refactor(env): consolidate INFINITO_* namespace and centralize path/image SPOTs

Closes a stack of env-pipeline regressions left over from the recent
INFINITO_* namespace refactor by:

* DOMAIN_PRIMARY now reads INFINITO_DOMAIN strictly (was: legacy DOMAIN
  env var → defaulted to infinito.localhost, which never resolved
  because CoreDNS serves the INFINITO_DOMAIN value, infinito.example).
* group_vars/all/08_networks.yml IPs (ip4/ip6/dns) now read
  INFINITO_IP4 / INFINITO_IP6 / INFINITO_DNS_IP.
* PLAYWRIGHT_KEEP_ALL renamed to INFINITO_PLAYWRIGHT_KEEP end-to-end
  (env-builder, role default, run_one.yml docker exec, playwright.config.js,
  lint allowlist, docs anchor, CI workflow vars).
* PKGMGR_IMAGE renamed to INFINITO_PARENT_IMAGE; Dockerfile ARG drops
  the inline default so env/default.env is the only SPOT.
* INFINITO_SRC_DIR centralized: Dockerfile ARG (no default) + ENV;
  compose forwards it as build-arg, volume mount path, and container env;
  every Python CLI + shell helper + CI workflow now reads it strictly
  (os.environ[...] / "${INFINITO_SRC_DIR:?...}") instead of the literal
  /opt/src/infinito.
* New entries in env/default.env: INFINITO_IP6=::1, INFINITO_PARENT_IMAGE,
  INFINITO_PLAYWRIGHT_KEEP=false. All three propagated through
  utils/env/handlers/passthrough.STATIC_KEYS and (where consumed in the
  container) through compose.yml's environment block.

Validated end-to-end with `make test` (2360 tests across lint, lint-*,
test-lint, test-external, test-unit, test-integration).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/test-deploy-local.yml

@@ -31,7 +31,7 @@ env:
   INFINITO_DISTROS: "debian"
   NIX_CONFIG: ""
   INFINITO_IMAGE_TAG: "latest"
-  PLAYWRIGHT_KEEP_ALL: ${{ vars.PLAYWRIGHT_KEEP_ALL }}
+  INFINITO_PLAYWRIGHT_KEEP: ${{ vars.INFINITO_PLAYWRIGHT_KEEP }}
   INFINITO_APP_DISCOVERY_RUNNER: host
 
 jobs:

.github/workflows/test-deploy-server.yml

@@ -24,7 +24,7 @@ env:
     access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
   INFINITO_IMAGE_TAG: ci-${{ github.sha }}
   INFINITO_GHCR_MIRROR_PREFIX: mirror
-  PLAYWRIGHT_KEEP_ALL: ${{ vars.PLAYWRIGHT_KEEP_ALL }}
+  INFINITO_PLAYWRIGHT_KEEP: ${{ vars.INFINITO_PLAYWRIGHT_KEEP }}
   INFINITO_APP_DISCOVERY_RUNNER: host
 jobs:
   discover:

.github/workflows/test-deploy-universal.yml

@@ -24,7 +24,7 @@ env:
     access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
   INFINITO_IMAGE_TAG: ci-${{ github.sha }}
   INFINITO_GHCR_MIRROR_PREFIX: mirror
-  PLAYWRIGHT_KEEP_ALL: ${{ vars.PLAYWRIGHT_KEEP_ALL }}
+  INFINITO_PLAYWRIGHT_KEEP: ${{ vars.INFINITO_PLAYWRIGHT_KEEP }}
   INFINITO_APP_DISCOVERY_RUNNER: host
 jobs:
   discover:

.github/workflows/test-deploy-workstation.yml

@@ -24,7 +24,7 @@ env:
     access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
   INFINITO_IMAGE_TAG: ci-${{ github.sha }}
   INFINITO_GHCR_MIRROR_PREFIX: mirror
-  PLAYWRIGHT_KEEP_ALL: ${{ vars.PLAYWRIGHT_KEEP_ALL }}
+  INFINITO_PLAYWRIGHT_KEEP: ${{ vars.INFINITO_PLAYWRIGHT_KEEP }}
   INFINITO_APP_DISCOVERY_RUNNER: host
 jobs:
   discover:

.github/workflows/test-install-make.yml

@@ -25,12 +25,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
+      - name: Resolve INFINITO_SRC_DIR from env/default.env (SPOT)
+        run: |
+          src_dir="$(awk -F= '/^INFINITO_SRC_DIR=/{print $2; exit}' env/default.env)"
+          test -n "${src_dir}" || { echo "INFINITO_SRC_DIR not found in env/default.env" >&2; exit 1; }
+          echo "INFINITO_SRC_DIR=${src_dir}" >> "$GITHUB_ENV"
+
       - name: Install & test in pkgmgr virgin container
         run: |
           docker run --rm \
             -e NIX_CONFIG="${NIX_CONFIG}" \
-            -v "$(pwd):/opt/src/infinito" \
-            -w "/opt/src/infinito" \
+            -e INFINITO_SRC_DIR="${INFINITO_SRC_DIR}" \
+            -v "$(pwd):${INFINITO_SRC_DIR}" \
+            -w "${INFINITO_SRC_DIR}" \
             "ghcr.io/kevinveenbirkenbach/pkgmgr-${{ matrix.distro }}-virgin:stable" \
             bash -lc '
               set -euo pipefail

Dockerfile

@@ -1,11 +1,13 @@
 # syntax=docker/dockerfile:1
 
-# Base image (pkgmgr) selector
-# Example:
-#   PKGMGR_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch:stable
-#   PKGMGR_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch-slim:stable
-ARG PKGMGR_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch:stable
-FROM ${PKGMGR_IMAGE} AS full
+# Base image (pkgmgr) selector. SPOT lives in env/default.env's
+# INFINITO_PARENT_IMAGE and is forwarded as a build arg by compose.yml /
+# scripts/image/build.sh.
+# Example values:
+#   INFINITO_PARENT_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch:stable
+#   INFINITO_PARENT_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch-slim:stable
+ARG INFINITO_PARENT_IMAGE
+FROM ${INFINITO_PARENT_IMAGE} AS full
 
 # Hadolint DL4006: ensure pipefail is set for RUN instructions that use pipes
 SHELL ["/bin/bash", "-o", "pipefail", "-lc"]
@@ -13,7 +15,10 @@ SHELL ["/bin/bash", "-o", "pipefail", "-lc"]
 # Forwardable build-time Nix settings (e.g., GitHub access tokens to avoid rate limits)
 ARG NIX_CONFIG
 
