Renamed docker-compose and docker-compose-ca roles to sys-svc-compose and sys-svc-compose-ca, updated template includes, handlers, lookups, tests, and variables, and moved compose instances to /opt/compose.
https://chatgpt.com/share/6985ab2c-8344-800f-9e9a-768f562d138d
- Replace lookup('docker', ..., want='...') with lookup('docker', ..., 'path')
- Allow both top-level keys (directories/files) and dotted paths
- Simplify docker lookup API and reduce lazy dict propagation
- Update unit tests to reflect new lookup semantics
https://chatgpt.com/share/6984ccea-8290-800f-a6d7-ec0e94df95a0
Remove implicit docker_compose variable usage and resolve all docker paths
(files, directories, env) via lookup('docker', application_id).
This prevents scope leakage, centralizes path resolution, and makes docker
context deterministic across roles and handlers.
https://chatgpt.com/share/6984ccea-8290-800f-a6d7-ec0e94df95a0
- Generate firstname and lastname fields in CLI user setup
- Add meaningful default description including primary domain
- Pass firstname/lastname explicitly to OpenLDAP givenName/sn
- Remove LDAP-side fallbacks to item.key to ensure consistent user data
https://chatgpt.com/share/6978d573-a8c4-800f-8670-c9344f594a3a
- Replace users.*.full_name with firstname/lastname across inventory and roles
- Update desk-git configuration to use firstname + lastname for author identity
- Refactor OpenLDAP user provisioning:
- Stop setting userPassword via ldap_entry
- Always set passwords via ldap_passwd (server-side SSHA hashing)
- Add givenName support and align attributes with inetOrgPerson
- Improve administrator user metadata and descriptions
https://chatgpt.com/share/6978cebb-3c9c-800f-ac1b-d67920a9cb23
- ensure OpenProject runs in production mode only
- wait for web container before applying settings
- run pending migrations automatically before rails runner
- apply settings via rails runner stdin (robust quoting & booleans)
- introduce thread/db pool cap to prevent OOM (OPENPROJECT_DB_POOL / RAILS_MAX_THREADS)
- fix admin creation runner env handling
- wire application_id correctly into docker roles
- disable unnecessary git pull for openldap docker role
- remove obsolete Development.md
This prevents OpenProject boot crashes caused by excessive thread/db pools
derived from dynamic Postgres sizing and makes role execution deterministic.
https://chatgpt.com/share/697135bd-7630-800f-8e1b-573305df86f6
- Always emit reserved flag in generated users (default: false)
- Do not override existing user definitions via --reserved-usernames
- Normalize description default to empty string
- Align unit tests with new reserved semantics
- Fix YAML quoting and trailing newline issues
- Clean up minor formatting and config inconsistencies
https://chatgpt.com/share/696bb761-0048-800f-9cf7-aebd3fda75be
- Add LDAP.RBAC.EMPTY_MEMBER_DN placeholder for empty role groups (schema-compliant groupOfNames)
- Ensure RBAC role entries always contain at least one member
- Align users OU attribute with DN (ou=users)
- Switch Keycloak LDAP group/role mappers to DN-based membership
- Fix missing newline in Keycloak schema file
https://chatgpt.com/share/696b7226-7c18-800f-a0b0-59068bb69d9f
- Normalize OPENLDAP_MODULE_DN to always include ,cn=config suffix
- Normalize OPENLDAP_DATA_BACKEND_DN to always include ,cn=config suffix
- Prevent ldapmodify/ldapadd failures due to missing superior DN
https://chatgpt.com/share/6966dc9d-03c8-800f-a9c7-e6d479694bb3
- Add explicit `database config` backend so cn=config is accessible via ldapi
- Fix access rules for EXTERNAL SASL on cn=config
- Resolve module DN from /etc/ldap/slapd.d instead of ldapsearch
- Simplify docker-compose role inclusion and network wiring
https://chatgpt.com/share/6966da0f-b458-800f-8e40-97a919b976f5
- Rework Docker image to start from a clean slapd.d and data dir
- Bootstrap cn=config via slaptest from generated slapd.conf
- Deterministic MDB initialization (creates data.mdb on first start)
- Enforce correct ownership and permissions for slapd, config, and DB
- Add logging and fatal guards for broken bootstrap states
- Make memberof check optional in healthcheck
- Ensure base LDAP tree and OUs via Ansible (root, people, groups, roles)
- Cleanup Docker hardening vars
Result: stable, reproducible OpenLDAP container startup with clean volumes.
