup.com']}},
+            },
+            'web-app-app2':{ 
+                'server':{
+                    'domains': {'canonical': ['dup.com']}
+                },
+            },
         }
         with self.assertRaises(AnsibleFilterError) as cm:
             self.filter_module.canonical_domains_map(apps, self.primary)
@@ -65,7 +75,7 @@ class TestDomainFilters(unittest.TestCase):
 
     def test_invalid_canonical_type(self):
         apps = {
-            'web-app-app1': {'domains': {'canonical': 123}}
+            'web-app-app1': {'server':{'domains': {'canonical': 123}}}
         }
         with self.assertRaises(AnsibleFilterError):
             self.filter_module.canonical_domains_map(apps, self.primary)
@@ -76,7 +86,7 @@ class TestDomainFilters(unittest.TestCase):
         resulting in an empty mapping when only non-web apps are provided.
         """
         apps = {
-            'db-app-app1': {'domains': {'canonical': ['db.example.com']}},
+            'db-app-app1': {'server':{'domains': {'canonical': ['db.example.com']}}},
             'service-app-app2': {}
         }
         result = self.filter_module.canonical_domains_map(apps, self.primary)
@@ -88,7 +98,7 @@ class TestDomainFilters(unittest.TestCase):
         non-web apps should be ignored alongside valid web apps.
         """
         apps = {
-            'db-app-app1': {'domains': {'canonical': ['db.example.com']}},
+            'db-app-app1': {'server':{'domains': {'canonical': ['db.example.com']}}},
             'web-app-app1': {}
         }
         expected = {'web-app-app1': ['app1.example.com']}

tests/unit/filter_plugins/test_domain_mappings.py

@@ -37,9 +37,11 @@ class TestDomainMappings(unittest.TestCase):
     def test_explicit_aliases(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {'aliases': ['alias.com']}
                 }
             }
+        }
         default = 'app1.example.com'
         expected = [
             {'source': 'alias.com',    'target': default},
@@ -51,9 +53,11 @@ class TestDomainMappings(unittest.TestCase):
     def test_canonical_not_default(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {'canonical': ['foo.com']}
                 }
             }
+        }
         expected = [
             {'source': 'app1.example.com', 'target': 'foo.com'}
         ]
@@ -63,11 +67,13 @@ class TestDomainMappings(unittest.TestCase):
     def test_canonical_dict(self):
         apps = {
             'app1': {
+                'server':{
                     'domains': {
                         'canonical': {'one': 'one.com', 'two': 'two.com'}
                     }
                 }
             }
+        }
         # first canonical key 'one' → one.com
         expected = [
             {'source': 'app1.example.com', 'target': 'one.com'}
@@ -77,8 +83,12 @@ class TestDomainMappings(unittest.TestCase):
 
     def test_multiple_apps(self):
         apps = {
-            'app1': {'domains': {'aliases': ['a1.com']}},
+            'app1': {
-            'app2': {'domains': {'canonical': ['c2.com']}},
+                'server':{'domains': {'aliases': ['a1.com']}}
+            },
+            'app2': {
+                'server':{'domains': {'canonical': ['c2.com']}}
+            },
         }
         expected = [
             {'source': 'a1.com',              'target': 'app1.example.com'},
@@ -89,7 +99,10 @@ class TestDomainMappings(unittest.TestCase):
         
     def test_multiple_aliases(self):
         apps = {
-            'app1': {'domains': {'aliases': ['a1.com','a2.com']}}
+            'app1': {
+                'server':{'domains': {'aliases': ['a1.com','a2.com']}
+                }
+            }
         }
         expected = [
             {'source': 'a1.com', 'target': 'app1.example.com'},
@@ -100,7 +113,7 @@ class TestDomainMappings(unittest.TestCase):
 
     def test_invalid_aliases_type(self):
         apps = {
-            'app1': {'domains': {'aliases': 123}}
+            'app1': {'server':{'domains': {'aliases': 123}}}
         }
         with self.assertRaises(AnsibleFilterError):
             self.filter.domain_mappings(apps, self.primary)

tests/unit/filter_plugins/test_load_configuration.py

@@ -19,12 +19,14 @@ class TestLoadConfigurationFilter(unittest.TestCase):
         self.nested_cfg = {
             'html': {
                 'features': {'matomo': True},
-                'domains': {'canonical': ['html.example.com']}
+                'server': {
+                    'domains':{'canonical': ['html.example.com']}
+                }
             }
         }
         self.flat_cfg = {
             'features': {'matomo': False},
-            'domains': {'canonical': ['flat.example.com']}
+            'server': {'domains':{'canonical': ['flat.example.com']}}
         }
 
     def test_invalid_key(self):
@@ -69,7 +71,7 @@ class TestLoadConfigurationFilter(unittest.TestCase):
         self.assertIn(self.app, _cfg_cache)
         mock_yaml.reset_mock()
         # from cache
-        self.assertEqual(self.f(self.app, 'domains.canonical'),
+        self.assertEqual(self.f(self.app, 'server.domains.canonical'),
                          ['html.example.com'])
         mock_yaml.assert_not_called()
 