-ENV INFINITO_SRC_DIR="/opt/src/infinito"
+# SPOT for the bind-mounted source tree inside the container. The compose
+# stack forwards env/default.env's INFINITO_SRC_DIR as a build arg.
+ARG INFINITO_SRC_DIR
+ENV INFINITO_SRC_DIR=${INFINITO_SRC_DIR}
 ENV PYTHON="/opt/venvs/infinito/bin/python"
 ENV PIP="/opt/venvs/infinito/bin/python -m pip"
 ENV PATH="/opt/venvs/infinito/bin:${PATH}"
@@ -60,7 +65,7 @@ RUN set -euo pipefail; \
   pkgmgr install infinito --clone-mode shallow; \
   echo "[docker-infinito] Installed Infinito.Nexus Version:"; \
   pkgmgr version infinito; \
-  /opt/src/infinito/scripts/docker/entry.sh --compile -- true
+  "${INFINITO_SRC_DIR}/scripts/docker/entry.sh" --compile -- true
 
 # Set workdir to / to avoid ambiguous commands
 WORKDIR /
@@ -71,7 +76,10 @@ RUN chmod +x /usr/local/bin/healthcheck.sh
 HEALTHCHECK --interval=5s --timeout=20s --start-period=30s --retries=20 \
   CMD /usr/local/bin/healthcheck.sh
 
-ENTRYPOINT ["/opt/src/infinito/scripts/docker/entry.sh"]
+# JSON-form ENTRYPOINT does not expand ENV vars; wrap via bash -c so the
+# INFINITO_SRC_DIR SPOT still controls the path. `exec` preserves systemd
+# signal forwarding; `--` is the placeholder for $0.
+ENTRYPOINT ["/bin/bash", "-c", "exec \"${INFINITO_SRC_DIR}/scripts/docker/entry.sh\" \"$@\"", "--"]
 
 # IMPORTANT: default to systemd as PID 1
 CMD ["/sbin/init"]

cli/administration/deploy/container/command.py

@@ -10,7 +10,7 @@ import uuid
 
 from . import PROJECT_ROOT
 
-INFINITO_SRC_DIR = "/opt/src/infinito"
+INFINITO_SRC_DIR = os.environ["INFINITO_SRC_DIR"]
 
 
 def ensure_image(image: str, rebuild: bool = False, no_cache: bool = False) -> None:

cli/administration/deploy/development/compose.py

@@ -222,9 +222,10 @@ class Compose:
 
         if run_entry_init:
             print(">>> Running infinito entry.sh init")
+            src_dir = os.environ["INFINITO_SRC_DIR"]
             r = self.exec(
-                ["sh", "-lc", "/opt/src/infinito/scripts/docker/entry.sh true"],
-                workdir="/opt/src/infinito",
+                ["sh", "-lc", f"{src_dir}/scripts/docker/entry.sh true"],
+                workdir=src_dir,
                 check=False,
                 live=True,
                 extra_env={

cli/administration/deploy/development/deps.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -32,7 +33,9 @@ def resolve_run_after(
     ]
     if services_overrides_container_path:
         cmd.extend(["--services-overrides", services_overrides_container_path])
-    r = compose.exec(cmd, check=False, workdir="/opt/src/infinito", capture=True)
+    r = compose.exec(
+        cmd, check=False, workdir=os.environ["INFINITO_SRC_DIR"], capture=True
+    )
 
     if r.returncode != 0:
         raise RuntimeError(

cli/administration/deploy/development/inventory/builder.py

@@ -9,6 +9,7 @@ runs the planner and builds every round's folder.
 from __future__ import annotations
 
 import json
+import os
 from typing import TYPE_CHECKING, Any
 
 from cli.administration.deploy.development.common import DEV_INVENTORY_VARS_FILE
@@ -73,7 +74,7 @@ def build_dev_inventory(compose: Compose, spec: DevInventorySpec) -> None:
     compose.exec(
         cmd,
         check=True,
-        workdir="/opt/src/infinito",
+        workdir=os.environ["INFINITO_SRC_DIR"],
         extra_env=extra_env or None,
     )
     _ensure_vault_password_file(compose, inventory_dir=inv_root)

cli/administration/deploy/development/mirrors.py

@@ -4,7 +4,7 @@ import os
 import shlex
 from pathlib import Path
 
-CONTAINER_REPO_ROOT = Path("/opt/src/infinito")
+CONTAINER_REPO_ROOT = Path(os.environ["INFINITO_SRC_DIR"])
 
 
 def _require_env(name: str) -> str:

cli/administration/deploy/development/up.py

@@ -12,7 +12,7 @@ def add_parser(sub: argparse._SubParsersAction) -> None:
     p.add_argument(
         "--skip-entry-init",
         action="store_true",
-        help="Do not run /opt/src/infinito/scripts/docker/entry.sh true after stack is up.",
+        help="Do not run ${INFINITO_SRC_DIR}/scripts/docker/entry.sh true after stack is up.",
     )
     p.add_argument(
         "--when-down",

compose.yml

@@ -28,6 +28,8 @@ services:
       dockerfile: Dockerfile
       network: host
       args:
+        INFINITO_PARENT_IMAGE: ${INFINITO_PARENT_IMAGE}
+        INFINITO_SRC_DIR: ${INFINITO_SRC_DIR}
         NIX_CONFIG: ${NIX_CONFIG}
     image: "${INFINITO_IMAGE}"
     pull_policy: "${INFINITO_PULL_POLICY:?Run 'make dotenv' to generate the .env single source of truth}"
@@ -64,7 +66,7 @@ services:
     <<: *ci_defaults
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
-      - .:/opt/src/infinito
+      - .:${INFINITO_SRC_DIR}
       - ${INFINITO_DOCKER_VOLUME:?Run 'make dotenv' to generate the .env single source of truth}:${INFINITO_DOCKER_MOUNT:?Run 'make dotenv' to generate the .env
         single source of truth}
       - infinito:/var/lib/infinito/
@@ -74,7 +76,9 @@ services:
       INFINITO_DNS_IP: ${INFINITO_DNS_IP}
       INFINITO_DOMAIN: ${INFINITO_DOMAIN}
       INFINITO_IP4: ${INFINITO_IP4}
-      INFINITO_SRC_DIR: /opt/src/infinito
+      INFINITO_IP6: ${INFINITO_IP6}
+      INFINITO_PLAYWRIGHT_KEEP: ${INFINITO_PLAYWRIGHT_KEEP}
+      INFINITO_SRC_DIR: ${INFINITO_SRC_DIR}
       PYTHONHTTPSVERIFY: "1"
       GIT_SSL_NO_VERIFY: "0"
 

docs/agents/action/iteration/playwright.md

@@ -34,11 +34,11 @@ You MUST load the following pages before editing any file, in this order:
 
