Added auto snippet for webserver injection

roles/sys-srv-web-inj-compose/filter_plugins/inj_snippets.py

@@ -0,0 +1,56 @@
+# roles/sys-srv-web-inj-compose/filter_plugins/inj_snippets.py
+"""
+Jinja filter: `inj_features(kind)` filters a list of features to only those
+that actually provide the corresponding snippet template file.
+
+- kind='head' -> roles/sys-srv-web-inj-<feature>/templates/head_sub.j2
+- kind='body' -> roles/sys-srv-web-inj-<feature>/templates/body_sub.j2
+
+If the feature's role directory (roles/sys-srv-web-inj-<feature>) does not
+exist, this filter raises FileNotFoundError.
+
+Usage in a template:
+    {% set head_features = SRV_WEB_INJ_COMP_FEATURES_ALL | inj_features('head') %}
+    {% set body_features = SRV_WEB_INJ_COMP_FEATURES_ALL | inj_features('body') %}
+"""
+
+import os
+
+# This file lives at: roles/sys-srv-web-inj-compose/filter_plugins/inj_snippets.py
+_THIS_DIR = os.path.dirname(__file__)
+_ROLE_DIR = os.path.abspath(os.path.join(_THIS_DIR, ".."))   # roles/sys-srv-web-inj-compose
+_ROLES_DIR = os.path.abspath(os.path.join(_ROLE_DIR, ".."))  # roles
+
+def _feature_role_dir(feature: str) -> str:
+    return os.path.join(_ROLES_DIR, f"sys-srv-web-inj-{feature}")
+
+def _has_snippet(feature: str, kind: str) -> bool:
+    if kind not in ("head", "body"):
+        raise ValueError("kind must be 'head' or 'body'")
+
+    role_dir = _feature_role_dir(feature)
+    if not os.path.isdir(role_dir):
+        raise FileNotFoundError(
+            f"[inj_snippets] Expected role directory not found for feature "
+            f"'{feature}': {role_dir}"
+        )
+
+    path = os.path.join(role_dir, "templates", f"{kind}_sub.j2")
+    return os.path.exists(path)
+
+def inj_features_filter(features, kind: str = "head"):
+    if not isinstance(features, (list, tuple)):
+        return []
+    # Validation + filtering in one pass; will raise if a role dir is missing.
+    valid = []
+    for f in features:
+        name = str(f)
+        if _has_snippet(name, kind):
+            valid.append(name)
+    return valid
+
+class FilterModule(object):
+    def filters(self):
+        return {
+            "inj_features": inj_features_filter,
+        }

roles/sys-srv-web-inj-compose/tasks/main.yml

@@ -39,6 +39,8 @@
 - name: Reinitialize 'inj_enabled' for '{{ domain }}', after modification by CDN
   set_fact:
     inj_enabled: "{{ applications | inj_enabled(application_id, SRV_WEB_INJ_COMP_FEATURES_ALL) }}"
+    inj_head_features: "{{ SRV_WEB_INJ_COMP_FEATURES_ALL | inj_features('head') }}"
+    inj_body_features: "{{ SRV_WEB_INJ_COMP_FEATURES_ALL | inj_features('body') }}"
 
 - name: "Activate Corporate CSS for '{{ domain }}'"
   include_role:

roles/sys-srv-web-inj-compose/templates/location.lua.j2

@@ -1,15 +1,10 @@
+{# roles/sys-srv-web-inj-compose/templates/location.lua.j2 #}
 {% macro push_snippets(list_name, features) -%}
-{% for f in features -%}
+{% set kind = list_name | regex_replace('_snippets$','') %}
-{% if inj_enabled.get(f) -%}
+{% for f in features if inj_enabled.get(f) -%}
 {{ list_name }}[#{{ list_name }} + 1] = [=[
-  {%- include
+  {%- include 'roles/sys-srv-web-inj-' ~ f ~ '/templates/' ~ kind ~ '_sub.j2' -%}
-     'roles/sys-srv-web-inj-' ~ f ~
-     '/templates/' ~
-     ('head' if list_name == 'head_snippets' else 'body') ~
-     '_sub.j2'
-  -%}
 ]=]
-{% endif -%}
 {% endfor -%}
 {%- endmacro %}
 
@@ -48,7 +43,7 @@ body_filter_by_lua_block {
     local whole = table.concat(ngx.ctx.buf)
     ngx.ctx.buf = nil  -- clear buffer
 
-    -- remove html CSP, due to management via infinito nexus policies
+    -- remove html CSP, due to management via Infinito.Nexus policies
     whole = whole:gsub(
         '<meta[^>]-http%-equiv=["\']Content%-Security%-Policy["\'][^>]->%s*',
         ''
@@ -57,20 +52,20 @@ body_filter_by_lua_block {
     -- build a list of head-injection snippets
     local head_snippets = {}
 
-    {{ push_snippets('head_snippets', ['css','matomo','desktop','javascript','logout']) }}
+    {{ push_snippets('head_snippets', inj_head_features) }}
 
     -- inject all collected snippets right before </head>
     local head_payload = table.concat(head_snippets, "\n") .. "</head>"
-    whole = string.gsub(whole, "</head>", head_payload)
+    whole = ngx.re.gsub(whole, "</head>", head_payload, "ijo", nil, 1)
 
     -- build a list of body-injection snippets
     local body_snippets = {}
 
-    {{ push_snippets('body_snippets', ['matomo','logout','desktop']) }}
+    {{ push_snippets('body_snippets', inj_body_features) }}
 
     -- inject all collected snippets right before </body>
     local body_payload = table.concat(body_snippets, "\n") .. "</body>"
-    whole = string.gsub(whole, "</body>", body_payload)
+    whole = ngx.re.gsub(whole, "</body>", body_payload, "ijo", nil, 1)
 
