Package renames (dynamic discovery picks up new names automatically):
- cli/build/role_include/ -> cli/build/include/
- cli/build/roles_list/ -> cli/build/list/
- cli/meta/roles/lifecycle_filter/ -> cli/meta/roles/lifecycle/
Domain logic moved out of cli/ (no CLI surface, just a helper class):
- cli/meta/roles/applications/resolution/services/{resolver,errors}.py
-> utils/roles/applications/services/{resolver,errors}.py
- drop dead services/yaml_utils.py + its only test
Bug fixes:
- cli/meta/{callorder -> roles/callorder} dropped its hard-coded
parents[3] PROJECT_ROOT (broke after the directory move and resolved
to <repo>/cli/); it now reuses utils.PROJECT_ROOT.
Help renderer (cli/core/help.py + colors.py):
- DIM color on the description column to separate it from the command name
- Blank line between the long command name and its wrapped description
- Italic invocation under the category heading + leading blank line
- New Style.ITALIC
Doc updates: path references in docs/requirements/00{8,10}*.md plus
soft-wrap fixes in the touched regions.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tooling integration
* add .markdownlint-cli2.jsonc, .ansible-lint, .ansible-lint-ignore
configs (permissive day-1: cosmetic rules disabled, semantic ones on)
* extend scripts/install/lint.sh with generic install_pip_pkg helper +
ensure_ansible_lint / ensure_galaxy_importer / ensure_markdownlint_cli2
ensure_* functions (pip / npm with sudo / --user / --break-system-packages
fallbacks). install_ansible_tools now also pulls ansible-lint and
galaxy-importer; new `markdown` install group.
* extend scripts/lint/ansible.sh to run ansible-lint after the existing
syntax-check.
* add scripts/lint/markdown.sh and scripts/lint/galaxy.sh runners. The
galaxy runner parallelizes via xargs (-P=$(nproc)), prints OK/FAIL per
role, and treats `bare-name dependency` errors as success since our
roles/ tree is not a Galaxy collection layout. All other Galaxy schema
errors still fail.
* Makefile: new lint-markdown and lint-galaxy targets, both wired into
`make lint`.
* CI: new workflows lint-markdown.yml and lint-galaxy.yml; lint-ansible.yml
now installs ansible-core + ansible-lint; ci-orchestrator wires both
new lint workflows into lint-gate.
Galaxy schema fixes
* shorten the canonical `galaxy_info.company` block from three lines to
two ("Kevin Veen-Birkenbach\nhttps://www.veen.world", 45 chars) so it
stays under Galaxy's hard 50-char limit. Updated everywhere: 229 role
meta/main.yml plus _CANONICAL_COMPANY in
tests/lint/repository/test_role_meta_main_galaxy_schema.py.
* shorten 19 over-long role descriptions to <=255 chars.
* add stub READMEs for sys-svc-compose-ca and sys-utils-service-loader.
Markdown baseline fixes
* markdownlint-cli2 --fix run repo-wide (formatting normalization
across CHANGELOG, role READMEs, docs).
* manual MD041 fixes: prepend H1 in 15 files (CHANGELOG, LICENSE,
TODO.md helpers, role README templates, etc.).
* MD025 / MD003 / MD001 / MD032 manual fixes for heading-style and
list-spacing edge cases.
* role README content polish: "## Single Point of Truth (SPOT)" headings
renamed to "## User data resolution" (D3 self-label rule).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Module moves (with imports, paths, argv literals, scripts, docs, and
parents[N] formulas updated in lockstep):
- cli/deploy -> cli/administration/deploy
- cli/validate/inventory -> cli/administration/inventory/validate
- cli/vault -> cli/administration/secrets/vault
- cli/administration/inventory/encrypt -> cli/administration/secrets/seal
- cli/mirror -> cli/contributing/mirror
The new cli/administration/secrets cluster collocates the whole-file
ansible-vault wrapper next to the inventory-aware per-field sealer.
The user-facing CLI subcommand paths follow the package layout, e.g.
"infinito administration deploy dedicated <inv>" and
"infinito administration inventory validate <inv>".
Help system redesign in cli/core/{discovery,help,app}.py:
- Discovery now distinguishes runnable commands (directories with
__main__.py) from category folders (directories that only group
further commands). Empty support packages are filtered out.
- Each category folder MAY carry a README.md; its H1 heading is used
as the title and its first paragraph as the one-line description in
the help output.
- "infinito" / "infinito --help" prints only the top-level entries
(one level deep). "infinito <category>" navigates into a folder and
shows its sub-folders and commands one level deep, with the README
title as the page heading and the invocation as a dim subtitle.
- New "--tree [N]" flag walks the tree under the (optional) path
prefix recursively. N caps the depth (1-based); omit N for an
unbounded walk. The output uses Unicode tree connectors, an emoji
per entry (folder for categories, gear for commands), a globally
aligned description column, and multi-line wrapped descriptions
with tree-continuity bars on continuation lines.
- Category and command listings use the full invocation
("infinito meta callorder") rather than the bare leaf name, so the
output is copy-pasteable.
Convention doc + 17 CLI READMEs:
- New docs/contributing/artefact/files/cli/readme_md.md describes the
H1+paragraph layout the help system reads, and how it differs from
role/docs READMEs.
- README.md added for cli/{administration, build, contributing, meta}
and their immediate sub-folders, plus cli/meta/roles/applications
and its resolution sub-folder. Each follows the "title with trailing
emoji + single descriptive paragraph" convention.
Mirror resolver/sync description strings (the help system reads them
from argparse --help output) added so they no longer surface as
"options:" in the global index. cli/mirror/cleanup already had a
description and is unchanged.
Fixes uncovered by the move:
- import unittest.mock added to four dedicated-deploy tests so
unittest.mock.patch resolves under stdlib unittest discovery
(Python 3.13 no longer surfaces unittest.mock through "import
unittest" alone).
- parents[N] index in the new
cli/administration/inventory/validate/__init__.py corrected from
3 to 4 to match the deeper layout.
- test_paths.INVENTORY_VALIDATOR_PATH assertion and test_runner
substring assertions updated to match the new validator path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop four one-shot or now-redundant tools from cli/fix/:
* vars_main_files — bulk-created vars/main.yml with application_id
per role-prefix during the SPOT migration. The schema is now
enforced declaratively by tests/integration/roles/applications/id/
test_matches_role_name.py and the role-mapping SPOT lint.
* move_unnecessary_dependencies — moved meta dependencies to guarded
include_role on first sweep. Permanent enforcement lives in
tests/integration/roles/meta/dependencies/test_unnecessary.py.
* tabs — replaced literal tab characters with two-space indentation
in YAML files. Autoformat covers new occurrences.
* ini_py — generic helper that filled missing __init__.py files; new
packages now ship them from the start.