 1. Verify every item in [Preconditions](#preconditions). If any fails, exit this page and follow [Role Loop](role.md).
 2. Edit `roles/<role>/files/playwright/playwright.spec.js`. You MUST NOT hand-edit the staged copy under `TEST_E2E_PLAYWRIGHT_STAGE_BASE_DIR/<role>/tests/`; the rerunner overwrites it from the repo on each run.
-3. Run `PLAYWRIGHT_KEEP_ALL=true scripts/tests/e2e/rerun-spec.sh <role>`. You MAY append `--grep <pattern>` or any other `npx playwright test` argument. Set `PLAYWRIGHT_KEEP_ALL=true` on every inner-loop run regardless of the previous result; omit only when the user has explicitly opted out. For the full propagation chain see [Playwright Tests](../../../contributing/actions/testing/playwright.md#artefact-retention-).
+3. Run `INFINITO_PLAYWRIGHT_KEEP=true scripts/tests/e2e/rerun-spec.sh <role>`. You MAY append `--grep <pattern>` or any other `npx playwright test` argument. Set `INFINITO_PLAYWRIGHT_KEEP=true` on every inner-loop run regardless of the previous result; omit only when the user has explicitly opted out. For the full propagation chain see [Playwright Tests](../../../contributing/actions/testing/playwright.md#artefact-retention-).
 4. Inspect the run output before deciding pass / fail; a green Playwright exit only proves no `expect(...)` threw, not that the contract is satisfied:
    - You MUST read the per-test logs for every run: the `list` reporter output, `playwright-report/index.html`, and `test-results/<test>/error-context.md` for any failed test.
    - You MUST verify schema conformance per [Contributing `playwright.spec.js`](../../../contributing/artefact/files/role/playwright.specs.js.md): persona names match `<persona>: <flow>`, every skip routes through `PERSONA_<X>_BLOCKED=true` or `<NAME>_SERVICE_ENABLED=false` (never runtime detection), and every persona reaches an authenticated surface and drives a role-specific interaction.
-   - With `PLAYWRIGHT_KEEP_ALL=true` you MUST open the trace / video of at least one passing persona per run, to confirm the journey actually fired.
+   - With `INFINITO_PLAYWRIGHT_KEEP=true` you MUST open the trace / video of at least one passing persona per run, to confirm the journey actually fired.
 5. If the script exits `0` AND the inspection passed, go to [Exit](#exit).
 6. If the script exits non-zero OR the inspection surfaced a schema violation:
    1. If the failure needs a change **outside** `files/playwright/playwright.spec.js` (role tasks, templates, vars, config, `javascript.js`, `style.css`, or any other role asset the deploy materializes), go to [Escape](#escape).

docs/agents/action/iteration/role.md

@@ -17,7 +17,7 @@ For workflow-level iteration with Act, see [Workflow Loop](workflow.md).
   - SIDE EFFECT (yes): inventory initializer auto-removes the provider roles `web-app-matomo`, `web-app-dashboard`, `web-app-prometheus`, `web-app-mailu`, and `web-svc-css`. Do NOT list them in `INFINITO_APPS`.
   - PERSIST: record answer at top of iteration. Reuse for all subsequent deploys without re-asking.
 - You MUST run `make test` before every deploy. Only proceed with the deploy if all tests pass.
-- You MUST prepend `PLAYWRIGHT_KEEP_ALL=true` to every `make deploy-*` command in the iteration (fresh, reuse-kept, and reuse-purged alike), so trace, screenshot, and video of passing Playwright tests stay inspectable. Omit only when the user has explicitly opted out of per-test artefacts. For the full propagation chain see [Playwright Tests](../../../contributing/actions/testing/playwright.md#artefact-retention-).
+- You MUST prepend `INFINITO_PLAYWRIGHT_KEEP=true` to every `make deploy-*` command in the iteration (fresh, reuse-kept, and reuse-purged alike), so trace, screenshot, and video of passing Playwright tests stay inspectable. Omit only when the user has explicitly opted out of per-test artefacts. For the full propagation chain see [Playwright Tests](../../../contributing/actions/testing/playwright.md#artefact-retention-).
 - Unless the user explicitly says to reuse the existing setup, you MUST start once with `make deploy-fresh-purged-apps INFINITO_APPS=<roles> INFINITO_FULL_CYCLE=true` to establish the baseline inventory and clean app state. `INFINITO_FULL_CYCLE=true` adds the async update pass (pass 2) and MUST stay on unless the user explicitly asks to skip it.
 - You MUST NOT run more than one deploy command at the same time. Deployments MUST be executed serially, never in parallel.
 - To speed up debugging, you MAY pass multiple apps at once, e.g. `make deploy-fresh-purged-apps INFINITO_APPS="<roles> <roles>" INFINITO_FULL_CYCLE=true`.

docs/contributing/actions/testing/playwright.md

@@ -52,22 +52,22 @@ The `test-e2e-playwright` role discovers Playwright-enabled roles through the pr
 
 ## Artefact Retention 🎞️
 
-The runner keeps Playwright traces, screenshots, and videos for every test only when the resolved environment variable `PLAYWRIGHT_KEEP_ALL` evaluates to `true` (case-insensitive).
+The runner keeps Playwright traces, screenshots, and videos for every test only when the resolved environment variable `INFINITO_PLAYWRIGHT_KEEP` evaluates to `true` (case-insensitive).
 Any other value, including unset or empty, keeps artefacts only when a test fails.
 
 The propagation chain has four hops:
 
-1. The host environment variable `PLAYWRIGHT_KEEP_ALL` (set on the host shell, by `act --env PLAYWRIGHT_KEEP_ALL=true`, or by the GitHub Actions repository variable forwarded into each `test-deploy-*.yml` workflow as `PLAYWRIGHT_KEEP_ALL: ${{ vars.PLAYWRIGHT_KEEP_ALL }}`).
-2. `roles/test-e2e-playwright/defaults/main.yml` reads the host value into `TEST_E2E_PLAYWRIGHT_KEEP_ALL` via `lookup('env', 'PLAYWRIGHT_KEEP_ALL')`. Inventory MAY override the role variable per environment in `group_vars` or `host_vars`.
-3. `roles/test-e2e-playwright/tasks/run_one.yml` forwards the resolved value into the Playwright container as `-e PLAYWRIGHT_KEEP_ALL={{ TEST_E2E_PLAYWRIGHT_KEEP_ALL }}`.
+1. The host environment variable `INFINITO_PLAYWRIGHT_KEEP` (set on the host shell, by `act --env INFINITO_PLAYWRIGHT_KEEP=true`, or by the GitHub Actions repository variable forwarded into each `test-deploy-*.yml` workflow as `INFINITO_PLAYWRIGHT_KEEP: ${{ vars.INFINITO_PLAYWRIGHT_KEEP }}`).
+2. `roles/test-e2e-playwright/defaults/main.yml` reads the host value into `TEST_E2E_PLAYWRIGHT_KEEP` via `lookup('env', 'INFINITO_PLAYWRIGHT_KEEP')`. Inventory MAY override the role variable per environment in `group_vars` or `host_vars`.
+3. `roles/test-e2e-playwright/tasks/run_one.yml` forwards the resolved value into the Playwright container as `-e INFINITO_PLAYWRIGHT_KEEP={{ TEST_E2E_PLAYWRIGHT_KEEP }}`.
 4. `roles/test-e2e-playwright/files/playwright.config.js` switches `trace`, `screenshot`, and `video` to `on` when the container value is `true`. It otherwise leaves the failure-only defaults (`retain-on-failure` for trace and video, `only-on-failure` for screenshot).
 
