- Rename all docker-compose.yml templates to compose.yml
- Update override and CA override filenames accordingly
- Adjust compose wrapper, lookup plugins, filters and path helpers
- Update roles, tasks, handlers and scripts to use compose CLI
- Rewrite documentation and admin guides to reference compose
- Update unit and integration tests to expect compose.yml
- Keep internal variable keys for backward compatibility where needed
https://chatgpt.com/share/69870272-b168-800f-84c3-6417398e441f
- Switch all docker compose invocations to the compose wrapper
- Update comments, task names, and log messages accordingly
- Simplify handlers and tasks to rely on wrapper-managed flags and env files
- Align tests and documentation with compose-based workflow
https://chatgpt.com/share/69866ede-be2c-800f-94b0-bffcf8fed260
Replace usages of the get_app_conf filter with the config lookup plugin
across roles and templates. Adjust quoting where required to keep YAML
and Jinja syntax valid. No functional changes intended.
https://chatgpt.com/share/69860678-cef8-800f-8402-7fe6231fdc2d
Renamed docker-compose and docker-compose-ca roles to sys-svc-compose and sys-svc-compose-ca, updated template includes, handlers, lookups, tests, and variables, and moved compose instances to /opt/compose.
https://chatgpt.com/share/6985ab2c-8344-800f-9e9a-768f562d138d
- Replace lookup('docker', ..., want='...') with lookup('docker', ..., 'path')
- Allow both top-level keys (directories/files) and dotted paths
- Simplify docker lookup API and reduce lazy dict propagation
- Update unit tests to reflect new lookup semantics
https://chatgpt.com/share/6984ccea-8290-800f-a6d7-ec0e94df95a0
Remove implicit docker_compose variable usage and resolve all docker paths
(files, directories, env) via lookup('docker', application_id).
This prevents scope leakage, centralizes path resolution, and makes docker
context deterministic across roles and handlers.
https://chatgpt.com/share/6984ccea-8290-800f-a6d7-ec0e94df95a0
Replace attribute-style access (lookup('database', app).volume/.host/etc.)
with explicit want= lookups across docker-compose and matrix templates
to align with updated database lookup plugin interface.
https://chatgpt.com/share/6983ddfd-aee4-800f-bce9-18eca2144f25
- Generate firstname and lastname fields in CLI user setup
- Add meaningful default description including primary domain
- Pass firstname/lastname explicitly to OpenLDAP givenName/sn
- Remove LDAP-side fallbacks to item.key to ensure consistent user data
https://chatgpt.com/share/6978d573-a8c4-800f-8670-c9344f594a3a
- Replace users.*.full_name with firstname/lastname across inventory and roles
- Update desk-git configuration to use firstname + lastname for author identity
- Refactor OpenLDAP user provisioning:
- Stop setting userPassword via ldap_entry
- Always set passwords via ldap_passwd (server-side SSHA hashing)
- Add givenName support and align attributes with inetOrgPerson
- Improve administrator user metadata and descriptions
https://chatgpt.com/share/6978cebb-3c9c-800f-ac1b-d67920a9cb23
with explicit per-application TLS resolution.
Key changes:
- Introduce sys-front-tls-layer as the single TLS abstraction
- Centralize certificate paths via TLS_CERT_FILE / TLS_KEY_FILE / TLS_CA_FILE
- Replace sys-svc-letsencrypt SSL templates with generic TLS layer includes
- Add tls_* Jinja filters (enabled, mode, protocol, port, websocket)
- Resolve TLS mode per application (letsencrypt | self_signed | off)
- Remove implicit defaults and WEB_* globals to fail fast on misconfiguration
- Support self-signed certificates with SAN awareness
- Make TLS behavior explicit and consistent across all roles
This decouples application logic from certificate providers and
allows switching TLS flavor without touching app roles.
https://chatgpt.com/share/69727c61-8e68-800f-a267-473a7e627978
- ensure OpenProject runs in production mode only
- wait for web container before applying settings
- run pending migrations automatically before rails runner
- apply settings via rails runner stdin (robust quoting & booleans)
- introduce thread/db pool cap to prevent OOM (OPENPROJECT_DB_POOL / RAILS_MAX_THREADS)
- fix admin creation runner env handling
- wire application_id correctly into docker roles
- disable unnecessary git pull for openldap docker role
- remove obsolete Development.md
This prevents OpenProject boot crashes caused by excessive thread/db pools
derived from dynamic Postgres sizing and makes role execution deterministic.
https://chatgpt.com/share/697135bd-7630-800f-8e1b-573305df86f6
Replace legacy volumes*.yml.j2 includes with the new compose_volumes filter across roles.
Add YAML-safe serialization for Ansible/Jinja proxy types to avoid PyYAML representer errors.