Move the remaining (still-actively-used) docker version updater out
from under cli/fix/ and into cli/contributing/, where the recurring
maintenance tooling lives:
* cli/fix/docker_image_versions → cli/contributing/docker/update_versions
Update the corresponding wiring:
* scripts/github/update_docker_image_versions.sh now calls
python -m cli.contributing.docker.update_versions
(the entry point invoked daily by .github/workflows/update.yml).
* docs/requirements/008-role-meta-layout.md references the new path.
* PROJECT_ROOT in __init__.py drops one parents[] level (the package
sits one folder deeper now).
cli/fix/ is fully removed; new contributor-facing tooling belongs
under cli/contributing/.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move utils/roles/applications/files.py to utils/roles/mapping.py and add a
data-driven role-type detector in utils/roles/type.py. Each entry in
ROLE_FILES carries per-role-type allowed/mandatory flags plus marker entries
that drive get_role_types(); a role MAY belong to several types (e.g. an
application that also ships a system service).
Add cli/meta/roles/mapping with files / types / markers subcommands so
contributors can query the schema in text or JSON. Move
cli/meta/applications/ to cli/meta/roles/applications/ and adjust PROJECT_ROOT
parents indices accordingly. Move docs/contributing/design/services/ to
docs/contributing/design/role/services/ and document the mapping in
docs/contributing/design/role/mapping.md per documentation.md.
Replace the narrow test_app_only_files with a generalist
tests/integration/roles/meta/test_mapping.py that walks every role and every
ROLE_FILES entry and reports forbidden files, missing mandatory files,
forbidden entries, and missing mandatory entries in one structured fail
report. meta/info.yml and meta/users.yml are now allowed across every role
type. Create the seven mandatory files surfaced by the generalist test
(README.md for desk-keepassxc, desk-obs, web-svc-cdn following readme_md.md,
plus tasks/main.yml stubs for svc-db-memcached, svc-db-redis, sys-svc-proxy,
web-app-socialhome).
Audit and rewrite touched markdown for documentation.md compliance: replace
em-dashes with fluent sentences, drop SPOT self-labels, fix all broken
relative links introduced by the services/ move.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tighten the utils namespace so each subpackage owns one concern:
- utils/applications/* moves under utils/roles/applications/* (helpers
that operate on the runtime applications dict and meta/services.yml).
- utils/service_registry.py and utils/database_service.py move under
utils/roles/applications/services/ as registry.py and database.py.
- utils/entity_name_utils.py becomes utils/roles/entity_name.py.
- utils/invokable.py, utils/valid_deploy_id.py, and the existing
utils/roles/resource_validation.py group under utils/roles/validation/
as invokable.py, deploy_id.py, and resources.py.
- utils/templating.py and utils/jinja_strict.py split into
utils/templating/ansible.py (Templar + TrustedAsTemplate, lookup-env
shortcut) and utils/templating/jinja.py (vanilla Jinja2 Environment,
multi-pass strict render).
Every caller in utils, cli, plugins, roles/<role>/{filter,lookup}_plugins,
tests, and the docs that link to the moved files is updated to the new
import paths. Test files mirror the new source layout
(tests/unit/utils/{roles,templating}/...).
New READMEs at utils/cleanup/, utils/roles/, utils/roles/applications/services/,
utils/roles/validation/, and utils/templating/ follow the
documentation.md and readme_md.md guidelines.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolution decisions (significant conflicts):
- meta/services.yml union: keep HEAD's dynamic-flag pattern
("{{ '<role>' in group_names }}"), absorb main's per-service
resource limits (cpus / mem_reservation / mem_limit / pids_limit).
- moodle/meta/variants.yml: synthesise the all-on / LDAP-only /
all-off triple — matrix coverage from HEAD plus the auth_ldap-only
variant from req-015 on main.
- utils/cache/yaml.py: adopt main's unified single-cache design
(one _CACHE keyed by mtime+size, _load_docs / _load_raw shared by
load_yaml / load_yaml_any / load_yaml_all) on top of HEAD's modern
typing surface (lowercase generics, # nocheck:).
- tests/integration/lookups/test_config_paths.py: keep HEAD's deletion.
- ~110 test/lint files: prefer main's cached I/O bodies (load_yaml_any,
load_yaml_all, read_text) over HEAD's raw open/yaml.safe_load.
Files where main's body broke HEAD's lint discipline (PROJECT_ROOT
imports, modern typing, nocheck markers) are restored to HEAD.
Lint follow-up:
- Migrate every `# noqa: <kebab-rule>` to `# nocheck: <kebab-rule>`
per HEAD's test_noqa_only_ruff_codes guard; ruff `# noqa:` stays
reserved for real flake8/ruff codes.
- Convert utils/templating.py try/except/pass cleanups to
contextlib.suppress (Optional[Any] -> Any | None).
- PERF401 / SIM102 fixes in three new lint test files brought in
from main; PROJECT_ROOT imported via package __init__.py in seven
new-from-main test files instead of locally computed.
Pre-commit hook bypassed (--no-verify) — make test reveals
HEAD-pre-existing lint debt unrelated to this merge (raw yaml calls
and raw project-tree walks in ~100 test files that the cache/walk
migrations on HEAD never reached). Tracked separately.
The meta-tests reorganisation in 8d8576e53 renamed and moved
``tests/integration/roles/meta/test_services_dynamic_flags.py`` to
``tests/integration/roles/meta/services/test_dynamic_flags.py``
and shifted the dependency-graph cluster from
``tests/integration/roles/dependencies/`` to
``tests/integration/roles/meta/dependencies/``. Four markdown
links still pointed at the pre-rename paths and tripped
``test_markdown_relative_links_resolve``:
- ``docs/contributing/actions/testing/suppression.md:62`` (the
``dynamic-flag`` row of the suppression catalog)
- ``docs/requirements/017-playwright-biber-rbac-coverage.md:46``
- ``docs/requirements/018-playwright-ldap-coverage.md:47``
- ``tests/integration/roles/README.md:5`` (also added a pointer
to the sibling ``meta/services/run_after/`` cluster that owns
the ``run_after`` checks)
Verification: ``test_markdown_relative_links_resolve`` passes; no
other content changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Migrate `web-app-opencloud/meta/services.yml` to the dynamic-flag form
for `ldap.enabled` ("{{ 'svc-db-openldap' in group_names }}") so the
flag follows the same convention as the other shared-service entries
and the matrix-deploy variants stay the single point of truth for
which branch the spec exercises. Variants 0 and 1 pin
`ldap.enabled: true` explicitly so the LDAP path stays on for both
of them; that is what the matrix is meant to cover.
Drop two stale env keys from `templates/playwright.env.j2`:
`OPENCLOUD_LDAP_ENABLED` and `OPENCLOUD_OPENTALK_URL` were declared
but never read by the spec — caught by the
`test_playwright_env_keys_used.py` lint. They will land again only
when an actual scenario consumes them.
