- Remove legacy FILE_VERSION path usage
- Add custom lookup plugin `version` to read pyproject.toml
- Resolve version via [project].version with poetry fallback
- Refactor sys-version role to use lookup('version')
- Add unit tests for version lookup plugin
https://chatgpt.com/share/e/699433f7-1278-8013-af8e-da1b7f303886
* explicitly merge DOMAIN_PRIMARY as canonical domain for svc-prx-openresty into CURRENT_PLAY_DOMAINS
* prevents tls lookup failures when rendering default_server.conf.j2
* stabilize domain mapping for webserver + OpenResty bootstrap phase
* normalize ansible.builtin.set_fact usage in constructor stage
* minor whitespace alignment in WEBSERVER_CPUS_EFFECTIVE
https://chatgpt.com/share/698de3f8-2d50-800f-ab99-edcce4f0734a
* add SOFTWARE_DOMAIN derived from SOFTWARE_NAME lowercased
* introduce DOMAIN_HOMEPAGE defaulting to dashboard domain if present, otherwise SOFTWARE_DOMAIN
* add automatic primary → homepage redirect mapping in constructor
* migrate TLS and CA paths from SOFTWARE_NAME|lower to SOFTWARE_DOMAIN
* update systemd unit suffix and timer/service discovery globs to SOFTWARE_DOMAIN
* switch OIDC default realm and client id to SOFTWARE_DOMAIN
* adjust SuiteCRM well-known software name to SOFTWARE_DOMAIN
* update unit tests to use SOFTWARE_DOMAIN for strict Jinja expansion
https://chatgpt.com/share/698db094-22bc-800f-8454-10d97f817659
* replace compose.services.desktop with compose.services.dashboard across all roles
* rename role web-app-desktop to web-app-dashboard
* rename sys-front-inj-desktop to sys-front-inj-dashboard
* update resolver mapping to include web-app-dashboard when dashboard is enabled
* adjust CSP filters to reference dashboard for frame-ancestors handling
* update lookup plugins, filter plugins, templates, vars and run_once flags
* migrate all tests to dashboard naming and service key
* update role dependencies and port mappings
* remove legacy desktop role and variables
BREAKING CHANGE:
The service key compose.services.desktop has been renamed to compose.services.dashboard.
All custom configs, inventories, or overrides must be updated accordingly.
https://chatgpt.com/share/698da7ad-1978-800f-82b4-4755b17be026
Replace usages of the get_app_conf filter with the config lookup plugin
across roles and templates. Adjust quoting where required to keep YAML
and Jinja syntax valid. No functional changes intended.
https://chatgpt.com/share/69860678-cef8-800f-8402-7fe6231fdc2d
The TLS lookup has been renamed from `tls_resolve` to `tls` to better
reflect its responsibility as a strict TLS state resolver.
This refactor updates all usages across the codebase, including:
- lookup plugins and internal helpers
- roles, vars, tasks, and templates
- tests, stubs, and error messages
- documentation and changelog references
Behavior, lookup API, and semantics remain unchanged.
https://chatgpt.com/share/6985e635-5a94-800f-b794-937e566ee308
Migrate all lookup() usages from the deprecated want= keyword argument to the
new strict positional want-path API. Update call order where required
(e.g. nginx_paths) and ensure consistency across vars, tasks, and templates.
https://chatgpt.com/share/6985d642-b40c-800f-9cdf-ed54fc484a92
Renamed docker-compose and docker-compose-ca roles to sys-svc-compose and sys-svc-compose-ca, updated template includes, handlers, lookups, tests, and variables, and moved compose instances to /opt/compose.
https://chatgpt.com/share/6985ab2c-8344-800f-9e9a-768f562d138d
- Add MAILU_OIDC_HOST derived from Keycloak domain
- Inject extra_hosts mapping to host-gateway for OIDC when DOCKER_IN_CONTAINER is enabled
- Keep DNS resolver configuration unchanged
- Normalize newline handling in OIDC defaults
https://chatgpt.com/share/697ff9c9-3428-800f-9771-54409bd98b3e
- Rename infinito-compose wrapper to compose-base across roles and tests
- Introduce DOCKER_CMD_BASE as global base command configuration
- Update sys-ctl-mtn-cert-deploy to use compose_cmd consistently
- Fix compose wrapper argument parsing by enforcing "--" passthrough
- Harden project name resolution for trailing-slash instance paths
- Align docker restart helper scripts with compose-base naming
- Update unit tests to reflect renamed wrapper and new paths
https://chatgpt.com/share/697cf057-bd04-800f-9117-c007088f7fb8
Move `with-ca-trust.sh` to `sys-ca-selfsigned` as the single source of truth, add `CA_TRUST_NAME`/`trust_name`, and pass it through `compose_ca_inject.py` + `compose_ca_inject_cmd`. Introduce `module_utils/templating.py` for strict multi-pass rendering with fallback env lookup, update TLS self-signed regen logic, purge script, and extend unit tests accordingly.