     -- finally send the modified HTML out
     ngx.arg[1] = whole

roles/web-app-mastodon/tasks/02_administrator.yml

@@ -1,7 +1,7 @@
 # Routines to create the administrator account
 # @see https://chatgpt.com/share/67b9b12c-064c-800f-9354-8e42e6459764
 
-- name: Check health status of {{ item }} container
+- name: Check health status of '{{ item }}' container
   shell: |
     cid=$(docker compose ps -q {{ item }})
     docker inspect \
@@ -19,6 +19,7 @@
     - sidekiq
   loop_control:
     label: "{{ item }}"
+  changed_when: false
 
 - name: Remove line containing "- administrator" from config/settings.yml to allow creating administrator account
   command: 
@@ -36,8 +37,11 @@
     tootctl_create.rc != 0
     and
     ("taken" not in tootctl_create.stderr | lower)
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
     
 - name: Approve the administrator account in Mastodon
   command: 
     cmd: docker compose exec -u root web bash -c "RAILS_ENV=production bin/tootctl accounts modify {{users.administrator.username}} --approve"
     chdir: "{{ docker_compose.directories.instance }}"
+  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll:  "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"

tests/unit/roles/sys-srv-web-inj-compose/filter_plugins/test_inj_snippets.py

@@ -0,0 +1,106 @@
+# tests/unit/roles/sys-srv-web-inj-compose/filter_plugins/test_inj_snippets.py
+"""
+Unit tests for roles/sys-srv-web-inj-compose/filter_plugins/inj_snippets.py
+
+- Uses tempfile.TemporaryDirectory for an isolated roles/ tree.
+- Loads inj_snippets.py by absolute path (no sys.path issues).
+- Monkey-patches inj_snippets._ROLES_DIR to the temp roles/ path.
+- Calls the filter function via the loaded module to avoid method-binding.
+"""
+
+import os
+import sys
+import unittest
+import tempfile
+import importlib.util
+
+
+class TestInjSnippets(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        # Find repo root by locating inj_snippets.py upwards from this file
+        cls.test_dir = os.path.dirname(__file__)
+        root = cls.test_dir
+        inj_rel = os.path.join(
+            "roles", "sys-srv-web-inj-compose", "filter_plugins", "inj_snippets.py"
+        )
+
+        while True:
+            candidate = os.path.join(root, inj_rel)
+            if os.path.isfile(candidate):
+                cls.repo_root = root
+                cls.inj_snippets_path = candidate
+                break
+            parent = os.path.dirname(root)
+            if parent == root:
+                raise RuntimeError(f"Could not locate {inj_rel} above {cls.test_dir}")
+            root = parent
+
+        # Create isolated temporary roles tree
+        cls.tmp = tempfile.TemporaryDirectory(prefix="inj-snippets-test-")
+        cls.roles_dir = os.path.join(cls.tmp.name, "roles")
+        os.makedirs(cls.roles_dir, exist_ok=True)
+
+        # Dynamically load inj_snippets by file path
+        spec = importlib.util.spec_from_file_location("inj_snippets", cls.inj_snippets_path)
+        if spec is None or spec.loader is None:
+            raise RuntimeError("Failed to create import spec for inj_snippets.py")
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+
+        # Point the module to our temp roles/ directory
+        module._ROLES_DIR = cls.roles_dir
+
+        # Keep the loaded module for calls
+        cls.mod = module
+
+        # Mock feature names
+        cls.feature_head_only = "zz_headonly"
+        cls.feature_body_only = "zz_bodyonly"
+        cls.feature_both = "zz_both"
+        cls.feature_missing = "zz_missing"
+
+        # Create mock roles and snippet files
+        cls._mkrole(cls.feature_head_only, head=True, body=False)
+        cls._mkrole(cls.feature_body_only, head=False, body=True)
+        cls._mkrole(cls.feature_both, head=True, body=True)
+
+    @classmethod
+    def _mkrole(cls, feature, head=False, body=False):
+        role_dir = os.path.join(cls.roles_dir, f"sys-srv-web-inj-{feature}")
+        tmpl_dir = os.path.join(role_dir, "templates")
+        os.makedirs(tmpl_dir, exist_ok=True)
+        if head:
+            with open(os.path.join(tmpl_dir, "head_sub.j2"), "w", encoding="utf-8") as f:
+                f.write("<!-- head test -->\n")
+        if body:
+            with open(os.path.join(tmpl_dir, "body_sub.j2"), "w", encoding="utf-8") as f:
+                f.write("<!-- body test -->\n")
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.tmp.cleanup()
+
+    def test_head_features_filter(self):
+        features = [self.feature_head_only, self.feature_both, self.feature_body_only]
+        result = self.mod.inj_features_filter(features, kind="head")
+        self.assertEqual(result, [self.feature_head_only, self.feature_both])
+
+    def test_body_features_filter(self):
+        features = [self.feature_head_only, self.feature_both, self.feature_body_only]
+        result = self.mod.inj_features_filter(features, kind="body")
+        self.assertEqual(result, [self.feature_both, self.feature_body_only])
+
+    def test_raises_when_role_dir_missing(self):
+        with self.assertRaises(FileNotFoundError):
+            self.mod.inj_features_filter([self.feature_missing], kind="head")
+        with self.assertRaises(FileNotFoundError):
+            self.mod.inj_features_filter([self.feature_missing], kind="body")
+
+    def test_non_list_input_returns_empty(self):
+        self.assertEqual(self.mod.inj_features_filter("not-a-list", kind="head"), [])
+        self.assertEqual(self.mod.inj_features_filter(None, kind="body"), [])
+
+
+if __name__ == "__main__":
+    unittest.main()