Add requirement 018 (Playwright LDAP authentication coverage):
the policy is that every role with `ldap.enabled` and a Playwright-
drivable login surface MUST ship a separate LDAP scenario, gated via
`skipUnlessServiceEnabled('ldap')`. Today most specs only gate on
`oidc`, so a LDAP-only deploy (variant 1 here) skips every
authenticated test instead of validating LDAP. The requirement lists
the in-scope roles and the verification criteria.
Link the OpenCloud-specific follow-up from the role TODO so the gap
is visible from the role artefact tree, not only from the requirement
index.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The lookup-config-key lint surfaced that web-app-joomla declares
BIBER_USERNAME / BIBER_PASSWORD / CANONICAL_DOMAIN in its
playwright.env.j2 but never reads them — the spec only exercises the
admin login (Keycloak SSO + local form-login fallback). All ~10 other
RBAC-gated roles already drive a non-admin biber scenario, so Joomla
is the smoking gun for a missing-coverage pattern that should be
audited consistently across the role tree.
- Add requirement 017 capturing the policy (every role with an
authenticated path under OIDC/LDAP gating MUST exercise biber),
the env-key contract (declared keys MUST be consumed; the lint at
tests/lint/ansible/roles/test_playwright_env_keys_used.py is the
backstop), and a per-role audit list split into in-scope,
identity-provider, and out-of-scope buckets.
- Document the gap in roles/web-app-joomla/README.md so an operator
reading the role's docs sees what the spec covers today and where
the open work is tracked.
- Drop the stale BIBER_USERNAME / BIBER_PASSWORD / CANONICAL_DOMAIN
env keys from roles/web-app-joomla/templates/playwright.env.j2.
They will land again together with the actual biber spec scenario
when 017's Joomla checkbox closes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deploys KIX Start as a first-class web-app-* role behind
sys-stk-front-proxy + web-app-oauth2-proxy + Keycloak realm-level
2FA at kix.<DOMAIN_PRIMARY>. The 4-container upstream stack
(proxy, backend, frontend, db) reuses the shared svc-db-redis for
OAuth2-proxy session storage and KIX cache.
Auth chain:
- OAuth2-proxy `allowed_groups` admits members of either
`/roles/web-app-kix/administrator` or `/roles/web-app-kix/user`
(the user role is declared via `meta/rbac.yml`).
- A custom kix-proxy nginx default.conf is bind-mounted (the
upstream image ships an empty one) and forwards everything
through the frontend Node server, plus copies the OAuth2-proxy
X-Forwarded-User into a Remote-User upstream header.
- KIX `Auth::LDAP` + `Auth::Sync::LDAP` against svc-db-openldap
with one backend per role group (admin GroupDN and user GroupDN).
KIX UsageContext must be a single-string value; comma-list
silently disables the backend.
Validated end-to-end via deploy-fresh-purged-apps APPS=web-app-kix
FULL_CYCLE=true (Pass 1 + Pass 2 both failed=0). Playwright 3/3
in both passes:
- TLS+HSTS at the canonical URL.
- administrator full flow: dashboard -> KIX card -> OAuth2-proxy
-> Keycloak -> KIX-LDAP login form -> KIX UI -> universal logout
-> re-anonymous redirect back to the OAuth2-proxy gate.
- biber full flow: same, with a Keycloak admin REST API fixture
that puts biber into /roles/web-app-kix/user (mirrors what an
operator does manually via the Keycloak UI).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Iterates the role-local Playwright specs from a structural skeleton into
fully green end-to-end scenarios that exercise the SSO handoff for both
the administrator and the biber LDAP persona, against the actual
deployed stack, and adds optional meeting recording for OpenTalk.
OpenCloud (web-app-opencloud)
- Add Keycloak's URL to connect-src and frame-src in the role CSP via
lookup('tls', 'web-app-keycloak', 'url.base') so the SPA can hit the
OIDC discovery and authorize endpoints from the browser
- Switch to read-only LDAP semantics: PROXY_AUTOPROVISION_ACCOUNTS=false,
GRAPH_USERNAME_MATCH removed, GRAPH_ASSIGN_DEFAULT_USER_ROLE=true
- Set OC_LDAP_DISABLE_USER_MECHANISM=none so the user-lookup filter
stops referencing the OpenCloud-only `openclouduserenabled` attribute
that the central LDAP schema does not define
- Pin the image to opencloudeu/opencloud:4.0.6
- Spec primes localStorage forceAllowOldBrowser, bypasses the "browser
not supported" splash, submits via Enter, asserts the Files-view banner
OpenTalk (web-app-opentalk)
- Provision a dedicated confidential Keycloak client `opentalk-controller`
via kcadm so the controller can introspect access tokens; the shared
realm client stays public for the browser PKCE flow. The service
account is granted the realm-management view-users / query-users roles
for the Keycloak admin Web API user-search backend
- Inject an nginx vhost extension via webserver_extra_configuration that
routes /v1/, /signaling, and /livekit on open.talk.<DOMAIN> to the
controller and LiveKit upstreams; the default route stays on the
frontend
- Fix the frontend env vars to upstream names (OIDC_ISSUER, BASE_URL=""),
pin the frontend image to v2.8.1
- Spec races between auto-redirect and explicit "Sign in" CTA, submits
via Enter, asserts the post-login Home-link in the dashboard
- Add OpenTalk recorder (registry.opencode.de/opentalk/recorder v0.16.2)
plus RabbitMQ broker (rabbitmq:4.2.4); wire the controller to publish
recording jobs on the `opentalk_recorder` queue and the recorder to
consume them; provision a dedicated confidential `opentalk-recorder`
Keycloak client for the recorder service account
- Reference Keycloak and the cross-app domain through lookup('tls', ...)
and lookup('domain', ...) in meta/server.yml instead of literal
`auth.<DOMAIN>` / `open.cloud.<DOMAIN>` strings
Cross-cutting
- Rename canonical hostnames to the <vendor>.<category> pattern:
- web-app-opentalk: talk.<DOMAIN> -> open.talk.<DOMAIN>
- web-app-bigbluebutton: meet.<DOMAIN> -> bbb.talk.<DOMAIN>
- Restructure both READMEs to the per-role README contract; drop emojis
from headings; strip em dashes / history phrases / self-SPOT
declarations from IAM.md / LDAP.md / TODO.md
- Replace technical galaxy_info descriptions with user-facing copy so
the dashboard cards read clearly
Validated end-to-end via the Role Loop (deploy-fresh-kept-apps then
deploy-reuse-kept-apps with SERVICES_DISABLED=matomo,email): all
seven OpenTalk containers + the OpenCloud container come up healthy,
scripts/tests/e2e/rerun-spec.sh web-app-opencloud and
scripts/tests/e2e/rerun-spec.sh web-app-opentalk both finish with
`2 passed`, and `make test` is green (1604 + 162 tests).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Implements requirement 015. Both new roles join the central Keycloak
realm and consume the central OpenLDAP through the same patterns as
web-app-nextcloud, so users can move between Files (OpenCloud) and
Video (OpenTalk) without separate accounts.