https://chatgpt.com/share/697c876d-7140-800f-9981-762dfeeafdfe
Adds an integration test that fails when a service defines `build:` without an `image:` on the same indentation level. This enforces stable image names for tooling like CA-injection and makes compose behavior more predictable.
https://chatgpt.com/share/697bb4af-0d58-800f-8edd-aaef4c224319
Move TLS/ACME/CA vars out of 00_general into group_vars/all/02_tls.yml and renumber subsequent group_vars files. Add sys-ca-selfsigned to generate /etc/<software>/ca/root-ca.crt and make docker-compose-ca depend on it. Update setup script, templates, and tests to use the new applications/users file numbering.
https://chatgpt.com/share/697b8150-22ac-800f-98b1-e063a659b684
- Normalize LDAP user filter to a canonical, valid LDAP form
- Keep LOGIN filter composition consistent across consumers
- Strip outer parentheses for Snipe-IT to avoid UI validation errors
- Align Nextcloud user directory condition handling
- Improve variable formatting and clarity in Snipe-IT role
https://chatgpt.com/share/6977bc80-cd10-800f-b51f-00768d8c8e3e
Introduce docker-compose-ca role with CA wrapper and inject script, add CA-aware compose override handling, and refactor compose pull/run logic to support multi-file projects. Update handlers, lookups, paths, and unit tests to consistently resolve TLS-driven CA injection without implicit defaults.
https://chatgpt.com/share/6973c00c-139c-800f-8ddb-e7d0cf5043fc
- Extract shared TLS logic into module_utils/tls_common
- Introduce cert_plan lookup for certificate paths and SAN computation
- Simplify tls_resolve to strict protocol/port/domain resolution only
- Add global self-signed certificate scope covering all domains
- Mount self-signed cert base into OpenResty container
- Update Nginx templates to use cert_plan for ssl_certificate paths
- Add comprehensive unit tests for tls_common, tls_resolve, and cert_plan
https://chatgpt.com/share/6972c568-9e8c-800f-b89a-a0061966f9a8
- Remove deprecated filter_plugins/tls.py and all dependent filters
- Introduce strict lookup plugin lookup_plugins/tls_resolve.py as single TLS authority
- Migrate all roles, templates, vars, and tasks to use tls_resolve (protocols, ports, URLs, cert paths)
- Enforce explicit TLS context (domains, applications, TLS_ENABLED, TLS_MODE)
- Support letsencrypt and self_signed with SAN handling and per-app overrides
- Update TLS provider roles to assert resolver state instead of setting facts
- Add comprehensive unit tests for tls_resolve lookup
https://chatgpt.com/share/6972b49b-b074-800f-a323-dd9fe69d02eb
with explicit per-application TLS resolution.
Key changes:
- Introduce sys-front-tls-layer as the single TLS abstraction
- Centralize certificate paths via TLS_CERT_FILE / TLS_KEY_FILE / TLS_CA_FILE
- Replace sys-svc-letsencrypt SSL templates with generic TLS layer includes
- Add tls_* Jinja filters (enabled, mode, protocol, port, websocket)
- Resolve TLS mode per application (letsencrypt | self_signed | off)
- Remove implicit defaults and WEB_* globals to fail fast on misconfiguration
- Support self-signed certificates with SAN awareness
- Make TLS behavior explicit and consistent across all roles
This decouples application logic from certificate providers and
allows switching TLS flavor without touching app roles.
https://chatgpt.com/share/69727c61-8e68-800f-a267-473a7e627978
- Force PYTHON=python3 for test-local-init to avoid missing venv python
- Rename test-local-inventory-init-all target to test-local-init
- Fix JSON quoting for --vars in local deploy scripts
- Add RUNTIME default to group_vars
- Improve debug output for initial host vars
- Update user hint in local run script
https://chatgpt.com/share/697222e1-5edc-800f-b9ab-511d8afc3142
Alejandro Roman
kevinveenbirkenbach