 Set the variable for the contexts you need:
 
-- **Local deploy**: prefix every `make deploy-*` invocation with `PLAYWRIGHT_KEEP_ALL=true`.
-- **Local `act` runs**: append `--env PLAYWRIGHT_KEEP_ALL=true` to the `act` command.
-- **CI**: set the `PLAYWRIGHT_KEEP_ALL` repository variable. For the GitHub click path see [CI Configuration](../../tools/github/actions/configuration.md#playwright_keep_all-).
-- **Inventory pin**: set `TEST_E2E_PLAYWRIGHT_KEEP_ALL: "true"` in `group_vars` or `host_vars` of the target environment.
+- **Local deploy**: prefix every `make deploy-*` invocation with `INFINITO_PLAYWRIGHT_KEEP=true`.
+- **Local `act` runs**: append `--env INFINITO_PLAYWRIGHT_KEEP=true` to the `act` command.
+- **CI**: set the `INFINITO_PLAYWRIGHT_KEEP` repository variable. For the GitHub click path see [CI Configuration](../../tools/github/actions/configuration.md#infinito_playwright_keep-).
+- **Inventory pin**: set `TEST_E2E_PLAYWRIGHT_KEEP: "true"` in `group_vars` or `host_vars` of the target environment.
 
 | Resolved container value | Trace | Screenshot | Video |
 |---|---|---|---|

docs/contributing/tools/github/actions/configuration.md

@@ -11,7 +11,7 @@ Repository variables are set under **Settings → Secrets and variables → Acti
 | `CI_CANCEL_IN_PROGRESS` | [entry-push-latest.yml](../../../../../.github/workflows/entry-push-latest.yml) | Cancels in-progress runs on new push | `false` to keep in-progress runs alive |
 | `CI_RUN_ON_MAIN` | [entry-push-latest.yml](../../../../../.github/workflows/entry-push-latest.yml) | Pushes to `main` skip CI | `true` to run CI on `main` pushes too |
 | `CI_ENABLE_AUTO_UPDATES` | [update.yml](../../../../../.github/workflows/update.yml), [dependabot-close.yml](../../../../../.github/workflows/dependabot-close.yml) | Update jobs skipped; Dependabot PRs auto-closed | `true` to allow update PRs (workflow-driven and Dependabot) |
-| `PLAYWRIGHT_KEEP_ALL` | [test-deploy-server.yml](../../../../../.github/workflows/test-deploy-server.yml), [test-deploy-universal.yml](../../../../../.github/workflows/test-deploy-universal.yml), [test-deploy-workstation.yml](../../../../../.github/workflows/test-deploy-workstation.yml), [test-deploy-local.yml](../../../../../.github/workflows/test-deploy-local.yml) | Playwright keeps trace, screenshot and video only when a test fails | `true` to keep them for every test (passing runs included) |
+| `INFINITO_PLAYWRIGHT_KEEP` | [test-deploy-server.yml](../../../../../.github/workflows/test-deploy-server.yml), [test-deploy-universal.yml](../../../../../.github/workflows/test-deploy-universal.yml), [test-deploy-workstation.yml](../../../../../.github/workflows/test-deploy-workstation.yml), [test-deploy-local.yml](../../../../../.github/workflows/test-deploy-local.yml) | Playwright keeps trace, screenshot and video only when a test fails | `true` to keep them for every test (passing runs included) |
 
 ## `CI_CANCEL_IN_PROGRESS` 🛑
 
@@ -114,7 +114,7 @@ Dependabot cannot read repository variables itself, so [dependabot-close.yml](..
 | `true` | Run ✓ | Stay open ✓ |
 | any other value | Skipped ✓ | Auto-closed on open ✓ |
 
-## `PLAYWRIGHT_KEEP_ALL` 🎬
+## `INFINITO_PLAYWRIGHT_KEEP` 🎬
 
 Controls whether Playwright keeps trace, screenshot, and video for every test or only for failing tests across the four deploy-test workflows ([test-deploy-server.yml](../../../../../.github/workflows/test-deploy-server.yml), [test-deploy-universal.yml](../../../../../.github/workflows/test-deploy-universal.yml), [test-deploy-workstation.yml](../../../../../.github/workflows/test-deploy-workstation.yml), [test-deploy-local.yml](../../../../../.github/workflows/test-deploy-local.yml)).
 For the full propagation chain, the inventory override, and the local equivalents, see [Playwright Tests](../../../actions/testing/playwright.md#artefact-retention-).
@@ -128,7 +128,7 @@ Artefacts are retained only when a test fails.
 2. Go to **Settings → Secrets and variables → Actions**.
 3. Switch to the **Variables** tab.
 4. Click **New repository variable**.
-5. Set **Name** to `PLAYWRIGHT_KEEP_ALL` and **Value** to `true`.
+5. Set **Name** to `INFINITO_PLAYWRIGHT_KEEP` and **Value** to `true`.
 6. Save.
 
 **To disable again:**
@@ -140,7 +140,7 @@ Delete the variable or change its value to anything other than `true`.
 Each deploy-test workflow forwards the variable into its own `env:` block:
 
 ```yaml
-PLAYWRIGHT_KEEP_ALL: ${{ vars.PLAYWRIGHT_KEEP_ALL }}
+INFINITO_PLAYWRIGHT_KEEP: ${{ vars.INFINITO_PLAYWRIGHT_KEEP }}
 ```
 