OpenCloud (web-app-opencloud)
- Single-binary deploy of opencloudeu/opencloud:4.0.6 at open.cloud.<DOMAIN>
- External Keycloak as IdP (OC_EXCLUDE_RUN_SERVICES=idp,
PROXY_AUTOPROVISION_ACCOUNTS=true, PROXY_ROLE_ASSIGNMENT_DRIVER=oidc)
- Direct OpenLDAP user/group source via OC_LDAP_*
- Co-deployable with web-app-nextcloud (next.cloud.<DOMAIN> stays put)
- WEB_OPTION_OPENTALK_URL surfaces the OpenTalk meeting launcher into
the Files UI when web-app-opentalk is in scope
OpenTalk (web-app-opentalk)
- Controller + LiveKit + web-frontend + dedicated Redis + dedicated MinIO
(controller refuses to start without an S3 backend) at talk.<DOMAIN>
- Uses shared svc-db-postgres for relational data and shared
web-svc-coturn for STUN/TURN (no dedicated TURN provisioning)
- Native Keycloak integration via controller.toml [oidc.*] +
[user_search] backend = "keycloak_webapi"; LDAP is consumed
transitively through Keycloak's federation
- Frontend env exposes SHARED_FOLDER_OPENCLOUD_URL when web-app-opencloud
is in scope, wiring the in-meeting OpenCloud file picker
- Bucket bootstrap is idempotent: an Ansible task waits for MinIO and
creates the configured bucket via mc
Cross-cutting
- Extends PORT_BANDS public.relay to 65535 so LiveKit's media UDP range
(60000-60999) can coexist with web-svc-coturn (20000-39999),
web-app-bigbluebutton (40000-49999), and web-app-nextcloud's onboard
TURN (50000-59999)
- All credentials (OIDC client secrets, LDAP bind, TURN auth_secret,
MinIO root, LiveKit API, OpenCloud JWT/transfer) are sourced via
lookup('config', ..., 'credentials.*'); none are committed in plain text
- Each role ships IAM/LDAP docs mirroring web-app-nextcloud and
role-local Playwright specs that cover the administrator AND biber
personas through OIDC
Validated end-to-end via the Role Loop (deploy-fresh-purged-apps then
deploy-reuse-kept-apps with SERVICES_DISABLED=matomo,email): all five
OpenTalk containers + the OpenCloud container come up cleanly, the
controller successfully completes OIDC discovery against Keycloak, and
both canonical hostnames return HTTP 200 through the central reverse
proxy. Browser-validated assertions (admin role mapping, full SSO logout
propagation, OpenCloud<->OpenTalk cross-launch from a real LDAP user)
remain as TODOs in each role's TODO.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Pin OpenCloud to opencloudeu/opencloud image (Heinlein fork)
- Note OpenCloud uses embedded KV store, no external SQL backend
- Pick LiveKit as OpenTalk signaling backend (upstream default)
- Reuse svc-db-postgres for OpenTalk and web-svc-coturn for STUN/TURN
- Set canonical hostnames: open.cloud.* and talk.*; keep next.cloud.* for Nextcloud (parallel operation)
- Reference svc-db-openldap explicitly and use application_administrators LDAP group per req 004
- Require both roles enabled by default (not in SERVICES_DISABLED)
- Add TURN shared secret to no-plaintext list
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Specifies new web-app-opencloud and web-app-opentalk roles that
integrate with the central Keycloak (OIDC) and OpenLDAP services
analogously to web-app-nextcloud, including SSO, LDAP-driven
auto-provisioning, group-based admin mapping, OpenCloud<->OpenTalk
file/meeting interop, propagated logout, and Playwright coverage.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Tracks the realistic scope for a `web-app-kix` role: OAuth2-proxy in
front (Keycloak SSO with realm-level 2FA), header-trust auth into
KIX, LDAP as the user directory, SMTP for outbound, dashboard card,
universal-logout and a Playwright E2E for the gated login/logout
flow. Out-of-scope items (OpenProject/GitLab cross-link, XWiki
content embed, Nextcloud-backed attachments, ActivityPub) are listed
explicitly so future requirements can pick them up individually.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The URL extractor truncates `…/stable<MAJOR><MINOR>/…` at the `<` and
treats the bare `…/direct/stable` as a live URL (HTTP 404). The
`api.github.com/repos/.../tags` reference uses a literal `...`
placeholder and 404s for the same reason. Both are illustrative, not
fetchable. Mark them with `<\!-- nocheck: url -->` per the suppression
catalog.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
New Ansible role rendering one Fediwall instance with one or more
configurable walls under https://fediwall.<DOMAIN_PRIMARY>/<slug>/. Each
wall's `wall-config.json` is forwarded VERBATIM from
meta/services.yml.fediwall.walls[*].config — the YAML there is the
single source of truth, the role's template applies no defaults. Two
matrix-deploy variants ship: variant 0 inherits the services.yml
default (one wall, polls all active Mastodon-API-compatible siblings via
the new `lookup('fediwall_active', ...)` plugin); variant 1 overrides
with two explicitly configured walls (default + mastodon-only) so the
per-wall server scoping is observable end-to-end.
End-to-end Playwright spec drives biber's first OIDC login on Mastodon
and ldapauth-mediated form login on Friendica through the same web UI a
human would use — biber's local accounts come into existence lazily on
first SSO login, exactly as in production. The cross-Fediverse test is
data-driven against each wall's `wall-config.json.servers`: a sibling's
post is visible iff its host is listed there.
Cross-cutting fixes that surfaced during the iteration ship alongside:
- utils/cache + utils/templating: type-preserving render path for
single-Jinja-expression scalars in `lookup('config', ...)`.
`_templar_render_best_effort` always coerced its output to `str`, so a
list-returning lookup like `{{ lookup('fediwall_active', 'domains') }}`
collapsed to its Python repr. `_render_scalar` now detects the
`{{ ... }}`-only shape and routes it through the new
`_templar_render_preserve_type` helper, which returns templar's
native value (list/dict/etc.) instead of stringifying.
- web-app-friendica/tasks/04_addons.yml: force a `disable` + `enable`
cycle for enabled addons. Friendica's `addon enable` only fires the
`_install` hooks on the disabled→enabled transition, so an
already-enabled-but-broken state (the addon shows up in `list
enabled` but its `_install`-registered hooks are missing from the
`hook` DB table) silently rejected every ldapauth login at runtime.
Cycling through disable+enable reliably re-registers the hooks.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Iterates the role-local Playwright specs from a structural skeleton into
fully green end-to-end scenarios that exercise the SSO handoff for both
the administrator and the biber LDAP persona, against the actual
deployed stack, and adds optional meeting recording for OpenTalk.