https://chatgpt.com/share/6966b019-d604-800f-86c2-d6ee04129130
Migrate `svc-db-openldap` from `bitnamilegacy/openldap` to a locally built `infinito/openldap:local` image (Debian bookworm-slim) with a bootstrap `entrypoint.sh` that initializes `slapd.d` and an MDB backend from `LDAP_SUFFIX/LDAP_ROOT_DN/LDAP_ROOT_PW`.
* Add Dockerfile + entrypoint + healthcheck scripts
* Persist config + data in separate volumes (`/etc/ldap/slapd.d`, `/var/lib/ldap`)
* Switch cn=config operations to `ldapi:///` with SASL EXTERNAL (`-Q -Y EXTERNAL`)
* Simplify env template to only `LDAP_SUFFIX`, `LDAP_ROOT_DN`, `LDAP_ROOT_PW`
* Refactor docker init into `02_docker.yml` and update compose template (build context)
* Update LDAP tasks/handlers to use `OPENLDAP_BIND_DN/OPENLDAP_BIND_PW`
* Remove outdated Bitnami-specific docs and credential reset logic
https://chatgpt.com/share/6965c921-3304-800f-9e8f-d2f10d273f1b
Bitnami OpenLDAP images do not allow write access to cn=config via
SASL/EXTERNAL (peercred), even when executed as root. This caused
"Insufficient access (50)" errors during module, overlay and password
configuration.
Switch all cn=config modifications (modules, overlays, olcRootPW) to
simple bind authentication using the configuration admin DN and password.
This makes LDAP provisioning reliable across all distros and CI runners.
https://chatgpt.com/share/696574b0-ebac-800f-aee6-dfd9b27d74cd
Add support for ignoring individual run_once_* when-conditions if the same
line contains the marker comment:
# pass test_run_once_suffix_matches_role
This allows intentional cross-role run_once usage (e.g. shared provider
roles) without weakening the global schema enforcement.
Also document the exception behavior directly in the test.
https://chatgpt.com/share/69653e36-c058-800f-921d-b4af9014df04
fix(openldap): make memberof/refint provisioning idempotent and robust
Refactor OpenLDAP cn=config provisioning:
- load memberof and refint modules via ldapmodify
- add overlays via ldapadd with proper error handling
- make handlers idempotent (ignore duplicate/value-exists errors)
- dynamically resolve module DN and data backend DN (mdb/hdb)
- clean up legacy LDIF definitions
This fixes rc=80 handler failures and allows safe re-runs.
https://chatgpt.com/share/69653e42-e020-800f-a6c3-9c37ec5e8028
Install distro-specific OpenLDAP, SASL, SSL, libffi and build toolchain packages
(Arch, Debian/Ubuntu, Fedora/CentOS) before installing python-ldap to ensure the
module can be built and imported in the Ansible runtime.
https://chatgpt.com/share/6964335a-29cc-800f-ae65-6a35c7cd2559
- Add global_install flag to sys-pip-install role (default: false)
- Allow optional system-wide installs via pip3 with --break-system-packages
- Install python-ldap via pip in Ansible interpreter for OpenLDAP role
- Refactor svc-db-openldap tasks into 01_core.yml with run-once gating
- Fix environment handling for conditional global pip installs
- Enable global pip installs for CLI tools (gitcon, ldapsm, backup tools, cleanup tools)
https://chatgpt.com/share/6963dd5d-cae0-800f-b8d7-82a3808be634
Introduce DOCKER_REACH_HOST as a single source of truth for service
reachability checks (wait_for), decoupled from DOCKER_BIND_HOST.