@@ -92,7 +94,7 @@ class TestLoadConfigurationFilter(unittest.TestCase):
         mock_yaml.return_value = self.nested_cfg
         # nested fallback must work
         self.assertTrue(self.f(self.app, 'features.matomo'))
-        self.assertEqual(self.f(self.app, 'domains.canonical'),
+        self.assertEqual(self.f(self.app, 'server.domains.canonical'),
                          ['html.example.com'])
 
     @patch('load_configuration.os.listdir', return_value=['r4'])
@@ -105,13 +107,15 @@ class TestLoadConfigurationFilter(unittest.TestCase):
         mock_exists.side_effect = lambda p: p.endswith('config/main.yml')
         mock_yaml.return_value = {
             'file': {
-                'domains': {
+                'server': {
+                    'domains':{
                         'canonical': ['files.example.com', 'extra.example.com']
                     }
                 }
             }
+        }
         # should get the first element of the canonical domains list
-        self.assertEqual(self.f('file', 'domains.canonical[0]'),
+        self.assertEqual(self.f('file', 'server.domains.canonical[0]'),
                          'files.example.com')
 
 if __name__ == '__main__':

tests/unit/roles/web-svc-logout/filter_plugins/test_domain_filters.py

@@ -33,23 +33,33 @@ class TestLogoutDomainsFilter(unittest.TestCase):
     def test_flatten_and_feature_flag(self):
         applications = {
             "app1": {
-                "domains": {"canonical": "single.domain.com"},
+                'server':{
+                    "domains": {"canonical": "single.domain.com"}
+                },
                 "features": {"logout": True},
             },
             "app2": {
-                "domains": {"canonical": ["list1.com", "list2.com"]},
+                'server':{
+                    "domains": {"canonical": ["list1.com", "list2.com"]}
+                },
                 "features": {"logout": True},
             },
             "app3": {
-                "domains": {"canonical": {"k1": "dictA.com", "k2": "dictB.com"}},
+                'server':{
+                    "domains": {"canonical": {"k1": "dictA.com", "k2": "dictB.com"}}
+                },
                 "features": {"logout": True},
             },
             "app4": {
-                "domains": {"canonical": "no-logout.com"},
+                'server':{
+                    "domains": {"canonical": "no-logout.com"}
+                },
                 "features": {"logout": False},
             },
             "other": {
-                "domains": {"canonical": "ignored.com"},
+                'server':{
+                    "domains": {"canonical": "ignored.com"}
+                },
                 "features": {"logout": True},
             },
         }
@@ -67,7 +77,9 @@ class TestLogoutDomainsFilter(unittest.TestCase):
     def test_missing_canonical_defaults_empty(self):
         applications = {
             "app1": {
-                "domains": {},  # no 'canonical' key
+                'server':{
+                    "domains": {}
+                },  # no 'canonical' key
                 "features": {"logout": True},
             }
         }
@@ -77,7 +89,9 @@ class TestLogoutDomainsFilter(unittest.TestCase):
     def test_app_not_in_group(self):
         applications = {
             "app1": {
-                "domains": {"canonical": "domain.com"},
+                'server':{
+                    "domains": {"canonical": "domain.com"}
+                },
                 "features": {"logout": True},
             }
         }
@@ -87,7 +101,9 @@ class TestLogoutDomainsFilter(unittest.TestCase):
     def test_invalid_domain_type(self):
         applications = {
             "app1": {
-                "domains": {"canonical": 123},
+                'server':{
+                    "domains": {"canonical": 123}
+                },
                 "features": {"logout": True},
             }
         }

tests/unit/utils/test_dict_renderer.py

@@ -64,11 +64,13 @@ class TestDictRenderer(unittest.TestCase):
         # Combine quoted key, dot access and numeric index
         data = {
             "web-svc-file": {
+                'server':{
                     "domains": {
                         "canonical": ["file.example.com"]
                     }
+                }
             },
-            "url": '<<[\'web-svc-file\'].domains.canonical[0]>>'
+            "url": '<<[\'web-svc-file\'].server.domains.canonical[0]>>'
         }
         rendered = self.renderer.render(data)
         self.assertEqual(rendered["url"], "file.example.com")