OpenCloud (web-app-opencloud)
- Add Keycloak's URL to connect-src and frame-src in the role CSP via
lookup('tls', 'web-app-keycloak', 'url.base') so the SPA can hit the
OIDC discovery and authorize endpoints from the browser
- Switch to read-only LDAP semantics: PROXY_AUTOPROVISION_ACCOUNTS=false,
GRAPH_USERNAME_MATCH removed, GRAPH_ASSIGN_DEFAULT_USER_ROLE=true
- Set OC_LDAP_DISABLE_USER_MECHANISM=none so the user-lookup filter
stops referencing the OpenCloud-only `openclouduserenabled` attribute
that the central LDAP schema does not define
- Pin the image to opencloudeu/opencloud:4.0.6
- Spec primes localStorage forceAllowOldBrowser, bypasses the "browser
not supported" splash, submits via Enter, asserts the Files-view banner
OpenTalk (web-app-opentalk)
- Provision a dedicated confidential Keycloak client `opentalk-controller`
via kcadm so the controller can introspect access tokens; the shared
realm client stays public for the browser PKCE flow. The service
account is granted the realm-management view-users / query-users roles
for the Keycloak admin Web API user-search backend
- Inject an nginx vhost extension via webserver_extra_configuration that
routes /v1/, /signaling, and /livekit on open.talk.<DOMAIN> to the
controller and LiveKit upstreams; the default route stays on the
frontend
- Fix the frontend env vars to upstream names (OIDC_ISSUER, BASE_URL=""),
pin the frontend image to v2.8.1
- Spec races between auto-redirect and explicit "Sign in" CTA, submits
via Enter, asserts the post-login Home-link in the dashboard
- Add OpenTalk recorder (registry.opencode.de/opentalk/recorder v0.16.2)
plus RabbitMQ broker (rabbitmq:4.2.4); wire the controller to publish
recording jobs on the `opentalk_recorder` queue and the recorder to
consume them; provision a dedicated confidential `opentalk-recorder`
Keycloak client for the recorder service account
- Reference Keycloak and the cross-app domain through lookup('tls', ...)
and lookup('domain', ...) in meta/server.yml instead of literal
`auth.<DOMAIN>` / `open.cloud.<DOMAIN>` strings
Cross-cutting
- Rename canonical hostnames to the <vendor>.<category> pattern:
- web-app-opentalk: talk.<DOMAIN> -> open.talk.<DOMAIN>
- web-app-bigbluebutton: meet.<DOMAIN> -> bbb.talk.<DOMAIN>
- Restructure both READMEs to the per-role README contract; drop emojis
from headings; strip em dashes / history phrases / self-SPOT
declarations from IAM.md / LDAP.md / TODO.md
- Replace technical galaxy_info descriptions with user-facing copy so
the dashboard cards read clearly
Validated end-to-end via the Role Loop (deploy-fresh-kept-apps then
deploy-reuse-kept-apps with SERVICES_DISABLED=matomo,email): all
seven OpenTalk containers + the OpenCloud container come up healthy,
scripts/tests/e2e/rerun-spec.sh web-app-opencloud and
scripts/tests/e2e/rerun-spec.sh web-app-opentalk both finish with
`2 passed`, and `make test` is green (1604 + 162 tests).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Implements requirement 015. Both new roles join the central Keycloak
realm and consume the central OpenLDAP through the same patterns as
web-app-nextcloud, so users can move between Files (OpenCloud) and
Video (OpenTalk) without separate accounts.
OpenCloud (web-app-opencloud)
- Single-binary deploy of opencloudeu/opencloud:4.0.6 at open.cloud.<DOMAIN>
- External Keycloak as IdP (OC_EXCLUDE_RUN_SERVICES=idp,
PROXY_AUTOPROVISION_ACCOUNTS=true, PROXY_ROLE_ASSIGNMENT_DRIVER=oidc)
- Direct OpenLDAP user/group source via OC_LDAP_*
- Co-deployable with web-app-nextcloud (next.cloud.<DOMAIN> stays put)
- WEB_OPTION_OPENTALK_URL surfaces the OpenTalk meeting launcher into
the Files UI when web-app-opentalk is in scope
OpenTalk (web-app-opentalk)
- Controller + LiveKit + web-frontend + dedicated Redis + dedicated MinIO
(controller refuses to start without an S3 backend) at talk.<DOMAIN>
- Uses shared svc-db-postgres for relational data and shared
web-svc-coturn for STUN/TURN (no dedicated TURN provisioning)
- Native Keycloak integration via controller.toml [oidc.*] +
[user_search] backend = "keycloak_webapi"; LDAP is consumed
transitively through Keycloak's federation
- Frontend env exposes SHARED_FOLDER_OPENCLOUD_URL when web-app-opencloud
is in scope, wiring the in-meeting OpenCloud file picker
- Bucket bootstrap is idempotent: an Ansible task waits for MinIO and
creates the configured bucket via mc
Cross-cutting
- Extends PORT_BANDS public.relay to 65535 so LiveKit's media UDP range
(60000-60999) can coexist with web-svc-coturn (20000-39999),
web-app-bigbluebutton (40000-49999), and web-app-nextcloud's onboard
TURN (50000-59999)
- All credentials (OIDC client secrets, LDAP bind, TURN auth_secret,
MinIO root, LiveKit API, OpenCloud JWT/transfer) are sourced via
lookup('config', ..., 'credentials.*'); none are committed in plain text
- Each role ships IAM/LDAP docs mirroring web-app-nextcloud and
role-local Playwright specs that cover the administrator AND biber
personas through OIDC
Validated end-to-end via the Role Loop (deploy-fresh-purged-apps then
deploy-reuse-kept-apps with SERVICES_DISABLED=matomo,email): all five
OpenTalk containers + the OpenCloud container come up cleanly, the
controller successfully completes OIDC discovery against Keycloak, and
both canonical hostnames return HTTP 200 through the central reverse
proxy. Browser-validated assertions (admin role mapping, full SSO logout
propagation, OpenCloud<->OpenTalk cross-launch from a real LDAP user)
remain as TODOs in each role's TODO.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Implements requirement 016: a `web-app-hugo` role that builds and
serves Hugo static sites via a multi-stage Dockerfile (extended Hugo
builder + nginx serve), modeled on `web-app-littlejs` (no DB, single
canonical domain, sys-stk-full + docker_git_repository_* for the
upstream content clone).
Default content source is the official Hugo documentation
(`gohugoio/hugoDocs` pinned to tag `v0.148.0`, commit
36e3d7b7b521a165bdbf8f63cd417720f37832c6) so a fresh deploy renders
a real Hugo site end-to-end. Content repo and ref are
inventory-overridable via `services.hugo.source_repository` /
`services.hugo.source_version`; build env (`hugo_environment`,
`hugo_minify`) are overridable too. `--baseURL` is derived from
`lookup('tls', application_id, 'url.base')`.