 | Variable value | Behaviour |

docs/requirements/019-playwright-meta-services-parity.md

@@ -40,7 +40,7 @@ The acceptance criteria below are the mechanical translation of this contract.
 | 11 | Persona scenarios MUST FAIL LOUDLY when the persona cannot execute the contracted journey, never silently `test.skip(...)` on runtime detection of "no logout button" / "no authenticated surface" / "no admin UI marker". A silent skip hides real regressions (broken OIDC mapping, removed logout button, misconfigured oauth2-proxy, drifted UI selectors) behind a green deploy. The ONLY clean-skip mechanism is an EXPLICIT env opt-out declared by the role: `PERSONA_BIBER_BLOCKED=true` / `PERSONA_ADMINISTRATOR_BLOCKED=true` / `PERSONA_GUEST_BLOCKED=true` rendered in `templates/playwright.env.j2`, with a documented rationale in the role's README or TODO. Without the flag the persona helper hard-fails the test. | [test_strict_mode.py](../../tests/lint/ansible/roles/web-app/playwright/persona/test_strict_mode.py) (`test_persona_skips_only_via_explicit_opt_out`) + persona-helper bodies in `roles/test-e2e-playwright/files/personas/{biber,admin,guest}.js` |
 | 12 | Direct-probe deny-checks at prometheus / matomo MUST validate the response body, not only the status code. A `200 OK` is acceptable ONLY when the body contains role-specific markers proving the response is the genuine provider surface (e.g. `prometheus_build_info`, `<title>Prometheus</title>` for prometheus; matomo's login-form markers / `piwik` or `matomo` for matomo). Any 200 with a non-matching body is treated as a misconfigured proxy or a denial-as-200 surface and fails loudly. | [test_strict_mode.py](../../tests/lint/ansible/roles/web-app/playwright/persona/test_strict_mode.py) (`test_deny_helpers_validate_body_on_200`) + bodies in `roles/web-app-prometheus/files/playwright/playwright.spec.js` and `roles/web-app-matomo/files/playwright/playwright.spec.js` (per Rule 13: provider-owned SPOT) |
 | 13 | **SPOT-owned cross-service assertions.** Dashboard tile reachability, prometheus scrape parity, and matomo tracker presence are owned by the provider's own spec, not duplicated across consumer roles. Each provider's `templates/playwright.env.j2` renders a `<NAME>_TARGET_ROLES_JSON` manifest via the `lookup('roles_with_service', '<svc>')` Ansible lookup ([plugins/lookup/roles_with_service.py](../../plugins/lookup/roles_with_service.py)), enumerating every role whose merged applications config declares the service with both `enabled` and `shared` truthy and whose role exposes a canonical domain. The provider's `files/playwright/playwright.spec.js` parameterises one assertion per consumer over that manifest. The shared persona helpers (`runBiberFlow`, `runAdminFlow`) consequently no longer drive cross-service probes; they exercise the role under test only. | provider specs `roles/web-app-{dashboard,prometheus,matomo}/files/playwright/playwright.spec.js` and the `roles_with_service` lookup |
-| 14 | **Post-deploy log inspection.** After every deploy cycle the agent MUST inspect the Playwright logs (`list` reporter, `playwright-report/index.html`, `test-results/<test>/error-context.md`, plus the trace / video captured under `PLAYWRIGHT_KEEP_ALL=true`) and verify both (a) the intended per-persona and per-service behavior is really wired into the role's `files/playwright/playwright.spec.js`, and (b) every wired assertion was actually executed by Playwright. A green exit alone is NOT sufficient evidence: a silent `test.skip(...)`, a scenario that exits before the role-specific interaction fires, or a `<NAME>_SERVICE_ENABLED=true` gate whose body never ran all violate this rule. Gaps MUST be closed by extending the spec to cover the missing behavior; existing assertions stay per [Preserving existing tests](#preserving-existing-tests), and removal is permitted only when the deleted assertion is demonstrably faulty. | review (this requirement) + log inspection per [Playwright Spec Loop](../agents/action/iteration/playwright.md#procedure) step 4 |
+| 14 | **Post-deploy log inspection.** After every deploy cycle the agent MUST inspect the Playwright logs (`list` reporter, `playwright-report/index.html`, `test-results/<test>/error-context.md`, plus the trace / video captured under `INFINITO_PLAYWRIGHT_KEEP=true`) and verify both (a) the intended per-persona and per-service behavior is really wired into the role's `files/playwright/playwright.spec.js`, and (b) every wired assertion was actually executed by Playwright. A green exit alone is NOT sufficient evidence: a silent `test.skip(...)`, a scenario that exits before the role-specific interaction fires, or a `<NAME>_SERVICE_ENABLED=true` gate whose body never ran all violate this rule. Gaps MUST be closed by extending the spec to cover the missing behavior; existing assertions stay per [Preserving existing tests](#preserving-existing-tests), and removal is permitted only when the deleted assertion is demonstrably faulty. | review (this requirement) + log inspection per [Playwright Spec Loop](../agents/action/iteration/playwright.md#procedure) step 4 |
 
 ## Per-service scenario catalogue
 
@@ -200,7 +200,7 @@ For each role in the [Iteration order](#iteration-order) below:
    Variants edits MUST keep `make test` green; the next `make test` invocation (which runs before the next deploy or redeploy per step 1) is the gate, not a per-test re-run.
    Variants edits are part of the same role-closure scope and do NOT trigger a separate commit.
 6. **Inspect the Playwright logs after every deploy cycle for this role** per [Rule 14](#rules), even when the deploy and the spec both exit `0`.
-   The agent MUST confirm via the `list` reporter, `playwright-report/index.html`, and the trace / video captured under `PLAYWRIGHT_KEEP_ALL=true` (set per [Role Loop](../agents/action/iteration/role.md)) that:
+   The agent MUST confirm via the `list` reporter, `playwright-report/index.html`, and the trace / video captured under `INFINITO_PLAYWRIGHT_KEEP=true` (set per [Role Loop](../agents/action/iteration/role.md)) that:
    - the spec really wires the persona and per-service assertions the role's `meta/services.yml` declares (no contract gap silently masked by absence of a gated step), AND
    - every wired assertion actually executed (no silent `test.skip(...)`, no scenario that exited before the role-specific interaction fired, no `<NAME>_SERVICE_ENABLED=true` gate whose body never ran).
    When the inspection surfaces a gap, the agent MUST extend the spec until the missing behavior is both wired AND executed.

env/default.env

@@ -41,7 +41,7 @@ INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE=/var/cache/infinito/core/cache/package/f
 INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR=/var/cache/infinito/core/cache/package/frontend/certs
 
 # Init image used by the package-cache frontend cert-gen wrapper to run cert-gen.sh.
-INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE=alpine:3.20
+INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE=alpine:latest
 
 # Static IPv4 address the package-cache frontend takes on the docker bridge.
 INFINITO_CACHE_PACKAGE_FRONTEND_IP=172.30.0.4
@@ -118,6 +118,9 @@ INFINITO_IMAGE_TAG=latest
 # Repo-relative path to the Ansible vars file `infinito administration inventory provision --vars-file <...>` consumes.
 INFINITO_INVENTORY_VARS_FILE=inventories/development/default.yml
 
+# IPv6 loopback / public address the playbook's `internet` network defaults to when no host_var pin is set.
+INFINITO_IP6=::1
+
 # True when /proc/version identifies the host as WSL2; generator overrides via runtime detection.
 INFINITO_IS_WSL2=false
 
@@ -136,6 +139,12 @@ INFINITO_MEM_LIMIT=0
 # MTU of the compose stack's bridge network; 1500 matches most hosts.
 INFINITO_OUTER_NETWORK_MTU=1500
 