- Default reach host is 127.0.0.1 for host-based execution
- Automatically override to Docker bridge gateway when running
inside a container (Docker socket mounted)
- Add custom docker_bridge_gateway module for reliable detection
- Update all wait_for tasks to use DOCKER_REACH_HOST
- Remove ad-hoc debug TCP probing logic
This ensures consistent behavior across host runs and
container-based control nodes without breaking existing setups.
https://chatgpt.com/share/694aaf8b-1fe4-800f-88ac-b5f6e508a2e3
Migrate most roles from community.general.pacman to the generic package module for better portability. Keep pacman where it is required (system upgrades and Arch-specific tasks). Split VirtualBox setup into an Arch-only task file and add a warning when skipped on non-Arch systems. Update integration test examples accordingly.
https://chatgpt.com/share/6947ce9f-3228-800f-8365-2253b5ed9451
This commit updates multiple roles to ensure compatibility with Ansible 2.20.
Several include paths and task-loading mechanisms required adjustments,
as Ansible 2.20 applies stricter evaluation rules for complex Jinja expressions
and no longer resolves certain relative include paths the way Ansible 2.18 did.
Key changes:
- Replaced legacy once_finalize.yml and once_flag.yml with the new structure
under tasks/utils/once/finalize.yml and tasks/utils/once/flag.yml.
- Updated all include_tasks statements to use 'path_join' with playbook_dir,
ensuring deterministic and absolute file resolution across roles.
- Fixed all network helper includes by converting direct relative paths such as
'roles/docker-compose/tasks/utils/network.yml' to proper Jinja-evaluated paths.
- Normalized MATOMO_* variable names for consistency with the updated variable
scope behavior in Ansible 2.20.
- Removed deprecated patterns that were implicitly supported in Ansible 2.18
but break under the more strict variable and path resolution model in 2.20.
These changes are part of the full migration step required to ensure the
infinito-nexus roles remain stable, deterministic, and forward-compatible with
Ansible 2.20.
Details of the discussion and reasoning can be found in this conversation:
https://chatgpt.com/share/69300a8d-24d4-800f-bec0-e895a695618a
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
- Converted group_vars/all/13_ldap.yml from lower-case to ALL-CAPS nested keys.
- Updated all roles, tasks, templates, and filter_plugins to reference LDAP.* instead of ldap.*.
- Fixed Keycloak JSON templates to properly quote Jinja variables.
- Adjusted svc-db-openldap filter plugins and unit tests to handle new LDAP structure.
- Updated integration test to only check uniqueness of TOP-LEVEL ALL-CAPS constants, ignoring nested keys.
See: https://chatgpt.com/share/68b01017-efe0-800f-a508-7d7e2f1c8c8d
- Standardize async/poll usage with 'ASYNC_ENABLED | bool'
- Add async/poll parameters to Cloudflare, Nginx, Mailu, MIG, Nextcloud, and OpenLDAP tasks
- Update async configuration in 'group_vars/all/00_general.yml' to ensure boolean evaluation
- Allow CAA, cache, and DNS tasks to run asynchronously when enabled
https://chatgpt.com/share/689cd8cc-7fbc-800f-bd06-a667561573bf
- Introduce global async configuration in group_vars/all/00_general.yml:
- ASYNC_ENABLED (disabled in debug mode)
- ASYNC_TIME (default 300s, omitted if async disabled)
- ASYNC_POLL (0 for async fire-and-forget, 10 for sync mode)
- Replace hardcoded async/poll values with global vars in:
- svc-db-openldap (03_users.yml, 04_update.yml)
- web-app-mig (02_build_data.yml)
- web-app-nextcloud (03_admin.yml, 04_system_config.yml, 05_plugin.yml,
06_plugin_routines.yml, 07_plugin_enable_and_configure.yml)
- Guard changed_when and failed_when conditions to only evaluate in synchronous
mode to avoid accessing undefined rc/stdout/stderr in async runs
https://chatgpt.com/share/689cd8cc-7fbc-800f-bd06-a667561573bf
kevinveenbirkenbach