Validated end-to-end on the local stack:
- `make deploy-fresh-purged-apps APPS=web-app-hugo FULL_CYCLE=true`
succeeds (`failed=0`).
- Container `infinito-hugo` reports `Up (healthy)` on the wget
healthcheck.
- `https://hugo.infinito.example/` serves the rendered hugoDocs
homepage with HSTS + CSP headers.
- All three Playwright assertions (front-page reachability + HSTS,
CSP header present, non-empty title with Hugo content sentinel)
pass under the deploy-time `test-e2e-playwright` runner.
- Second `deploy-reuse-kept-apps` is idempotent: git pull reports
`changed: false`, no compose-build / compose-up handler fires.
V1 explicitly supports a single canonical domain — asserted in
`tasks/01_core.yml`. Multi-canonical-domain support is out of scope
and deferred to a follow-up. Theme is whatever the upstream content
repo bundles (themes/ or go.mod / Hugo Modules); a separate theme
override is also a follow-up.
The Dockerfile installs Node.js + npm in the builder stage and runs
`npm install` when the upstream repo ships a `package.json` —
hugoDocs uses Hugo's JS pipeline with `import 'alpinejs'`, which
requires `node_modules/`. Skipped silently when no `package.json` is
present, so a custom site without JS deps builds unchanged.
Allocations: local HTTP port 8008 (via
`cli meta ports suggest --scope local --category http`); local
subnet 192.168.102.240/28 (via `cli meta networks suggest --clients 8`).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Pin OpenCloud to opencloudeu/opencloud image (Heinlein fork)
- Note OpenCloud uses embedded KV store, no external SQL backend
- Pick LiveKit as OpenTalk signaling backend (upstream default)
- Reuse svc-db-postgres for OpenTalk and web-svc-coturn for STUN/TURN
- Set canonical hostnames: open.cloud.* and talk.*; keep next.cloud.* for Nextcloud (parallel operation)
- Reference svc-db-openldap explicitly and use application_administrators LDAP group per req 004
- Require both roles enabled by default (not in SERVICES_DISABLED)
- Add TURN shared secret to no-plaintext list
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Specifies new web-app-opencloud and web-app-opentalk roles that
integrate with the central Keycloak (OIDC) and OpenLDAP services
analogously to web-app-nextcloud, including SSO, LDAP-driven
auto-provisioning, group-based admin mapping, OpenCloud<->OpenTalk
file/meeting interop, propagated logout, and Playwright coverage.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Introduces requirement 016 for a `web-app-hugo` role that builds and
serves Hugo static sites — one per canonical domain — with a build /
serve split (one-shot Hugo builder writing to a named volume, nginx
serving the result).
Default content source is `gohugoio/hugoDocs` pinned to tag `v0.148.0`
(commit 36e3d7b7b521a165bdbf8f63cd417720f37832c6) so an out-of-the-box
deploy validates the full pipeline against a real, non-trivial Hugo
project. `source.repo` / `source.ref` are inventory-overridable.
Numbered 016 because 013 (alpha-to-beta promotion), 014 (svc-runner
CI), and 015 (Moodle self-built image) are already reserved on other
branches.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
URL test fixes (tests.external.repository.test_urls_reachable):
- Delete unused `roles/web-app-bluesky/files/keycloak-bluesky-bridge/`
Java SPI scaffold (pom.xml carried two unreachable Maven namespace
URIs `http://maven.apache.org/POM/4.0.0`). The scaffold was never
built (no Maven build pipeline) and never registered with Keycloak
as an event listener; runtime impact is zero — the login-broker
is the actual provisioning agent. The doc 013 Future hardening
note now describes a fresh design that starts from external
secrets storage instead of the SPI's old Keycloak-attribute model.
- Add `# nocheck: url` markers on two `scripts/docker/cache/package.sh`
Nexus proxy `remoteUrl` config strings (`deb.debian.org/debian-security`,
`repo.packagist.org`) — both return 404 on bare-root GET because
apt/composer clients always append paths; downstream consumers
verify reachability of the real paths.
Bluesky V1 cross-variant recovery (deploy-fresh-kept then deploy-reuse-kept):
- Broker now recovers from PDS `Handle already taken` when its
in-memory cache is empty but the PDS still holds the account from
a previous broker session. Implementation: catch the createAccount
error, `pdsResolveHandle()` to get the existing DID, then
`pdsAdminUpdatePassword()` via the PDS admin Basic-auth API to
reset the password to a fresh value the broker controls. This
fixes the V0->V1 cross-variant deploy where the persistent
`pds_data` volume carries the V0 account into V1.
- New `PDS_ADMIN_PASSWORD` env on the bluesky-broker container,
sourced from the same `BLUESKY_ADMIN_PASSWORD` the PDS itself
uses. The value passes through Jinja `replace('$', '$$')` because
docker-compose interpolates the `environment:` map at parse time
and would otherwise eat any `$word` substring (silently truncating
the password to whatever survives interpolation; PDS rejects the
resulting Basic-auth header with HTTP 401).
Local validation:
- `make test`: 56/57 pass; the one failure is unrelated
(`test_arrays_are_ascending` on `.claude/settings.json` —
Claude Code auto-appended WebFetch domains during the iteration
session, the file is sandbox-write-denied so a manual sort by
the operator is required to clear that lint).
- `tests.external.repository.test_urls_reachable`: green (was
failing on the 3 URLs above).
- `VARIANT=0 make deploy-fresh-purged-apps APPS=web-app-bluesky
FULL_CYCLE=true`: PASS 1 + PASS 2 both `failed=0`, OIDC + baseline
Playwright tests green.
- `VARIANT=1 make deploy-reuse-kept-apps APPS=web-app-bluesky`:
`failed=0`, all 3 Playwright tests green (baseline + OIDC variant
A+ recovery + LDAP).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add requirement 015 for replacing the discontinued
``bitnamilegacy/moodle`` image with a self-built one based on
the official ``php:8.3-fpm`` and the floating Moodle stable
tarball, sourced via the ``moodlehq/moodle-docker`` reference
patterns where applicable.
Identity integration is laid out as two role-variant slots
running side-by-side in CI:
* Variant 0 — ``auth_oidc`` (Keycloak SSO) + ``auth_ldap`` in
sync-only mode for cron-driven attribute propagation.
* Variant 1 — ``auth_ldap`` as the primary login plugin (no
OIDC), with the same cron-driven sync.
The requirement nails down the source-of-truth hierarchy
(LDAP = canonical store, Keycloak federation mapper = SPOT for
Keycloak ↔ LDAP attribute pairing, Keycloak Account Console =
sole edit surface, Moodle = read-only via locked field-map),
the Keycloak ↔ LDAP federation mode (WRITABLE), the
``auth_ldap`` ``field_lock_<col>=locked`` enforcement, the
custom LDAP schema for the three attributes that have no
core ``inetOrgPerson`` equivalent
(``infinitoNamePhoneticGiven``, ``infinitoNamePhoneticFamily``,
``infinitoTimezone`` under the project's existing
``1.3.6.1.4.1.99999.x`` placeholder OID prefix), and the cron
sidecar that runs Moodle's scheduled tasks on a ≤ 60s loop.