+# Base image (pkgmgr container) the Dockerfile inherits from. scripts/image/build.sh overrides this per-distro / per-variant at build time.
+INFINITO_PARENT_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch:stable
+
+# `true` keeps Playwright trace, screenshot, and video for every test; default `false` retains them only on failure.
+INFINITO_PLAYWRIGHT_KEEP=false
+
 # Docker pull policy compose applies; generator overrides to `always` on GHA.
 INFINITO_PULL_POLICY=never
 

group_vars/all/00_general.yml

@@ -38,7 +38,7 @@ WWW_REDIRECT_ENABLED: "{{ ('web-opt-rdr-www' in group_names) | bool }}"
 AUTO_BUILD_ALIASES: false # If enabled it creates an alias domain for each web application by the entity name, recommended to set to false to safe domain space
 
 # Domain
-DOMAIN_PRIMARY: "{{ lookup('env', 'DOMAIN') | default('infinito.localhost', true) }}" # Primary Domain of the server
+DOMAIN_PRIMARY: "{{ lookup('env', 'INFINITO_DOMAIN') | default('infinito.localhost', true) }}" # Primary Domain of the server
 DOMAIN_TEST: "test.{{ DOMAIN_PRIMARY }}"
 DOMAIN_HOMEPAGE: "{{ lookup('domain','web-app-dashboard') if 'web-app-dashboard' in group_names else SOFTWARE_DOMAIN }}"
 

group_vars/all/08_networks.yml

@@ -53,9 +53,9 @@ NETWORK_DOCKER_EMBEDDED_DNS_RESOLVER: "127.0.0.11" # nocheck: hardcoded-dns-reso
 NETWORK_DOCKER_DNS_NGINX_DIRECTIVE: "resolver {{ NETWORK_DOCKER_EMBEDDED_DNS_RESOLVER }} valid=30s ipv6={{ NETWORK_IPV6_ENABLED | on_off }};"
 defaults_networks:
   internet:
-    ip4: "{{ lookup('env', 'IP4') | default('127.0.0.1', true) }}"
-    ip6: "{{ lookup('env', 'IP6') | default('::1', true) }}"
-    dns: "{{ lookup('env', 'DNS_IP') | default('') }}"
+    ip4: "{{ lookup('env', 'INFINITO_IP4') | default('127.0.0.1', true) }}"
+    ip6: "{{ lookup('env', 'INFINITO_IP6') | default('::1', true) }}"
+    dns: "{{ lookup('env', 'INFINITO_DNS_IP') | default('') }}"
 PORT_BANDS: # nocheck: unused-var  # consumed by the port-allocation plugin outside the YAML/Jinja scope
   local:
     http:

roles/test-e2e-playwright/defaults/main.yml

@@ -20,7 +20,7 @@ TEST_E2E_PLAYWRIGHT_WAIT_DELAY: 5
 TEST_E2E_PLAYWRIGHT_ONLY_ROLES: "{{ lookup('status').groups }}"
 TEST_E2E_PLAYWRIGHT_SKIP_ROLES: [] # e.g. ["svc-something"]
 
-TEST_E2E_PLAYWRIGHT_KEEP_ALL: "{{ lookup('env', 'PLAYWRIGHT_KEEP_ALL') }}"
+TEST_E2E_PLAYWRIGHT_KEEP: "{{ lookup('env', 'INFINITO_PLAYWRIGHT_KEEP') }}"
 
 # 0-based matrix-deploy round id. Pushed as an Ansible extra var by
 # `cli/administration/deploy/development/deploy.py` when the matrix

roles/test-e2e-playwright/files/playwright.config.js

@@ -2,7 +2,7 @@ const { defineConfig } = require("@playwright/test");
 
 const baseURL = process.env.APP_BASE_URL || "http://127.0.0.1";
 
-const keepAll = (process.env.PLAYWRIGHT_KEEP_ALL || "").toLowerCase() === "true";
+const keepAll = (process.env.INFINITO_PLAYWRIGHT_KEEP || "").toLowerCase() === "true";
 
 module.exports = defineConfig({
   testDir: "./tests",

roles/test-e2e-playwright/tasks/run_one.yml

@@ -257,7 +257,7 @@
       - --env-file
       - "{{ _playwright_stage_dir }}/.env"
       - -e
-      - "PLAYWRIGHT_KEEP_ALL={{ TEST_E2E_PLAYWRIGHT_KEEP_ALL }}"
+      - "INFINITO_PLAYWRIGHT_KEEP={{ TEST_E2E_PLAYWRIGHT_KEEP }}"
       - -v
       - "{{ _playwright_stage_dir }}:/e2e"
       - -v
@@ -303,6 +303,6 @@
   ansible.builtin.script: >-
     {{ role_path }}/files/archive_playwright_reports.sh
     {{ _playwright_reports_dir | quote }}
-    {{ VARIANT_INDEX | default(0) | int }}
+    {{ VARIANT_INDEX | int }}
     {{ ASYNC_ENABLED | bool | string | lower }}
   changed_when: true

scripts/container/purge/apps.sh

@@ -12,10 +12,11 @@
 #
 # Designed to be invoked from the host via:
 #   docker exec -e INFINITO_APPS="${INFINITO_APPS}" <container> \
-#     bash /opt/src/infinito/scripts/container/purge/apps.sh  # nocheck: self-path-reference
+#     bash ${INFINITO_SRC_DIR}/scripts/container/purge/apps.sh  # nocheck: self-path-reference
 
 set -euo pipefail
-cd /opt/src/infinito
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
+cd "${INFINITO_SRC_DIR}"
 
 : "${INFINITO_APPS:?INFINITO_APPS is not set (e.g. INFINITO_APPS=web-app-nextcloud)}"
 

scripts/container/purge/entity/nginx.sh

@@ -28,7 +28,8 @@ if [[ "$#" -lt 1 ]]; then
 	exit 2
 fi
 
-cd /opt/src/infinito
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
+cd "${INFINITO_SRC_DIR}"
 
 if [[ -f "scripts/meta/env/load.sh" ]]; then
 	# shellcheck source=scripts/meta/env/load.sh

scripts/docker/entry.sh

@@ -12,7 +12,8 @@ echo "[docker-infinito] before pkgmgr path"
 INFINITO_PATH="$(pkgmgr path infinito)"
 echo "[docker-infinito] after pkgmgr path: ${INFINITO_PATH}" # nocheck: container-bootstrap
 
-INFINITO_SRC_DIR="/opt/src/infinito"
+# INFINITO_SRC_DIR is provided by compose / Dockerfile ENV. Assert strictly.
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
 export INFINITO_PATH
 export INFINITO_SRC_DIR
 

scripts/image/build.sh

@@ -260,7 +260,7 @@ echo "------------------------------------------------------------"
 
