diff --git a/plugins/filter/seaweedfs.py b/plugins/filter/seaweedfs.py index 3e39167391..bd5440616a 100644 --- a/plugins/filter/seaweedfs.py +++ b/plugins/filter/seaweedfs.py @@ -92,7 +92,9 @@ def seaweedfs_sidecar_script(bucket, s3_port, access_key, secret_key): The ``s3.configure`` grant is required since SeaweedFS 4.39: a server started without an ``-s3.config`` has zero identities, and ListBuckets then returns an empty list to the consumer's access key, so the consumer - reads the bucket as missing even though it exists. + reads the bucket as missing even though it exists. ``WriteAcp`` is + required since SeaweedFS 4.49: a PutObject carrying ``x-amz-acl`` is + also authorized as s3:PutObjectAcl and answers AccessDenied without it. Args: bucket: consumer bucket name created idempotently at startup. @@ -104,7 +106,7 @@ def seaweedfs_sidecar_script(bucket, s3_port, access_key, secret_key): grant = ( f"s3.configure -user {bucket} -access_key {access_key} " f"-secret_key {secret_key} -buckets {bucket} " - f"-actions Read,Write,List,Tagging -apply" + f"-actions Read,Write,WriteAcp,List,Tagging -apply" ) return ( f"(until wget -q -O /dev/null http://127.0.0.1:{s3_port}/status; do sleep 2; done; " diff --git a/roles/web-app-checkmk/meta/services.yml b/roles/web-app-checkmk/meta/services.yml index 7790cd70ba..7e36215ffc 100644 --- a/roles/web-app-checkmk/meta/services.yml +++ b/roles/web-app-checkmk/meta/services.yml @@ -71,7 +71,7 @@ checkmk: pids_limit: 2048 min_storage: 1053MB image: checkmk/check-mk-raw - version: "2.4.0p38" + version: "2.4.0p39" backup: no_stop_required: true name: checkmk diff --git a/roles/web-app-matrix/meta/services.yml b/roles/web-app-matrix/meta/services.yml index 841de75aec..1b9c8afaa6 100644 --- a/roles/web-app-matrix/meta/services.yml +++ b/roles/web-app-matrix/meta/services.yml @@ -80,7 +80,7 @@ postgres: synapse: healthcheck: flavor: curl - version: v1.163.2 + version: v1.164.0 image: matrixdotorg/synapse name: matrix-synapse backup: @@ -103,7 +103,7 @@ synapse: element: healthcheck: flavor: wget - version: v1.12.32 + version: v1.12.33 image: vectorim/element-web name: matrix-element ports: diff --git a/roles/web-app-n8n/meta/services.yml b/roles/web-app-n8n/meta/services.yml index 078823fdfc..cb068ec35d 100644 --- a/roles/web-app-n8n/meta/services.yml +++ b/roles/web-app-n8n/meta/services.yml @@ -67,7 +67,7 @@ n8n: backup: no_stop_required: false image: docker.n8n.io/n8nio/n8n - version: "2.45.4" + version: "3.0.0" update: type: registry_tags image: docker.n8n.io/n8nio/n8n diff --git a/roles/web-app-nextcloud/meta/services.yml b/roles/web-app-nextcloud/meta/services.yml index 1e35ea097a..eabc21d99a 100644 --- a/roles/web-app-nextcloud/meta/services.yml +++ b/roles/web-app-nextcloud/meta/services.yml @@ -155,7 +155,7 @@ context_agent: internal: http: 23000 healthcheck: - flavor: curl + flavor: http_status path: heartbeat # nocheck: healthcheck-timing-override a sidecar of a stack whose main service alone takes minutes; the value predates this default and has not been measured against it start_period: 20m diff --git a/roles/web-app-openbao/meta/services.yml b/roles/web-app-openbao/meta/services.yml index 53108ab4cb..8f8a9e2276 100644 --- a/roles/web-app-openbao/meta/services.yml +++ b/roles/web-app-openbao/meta/services.yml @@ -77,7 +77,7 @@ openbao: # nocheck: dynamic-flag build-stage image, not group-gated auth-ldap: image: ghcr.io/openbao/openbao-plugin-auth-ldap - version: "v0.1.0" + version: "v0.2.0" enabled: false # nocheck: playwright-service-flag diff --git a/roles/web-app-seaweedfs/README.md b/roles/web-app-seaweedfs/README.md index d08b59d997..1c94a2eb09 100644 --- a/roles/web-app-seaweedfs/README.md +++ b/roles/web-app-seaweedfs/README.md @@ -16,7 +16,7 @@ The role serves three canonical domains: - `filer.seaweedfs.s3.*` serves the filer web UI behind an admin-only oauth2-proxy. - `master.seaweedfs.s3.*` serves the master web UI behind the same admin-only oauth2-proxy. -Per-consumer S3 identities are rendered into `s3.json`: each consuming role receives an access key and bucket-scoped `Read`, `Write`, `List`, and `Tagging` actions, and consumers marked `public` additionally receive anonymous read on their bucket. +Per-consumer S3 identities are rendered into `s3.json`: each consuming role receives an access key and bucket-scoped `Read`, `Write`, `WriteAcp`, `List`, and `Tagging` actions, and consumers marked `public` additionally receive anonymous read on their bucket. Consumer buckets are created through `weed shell` when a consumer role requests provisioning. The bucket of every consumer not marked `public` carries a bucket policy statement `DenyAnonymousRead` that denies all unsigned reads, so a `public-read` ACL set by an app never exposes an object; signed and presigned requests are unaffected. Every deploy of this role converges that statement on all existing consumer buckets, adding it to private buckets and removing it from public ones, and a consumer's provisioning applies it right after creating the bucket. diff --git a/roles/web-app-seaweedfs/templates/s3.json.j2 b/roles/web-app-seaweedfs/templates/s3.json.j2 index 7fbfaccbf0..4027d5044c 100644 --- a/roles/web-app-seaweedfs/templates/s3.json.j2 +++ b/roles/web-app-seaweedfs/templates/s3.json.j2 @@ -13,6 +13,7 @@ "actions": [ "Read:" ~ objstore.bucket, "Write:" ~ objstore.bucket, + "WriteAcp:" ~ objstore.bucket, "List:" ~ objstore.bucket, "Tagging:" ~ objstore.bucket ] diff --git a/tests/unit/python/plugins/filter/test_seaweedfs.py b/tests/unit/python/plugins/filter/test_seaweedfs.py index e6f669f179..df539149c3 100644 --- a/tests/unit/python/plugins/filter/test_seaweedfs.py +++ b/tests/unit/python/plugins/filter/test_seaweedfs.py @@ -139,7 +139,7 @@ class TestSeaweedfsSidecarScriptFilter(unittest.TestCase): self.assertLess(create, grant) self.assertIn("-access_key AKID", script) self.assertIn("-secret_key SEC", script) - self.assertIn("-actions Read,Write,List,Tagging", script) + self.assertIn("-actions Read,Write,WriteAcp,List,Tagging", script) def test_keeps_server_in_foreground(self): script = seaweedfs_sidecar_script("app", 8333, "AK", "SK")