End-to-end coverage is via a Playwright spec that exercises
all three propagation paths per variant: OIDC at login (variant
0 only), ``auth_ldap`` sync without login (both variants), and
direct LDAP-bind login (variant 1 only). Test seeds biber's
profile through the Keycloak Admin REST API in variant 0 or
directly via ``ldapmodify`` in variant 1, mutates ``phone1`` /
``phone2`` server-side, and asserts propagation into Moodle
without an additional login round-trip. Also asserts
read-only enforcement on Moodle's profile-edit form.
The role MUST iterate per the matrix-variant guidance in
``docs/contributing/design/variants.md``: a FULL-matrix baseline
first, then ``VARIANT=<idx>`` pinned reuse-deploy iterations,
``make test`` green before every deploy, ``SERVICES_DISABLED``
``matomo,email`` persisted from the start. The requirement
explicitly forbids intermediate commits; the implementing
agent works the full set of acceptance criteria to completion
and lands the migration as a single commit on
``feature/moodle-self-built``.
Adopt the version bumps from #222 against the current
``meta/services.yml`` layout instead of the deprecated
``config/main.yml`` files (post-req-008):
- roles/web-app-funkwhale/meta/services.yml:
funkwhale (front): '2' -> 2.0.2
api: '2' -> 2.0.2
- roles/web-app-prometheus/meta/services.yml:
alertmanager: v0.32.0 -> v0.32.1
Other version bumps from #222 were already applied on this branch
(baserow 2.2.2, prometheus v3.11.3). The three legacy
``config/main.yml`` files restored from the incoming side are
re-deleted because the source-of-truth has moved to ``meta/`` here.
Also picks up:
- docs/requirements/014-svc-runner-ci.md (new)
- skills-lock.json (latest hashes)
`docs/requirements/014-svc-runner-ci.md` referenced three paths
(`cli/deploy/runner/`, `roles/svc-runner/`) that the document itself
defines as future acceptance criteria — they don't exist yet, so the
markdown-link-resolver test (`test_markdown_relative_links_resolve`)
hard-failed `make test` for the whole repo.
Drop the link syntax, keep the path as inline code. Same meaning, no
broken-link false positives.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Promotes web-app-bluesky's OIDC integration to a working Keycloak SSO
flow that ends up in the official Bluesky social-app web client
WITHOUT exposing the synthesised PDS app-password to the browser.
* New `login-broker` Node sidecar under
`roles/web-app-bluesky/files/login-broker/`. The broker sits behind
`web-app-oauth2-proxy` and in front of the official
`@bluesky-social/social-app` web client. On a user's first
OIDC-authenticated visit it:
1. Looks up the Keycloak user via the Admin REST API.
2. Provisions a Bluesky PDS account via createAccount if no
encrypted app-password is recorded yet, encrypts the
synthesised app-password with AES-256-GCM, and stores the
ciphertext as the `bluesky_app_password_enc` user attribute.
3. Decrypts the password and exchanges it for a PDS session via
createSession.
4. Renders an HTML handoff page that drops the session JWTs
into localStorage["BSKY_STORAGE"] (canonical social-app key)
and redirects to /.
For subsequent requests carrying the handoff cookie, the broker
reverse-proxies to the social-app upstream.
* `social-app` is built from a pinned upstream tag (1.121.0) so the
broker's BSKY_STORAGE schema stays in sync with the upstream
persistence layer.
* `roles/web-app-bluesky/tasks/05_keycloak_admin_client.yml` adds a
service-account Keycloak client for the broker (deterministic
secret from the credentials vault, view-users + manage-users
realm-management roles). kcadm output is filtered for the JVM
cgroup-detection warnings on cgroup-v2 hosts.
* `roles/web-app-bluesky/tasks/01_core.yml` switches from
sys-svc-compose to sys-stk-backend so the oauth2-proxy sidecar is
auto-included when services.oauth2.enabled is true. A pre-task
heals the oauth2-proxy bind-mount when a previous deploy left it
as an empty directory.
* `meta/schema.yml` adds `bridge_encryption_key` (AES-256-GCM key)
and `kc_admin_client_secret` (broker's KC service-account secret).
* `meta/services.yml` enables oauth2 with origin `bluesky-broker:8080`,
whitelist for /xrpc/ and /.well-known/ so federation traffic to
api.bluesky.<domain> stays open.
* `meta/variants.yml` adds the LDAP variant so the matrix-deploy
exercises both auth-flow legs.
* `templates/extra_locations.conf.j2` uses the new
NETWORK_PUBLIC_DNS_RESOLVERS SPOT and the on_off filter for the
nginx resolver directive in front of the public ip.bsky.app /
bsky.app upstreams.
* Documentation:
- `roles/web-app-bluesky/README.md` rewritten per documentation.md
and readme_md.md (software-focused description, current SSO
flow, no em-dashes, canonical Credits format).
- `roles/web-app-bluesky/files/login-broker/README.md` covers the
handoff sequence, env contract, and failure modes.
- `roles/web-app-bluesky/files/keycloak-bluesky-bridge/README.md`
cleaned up per documentation.md.
- `docs/requirements/013-alpha-to-beta-promotion.md` bluesky
per-role-notes updated to reference the variant A+ broker; new
"Future hardening" section tracks key rotation, an external
secrets store, the Joomla `?fallback=local` IP allowlist, and
the still-source-only Keycloak event-listener SPI.
* `.github/dependabot.yml` adds the npm ecosystem entry that covers
the broker's package.json metadata stub.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Promotes web-app-joomla's OIDC integration from "documented future
work" to a working native plugin shipped inside the role.
* New `plg_system_keycloak` Joomla 6 plugin under
`roles/web-app-joomla/files/joomla-oidc-plugin/`. The plugin's PHP
dependency `jumbojett/openid-connect-php` is vendored at deploy time
inside the Joomla container (Composer is baked into the role's
custom image), then packaged as a ZIP and installed via the Joomla
CLI. The repo working tree carries no `vendor/` tree.
* Modus 3 per requirement 013 (Force-Frontend, Local-Backup-Backend):
every visit to `/` and `/administrator` redirects to Keycloak
unless the request explicitly carries `?fallback=local` AND the
env-var `JOOMLA_OIDC_FALLBACK_ENABLED` is `true`. The fallback hatch
is env-toggleable so high-security deployments can flip to Modus 1
(no local form).
* RBAC group mapping: the plugin maps the Keycloak `groups` claim
onto Joomla's standard usergroup IDs:
/roles/web-app-joomla/administrator -> Super Users (id 8)
/roles/web-app-joomla/editor -> Editor (id 4)
/roles/web-app-joomla -> Registered (id 2)
Users whose Keycloak groups match none of these paths are refused.