 # Common build args
 build_args=(
-	--build-arg "PKGMGR_IMAGE=${PKGMGR_IMAGE}"
+	--build-arg "INFINITO_PARENT_IMAGE=${PKGMGR_IMAGE}"
 	--build-arg "NIX_CONFIG=${NIX_CONFIG:-}"
 )
 

scripts/image/push.sh

@@ -30,7 +30,7 @@ while true; do
 		--push \
 		--tag "ghcr.io/${ghcr_owner}/${repo_name}/${MATRIX_DISTRO}:${IMAGE_TAG}" \
 		--label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
-		--build-arg "PKGMGR_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-${MATRIX_DISTRO}:stable" \
+		--build-arg "INFINITO_PARENT_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-${MATRIX_DISTRO}:stable" \
 		"${nix_arg[@]}" \
 		--cache-from "type=gha,scope=${repo_name}-${MATRIX_DISTRO}" \
 		--cache-to "type=gha,mode=max,scope=${repo_name}-${MATRIX_DISTRO}" \

scripts/tests/deploy/local/deploy/fresh-kept-all.sh

@@ -113,7 +113,7 @@ deploy_with_cache_retry "fresh-kept-all" -- \
 	--env "APPS_COUNT=${apps_count}" \
 	--env "INFINITO_LIMIT_HOST=${INFINITO_LIMIT_HOST}" \
 	--env "RUNTIME_VARS_JSON=${RUNTIME_VARS_JSON}" \
-	-- bash /opt/src/infinito/scripts/tests/deploy/local/utils/fresh-kept-all-init-and-deploy.sh
+	-- bash "${INFINITO_SRC_DIR}/scripts/tests/deploy/local/utils/fresh-kept-all-init-and-deploy.sh"
 
 echo
 echo "=== local full deploy finished ==="

scripts/tests/deploy/local/deploy/fresh-kept-app.sh

@@ -103,7 +103,7 @@ echo ">>> Ensuring development stack is up (when-down)"
 
 echo ">>> Running entry.sh bootstrap inside container"
 "${PYTHON}" -m cli.administration.deploy.development exec \
-	-- bash /opt/src/infinito/scripts/tests/deploy/local/utils/entry-bootstrap.sh
+	-- bash "${INFINITO_SRC_DIR}/scripts/tests/deploy/local/utils/entry-bootstrap.sh"
 
 echo ">>> Creating inventory for app '${INFINITO_APPS}'"
 # RUNTIME MUST be `dev` here: the host process running this script lives

scripts/tests/deploy/local/deploy/fresh-purged-app.sh

@@ -54,7 +54,7 @@ INFINITO_APPS='matomo' scripts/tests/deploy/local/purge/entity.sh
 
 echo ">>> Running entry.sh inside container"
 "${PYTHON}" -m cli.administration.deploy.development exec \
-	-- bash /opt/src/infinito/scripts/tests/deploy/local/utils/entry-bootstrap.sh
+	-- bash "${INFINITO_SRC_DIR}/scripts/tests/deploy/local/utils/entry-bootstrap.sh"
 
 deploy_args=(
 	--apps "${INFINITO_APPS}"

scripts/tests/deploy/local/deploy/reuse-kept-all.sh

@@ -98,7 +98,7 @@ deploy_with_cache_retry "reuse-all" -- \
 	--env "INFINITO_INVENTORY_PASSWORD_FILE=${pw_file}" \
 	--env "INFINITO_LIMIT_HOST=${INFINITO_LIMIT_HOST}" \
 	--env "INFINITO_DEBUG=${INFINITO_DEBUG}" \
-	-- bash /opt/src/infinito/scripts/tests/deploy/local/utils/reuse-kept-all-deploy.sh
+	-- bash "${INFINITO_SRC_DIR}/scripts/tests/deploy/local/utils/reuse-kept-all-deploy.sh"
 
 echo
 echo "✅ Local run finished."

scripts/tests/deploy/local/deploy/reuse-kept-app.sh

@@ -61,4 +61,4 @@ deploy_with_cache_retry "reuse-${INFINITO_APPS//[^A-Za-z0-9._-]/-}" -- \
 	-e INFINITO_APPS="${INFINITO_APPS}" \
 	-e INFINITO_DEBUG="${INFINITO_DEBUG}" \
 	"${INFINITO_CONTAINER}" \
-	bash /opt/src/infinito/scripts/tests/deploy/local/utils/reuse-kept-app-deploy.sh
+	bash "${INFINITO_SRC_DIR}/scripts/tests/deploy/local/utils/reuse-kept-app-deploy.sh"

scripts/tests/deploy/local/exec/container.sh

@@ -70,11 +70,11 @@ if [[ $# -gt 0 ]]; then
 		usage
 		exit 2
 	fi
-	exec docker exec "${docker_exec_flags[@]}" -w /opt/src/infinito "${container}" "$@"
+	exec docker exec "${docker_exec_flags[@]}" -w "${INFINITO_SRC_DIR}" "${container}" "$@"
 fi
 
 if [[ -n "${INFINITO_CMD:-}" ]]; then
-	exec docker exec "${docker_exec_flags[@]}" -w /opt/src/infinito "${container}" sh -lc "${INFINITO_CMD}"
+	exec docker exec "${docker_exec_flags[@]}" -w "${INFINITO_SRC_DIR}" "${container}" sh -lc "${INFINITO_CMD}"
 fi
 
-exec docker exec "${docker_exec_flags[@]}" -w /opt/src/infinito "${container}" sh
+exec docker exec "${docker_exec_flags[@]}" -w "${INFINITO_SRC_DIR}" "${container}" sh

scripts/tests/deploy/local/purge/entity.sh

@@ -19,5 +19,7 @@ set -euo pipefail
 
 echo "=== local cleanup: INFINITO_APPS=${INFINITO_APPS} container=${INFINITO_CONTAINER} ==="
 
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR is not set; source scripts/meta/env/load.sh}"
+
 docker exec -e INFINITO_APPS="${INFINITO_APPS}" "${INFINITO_CONTAINER}" \
-	bash /opt/src/infinito/scripts/container/purge/apps.sh
+	bash "${INFINITO_SRC_DIR}/scripts/container/purge/apps.sh"

scripts/tests/deploy/local/purge/web.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR is not set; source scripts/meta/env/load.sh}"
+
 docker exec "${INFINITO_CONTAINER}" bash -lc "
   echo \">>> Cleaning up Nginx configuration files\"
-  bash /opt/src/infinito/scripts/container/purge/web.sh || true
+  bash ${INFINITO_SRC_DIR}/scripts/container/purge/web.sh || true
 "

scripts/tests/deploy/local/reset/inventory.sh

@@ -76,7 +76,7 @@ echo ">>> Initializing inventory inside container"
 	-- \
 	bash -c "
     set -euo pipefail
-    cd /opt/src/infinito
+    cd \"${INFINITO_SRC_DIR}\"
 
     echo '>>> entry.sh bootstrap'
     ./scripts/docker/entry.sh true

scripts/tests/deploy/local/utils/entry-bootstrap.sh

@@ -3,7 +3,8 @@
 #
 # Designed to be called via `docker exec` or
 # `cli.administration.deploy.development exec -- bash <this-path>`. The repo is mounted
-# at /opt/src/infinito by the dev compose stack.
+# at ${INFINITO_SRC_DIR} by the dev compose stack.
 set -euo pipefail
-cd /opt/src/infinito
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
+cd "${INFINITO_SRC_DIR}"
 ./scripts/docker/entry.sh true

scripts/tests/deploy/local/utils/fresh-kept-all-init-and-deploy.sh

@@ -6,7 +6,7 @@
 # `cli.administration.deploy.development exec --env KEY=VAL`, which injects the env-vars
 # asserted below. Performs entry bootstrap, creates the inventory and
 # runs the dedicated deploy in one in-container session. The repo is
-# mounted at /opt/src/infinito by the dev compose stack.
+# mounted at ${INFINITO_SRC_DIR} by the dev compose stack.
 #
 # Required env:
 #   INFINITO_INVENTORY_DIR    absolute base inventory dir (no trailing slash)
@@ -15,9 +15,11 @@
 #   APPS_CSV                  comma-separated app id list for `--include`
 #   APPS_COUNT                length of APPS_CSV (echoed for log clarity)
 #   INFINITO_LIMIT_HOST       Ansible host (typically "localhost")
+#   INFINITO_SRC_DIR          absolute path to the bind-mounted repo root in the container
 #   RUNTIME_VARS_JSON         JSON object passed verbatim to `--vars`
 set -euo pipefail
-cd /opt/src/infinito
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
+cd "${INFINITO_SRC_DIR}"
 
 : "${INFINITO_INVENTORY_DIR:?INFINITO_INVENTORY_DIR must be set}"
 : "${INFINITO_INVENTORY_FILE:?INFINITO_INVENTORY_FILE must be set}"
@@ -56,7 +58,7 @@ echo ">>> Deploying against ${INFINITO_INVENTORY_FILE}"
 infinito administration deploy dedicated "${INFINITO_INVENTORY_FILE}" \
 	--skip-backup \
 	--debug \
-	--log /opt/src/infinito/logs \
+	--log "${INFINITO_SRC_DIR}/logs" \
 	-l "${INFINITO_LIMIT_HOST}" \
 	--diff \
 	-vv \

scripts/tests/deploy/local/utils/reuse-kept-all-deploy.sh

@@ -4,7 +4,7 @@
 # Called from the host wrapper at
 # scripts/tests/deploy/local/deploy/reuse-kept-all.sh via
 # `cli.administration.deploy.development exec --env KEY=VAL`, which injects the env-vars
-# asserted below. The repo is mounted at /opt/src/infinito by the dev
+# asserted below. The repo is mounted at ${INFINITO_SRC_DIR} by the dev
 # compose stack.
 #
 # Required env:
@@ -12,8 +12,10 @@
 #   INFINITO_INVENTORY_PASSWORD_FILE                   absolute path to <inv>/.password
 #   INFINITO_LIMIT_HOST       Ansible limit (typically "localhost")
 #   INFINITO_DEBUG            "true"|"false" — appends `--debug` when true
+#   INFINITO_SRC_DIR          absolute path to the bind-mounted repo root in the container
 set -euo pipefail
-cd /opt/src/infinito
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
+cd "${INFINITO_SRC_DIR}"
 
 : "${INFINITO_INVENTORY_FILE:?INFINITO_INVENTORY_FILE must be set}"
 : "${INFINITO_INVENTORY_PASSWORD_FILE:?INFINITO_INVENTORY_PASSWORD_FILE must be set}" # nocheck: driver-injected-per-invocation

scripts/tests/deploy/local/utils/reuse-kept-app-deploy.sh

@@ -4,14 +4,16 @@
 # Called from the host wrapper at
 # scripts/tests/deploy/local/deploy/reuse-kept-app.sh via `docker exec`,
 # which is responsible for injecting the env-vars asserted below. The
-# repo is mounted at /opt/src/infinito by the dev compose stack.
+# repo is mounted at ${INFINITO_SRC_DIR} by the dev compose stack.
 #
 # Required env:
 #   INFINITO_INVENTORY_FILE   absolute path to <inv>/devices.yml
 #   INFINITO_APPS    space-separated app id list for `--id`
 #   INFINITO_DEBUG   "true"|"false" — appends `--debug` when true
+#   INFINITO_SRC_DIR absolute path to the bind-mounted repo root in the container
 set -euo pipefail
-cd /opt/src/infinito
+: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
+cd "${INFINITO_SRC_DIR}"
 
 : "${INFINITO_INVENTORY_FILE:?INFINITO_INVENTORY_FILE must be set}"
 : "${INFINITO_APPS:?INFINITO_APPS must be set}"

tests/lint/ansible/roles/web-app/playwright/test_spec_env_keys_declared.py

@@ -51,15 +51,15 @@ _ENV_REF_RE = re.compile(
 # * Playwright runner: PLAYWRIGHT_*, PW_*, CI, DEBUG.
 # * Test-harness flags injected by the deploy task (see
 #   `roles/test-e2e-playwright/tasks/run_one.yml`, e.g.
-#   `PLAYWRIGHT_KEEP_ALL`).
+#   `INFINITO_PLAYWRIGHT_KEEP`).
 _RUNTIME_ENV_NAMES: frozenset[str] = frozenset(
     {
         "CI",
         "DEBUG",
+        "INFINITO_PLAYWRIGHT_KEEP",
         "NODE_DEBUG",
         "NODE_ENV",
         "NODE_TLS_REJECT_UNAUTHORIZED",
-        "PLAYWRIGHT_KEEP_ALL",
         "PLAYWRIGHT_BROWSERS_PATH",
         "PLAYWRIGHT_HTML_REPORT",
         "PLAYWRIGHT_JSON_REPORT",

utils/env/handlers/passthrough.py

@@ -30,7 +30,10 @@ STATIC_KEYS = (
     "INFINITO_WAIT_HEALTH_TIMEOUT_S",
     "INFINITO_DOCKER_VOLUME",
     "INFINITO_DOCKER_MOUNT",
+    "INFINITO_IP6",
     "INFINITO_OUTER_NETWORK_MTU",
+    "INFINITO_PARENT_IMAGE",
+    "INFINITO_PLAYWRIGHT_KEEP",
     "INFINITO_TEST_DEPLOY_TYPE",
     "INFINITO_TEST_PATTERN",
     "INFINITO_TEST_RUNNER",