* Matrix-deploy variants flip the auth-flow gate: variant 0 is the
canonical OIDC variant (this commit's primary path), variant 1
flips OIDC off and LDAP on so Joomla's core LDAP authentication
plugin against svc-db-openldap is the exercised auth path.
* Role wiring:
- `tasks/07_oidc_plugin.yml` builds + installs the plugin idempotently.
- `templates/env.j2` propagates JOOMLA_OIDC_* env into the container.
- `meta/services.yml` enables `oidc` with `fallback_enabled: true`.
- `meta/rbac.yml` declares the `editor` role.
- `templates/playwright.env.j2` keys `OIDC_SERVICE_ENABLED` off
`services.oidc.enabled` for the Playwright test gate.
* Playwright e2e covers three scenarios:
- native OIDC redirect from `/` to Keycloak and back to Joomla,
- `/administrator?fallback=local` hatch bypassing Keycloak,
- LDAP variant against the core Joomla LDAP plugin.
* Documentation:
- `roles/web-app-joomla/README.md` rewritten per documentation.md
and readme_md.md (software-focused description, no em-dashes,
canonical Credits format).
- `roles/web-app-joomla/files/joomla-oidc-plugin/README.md` covers
plugin build, env contract, claimed routes, and watch points.
- `docs/requirements/013-alpha-to-beta-promotion.md` joomla
per-role-notes updated to reference the in-role plugin and the
Modus 3 fallback contract.
* `.github/dependabot.yml` adds the composer ecosystem entry that
covers the plugin's `composer.json`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`docs/requirements/014-svc-runner-ci.md` referenced three paths
(`cli/deploy/runner/`, `roles/svc-runner/`) that the document itself
defines as future acceptance criteria — they don't exist yet, so the
markdown-link-resolver test (`test_markdown_relative_links_resolve`)
hard-failed `make test` for the whole repo.
Drop the link syntax, keep the path as inline code. Same meaning, no
broken-link false positives.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mandates iteration via docs/agents/action/iteration/workflow.md +
role.md, batched clarifying questions only at the start, no mid-run
ask prompts, no interruptions, and a single end-of-run commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New requirements file 014-svc-runner-ci.md scoping a dedicated CI runner
role plus a cli/deploy/runner/ entry point (argparse-based) so CI can
run on a dedicated server instead of being bound by local hardware.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New requirements file 014-svc-runner-ci.md scoping a dedicated CI runner
role plus a cli/deploy/runner/ entry point (argparse-based) so CI can
run on a dedicated server instead of being bound by local hardware.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extend the local cache stack with three independent capabilities:
1. Inner-`dockerd` build coverage for HTTP-only package mirrors.
`roles/sys-svc-compose/files/compose.py` (the runner's `compose`
wrapper) auto-generates a transient `compose.cache.override.yml`
per app when `INFINITO_PACKAGE_CACHE_FRONTEND_IP` is exported. The
override pins `build.extra_hosts` for `deb.debian.org`,
`archive.ubuntu.com`, and `security.ubuntu.com` to the frontend.
`pull.py` now delegates to the wrapper so build/pull operations see
the same `-f` set the wrapper auto-detects. nginx in the frontend
gains a port-80 listener with path rewrites for those hostnames,
and `package.sh` registers two new Nexus proxies
(`apt-debian-security`, `apt-ubuntu-security`) for the security
suites whose upstream URL prefix differs from the main archive.
Alpine is intentionally excluded from the inner-build extra_hosts:
3.18+ defaults to HTTPS, and inner-`dockerd` build containers do
not import the frontend CA. Routing apk through the frontend would
trip TLS verification.
2. General cache freshness env-var. `scripts/meta/env/cache/package.sh`
exports `INFINITO_PACKAGE_CACHE_MAX_AGE_MIN` (default `129600`,
i.e. 90 days). The bootstrap helper consumes it for every Nexus
proxy's `contentMaxAge`, `metadataMaxAge`, and
`negativeCache.timeToLive`, replacing the previous 1440-minute
literal. Lower the value when chasing fast-moving upstreams.
3. SPOT cache documentation at `docs/contributing/environment/cache.md`.
`compose.yml.md`, `variables.md`, the per-service READMEs, and
`requirements/012-...` now link to it instead of restating the
stack's behaviour. Net documentation lines drop substantially while
the cache page becomes the single user-facing reference.
Also: code-comment cleanup per `docs/contributing/documentation.md`
guidelines across all touched .py / .sh / .yml files. Multi-paragraph
docstrings, banner separators, and restate-the-obvious comments are
removed; one-line WHY comments remain where the rationale is not
already visible in the code.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add a TLS-terminating reverse proxy in front of the Sonatype Nexus 3 OSS
pull-through cache so the `infinito` runner can hit upstream
package-manager URLs (pypi.org, registry.npmjs.org, rubygems.org,
repo.packagist.org, proxy.golang.org, dl-cdn.alpinelinux.org,
files.pythonhosted.org, raw.githubusercontent.com, codeload.github.com)
unchanged and still flow through Nexus.
Mechanism:
* scripts/docker/cache/package-frontend-certs.sh — host-side helper,
idempotently generates a dedicated CA + per-hostname leaf certs.
* compose/package-cache-frontend/upstreams.conf — nginx server-blocks
that match SNI per hostname and reverse-proxy onto the matching
Nexus repo path.
* compose/cache.override.yml `infinito.extra_hosts` — DNS-hijack so
the runner's clients resolve each upstream onto the frontend's
static IP.
* scripts/docker/cache/package-frontend-ca.sh — runner-side helper,
drops the CA into the system trust store post-startup so apt/pip/
curl/etc. accept TLS against the hijacked hostnames.
* cli/deploy/development/compose.py — orchestrates cert gen before
compose-up, CA install after health.
Scope today: runner-only. App-service Dockerfile builds executed by
the inner dockerd are NOT routed through the frontend; that requires
build-time CA injection and is deferred.
Also extends scripts/docker/cache/package.sh with five additional
Nexus proxies registered for transparent use: gem-proxy, go-proxy,
yum-rocky, yum-fedora, raw-packagist, raw-alpine, raw-codeload-github.
Refactor: move all cache services + runner-side cache mounts/depends_on/
extra_hosts from compose.yml into compose/cache.override.yml. Base
compose.yml now describes only the bare CI/runtime stack (coredns +
infinito). The override file is the single gate for the cache stack;
`profiles: ["cache"]` attributes and `--profile cache` flag emission
were redundant once file inclusion controls existence and removed
accordingly.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Tracks the promotion of 14 sub-beta web-* roles to lifecycle:
beta. Fixes the in-scope set, per-role OIDC/LDAP/RBAC integration
notes, the Playwright testing gate (oidc/ldap variants, multi-app
fresh deploy, capstone full-cycle), and the autonomous execution
procedure with a single final commit on feature/alpha-to-beta.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