Remove obsolete volumes templates and extend unit tests to enforce required database_volume behavior.
https://chatgpt.com/share/696c2722-fd30-800f-bf01-dfcd3cb7ba72
Load `memberof` and `refint` in `slapd.conf` before generating `cn=config` via `slaptest`, so the `memberOf` attribute is known and user entry updates no longer fail with “entry update failed”.
https://chatgpt.com/share/696be95b-68cc-800f-a883-fe2755a0a6cc
- Always emit reserved flag in generated users (default: false)
- Do not override existing user definitions via --reserved-usernames
- Normalize description default to empty string
- Align unit tests with new reserved semantics
- Fix YAML quoting and trailing newline issues
- Clean up minor formatting and config inconsistencies
https://chatgpt.com/share/696bb761-0048-800f-9cf7-aebd3fda75be
- Add LDAP.RBAC.EMPTY_MEMBER_DN placeholder for empty role groups (schema-compliant groupOfNames)
- Ensure RBAC role entries always contain at least one member
- Align users OU attribute with DN (ou=users)
- Switch Keycloak LDAP group/role mappers to DN-based membership
- Fix missing newline in Keycloak schema file
https://chatgpt.com/share/696b7226-7c18-800f-a0b0-59068bb69d9f
- Change --log flag to require explicit log directory (--log <LOG_DIR>)
- Automatically create log directory with parents=True
- Harden permissions best-effort (0700)
- Update CLI help text accordingly
- Adjust Makefile test targets to pass explicit log directory
- Ignore logs/ via .gitignore and .dockerignore
- Refactor flag parsing to correctly detect deploy with --log
- Add dedicated logging unit tests
- Update existing tests for new log semantics
- Remove deprecated -i alias for --id in deploy command
https://chatgpt.com/share/6969680a-dbf8-800f-aafb-3d32d6212ba0
Grant `${LDAP_ROOT_DN}` manage rights on the `config` database (in addition to SASL EXTERNAL) so tools like `ldapsm` can read/write `cn=config` over LDAP and no longer fail with “No such object”.
https://chatgpt.com/share/6966da0f-b458-800f-8e40-97a919b976f5
- Normalize OPENLDAP_MODULE_DN to always include ,cn=config suffix
- Normalize OPENLDAP_DATA_BACKEND_DN to always include ,cn=config suffix
- Prevent ldapmodify/ldapadd failures due to missing superior DN
https://chatgpt.com/share/6966dc9d-03c8-800f-a9c7-e6d479694bb3
- Add explicit `database config` backend so cn=config is accessible via ldapi
- Fix access rules for EXTERNAL SASL on cn=config
- Resolve module DN from /etc/ldap/slapd.d instead of ldapsearch
- Simplify docker-compose role inclusion and network wiring
https://chatgpt.com/share/6966da0f-b458-800f-8e40-97a919b976f5
- Rework Docker image to start from a clean slapd.d and data dir
- Bootstrap cn=config via slaptest from generated slapd.conf
- Deterministic MDB initialization (creates data.mdb on first start)
- Enforce correct ownership and permissions for slapd, config, and DB
- Add logging and fatal guards for broken bootstrap states
- Make memberof check optional in healthcheck
- Ensure base LDAP tree and OUs via Ansible (root, people, groups, roles)
- Cleanup Docker hardening vars
Result: stable, reproducible OpenLDAP container startup with clean volumes.
https://chatgpt.com/share/6966b019-d604-800f-86c2-d6ee04129130
Migrate `svc-db-openldap` from `bitnamilegacy/openldap` to a locally built `infinito/openldap:local` image (Debian bookworm-slim) with a bootstrap `entrypoint.sh` that initializes `slapd.d` and an MDB backend from `LDAP_SUFFIX/LDAP_ROOT_DN/LDAP_ROOT_PW`.
* Add Dockerfile + entrypoint + healthcheck scripts
* Persist config + data in separate volumes (`/etc/ldap/slapd.d`, `/var/lib/ldap`)
* Switch cn=config operations to `ldapi:///` with SASL EXTERNAL (`-Q -Y EXTERNAL`)
* Simplify env template to only `LDAP_SUFFIX`, `LDAP_ROOT_DN`, `LDAP_ROOT_PW`
* Refactor docker init into `02_docker.yml` and update compose template (build context)
* Update LDAP tasks/handlers to use `OPENLDAP_BIND_DN/OPENLDAP_BIND_PW`
* Remove outdated Bitnami-specific docs and credential reset logic
https://chatgpt.com/share/6965c921-3304-800f-9e8f-d2f10d273f1b
Bitnami OpenLDAP images do not allow write access to cn=config via
SASL/EXTERNAL (peercred), even when executed as root. This caused
"Insufficient access (50)" errors during module, overlay and password
configuration.
Switch all cn=config modifications (modules, overlays, olcRootPW) to
simple bind authentication using the configuration admin DN and password.
This makes LDAP provisioning reliable across all distros and CI runners.
https://chatgpt.com/share/696574b0-ebac-800f-aee6-dfd9b27d74cd
Add support for ignoring individual run_once_* when-conditions if the same
line contains the marker comment:
# pass test_run_once_suffix_matches_role
This allows intentional cross-role run_once usage (e.g. shared provider
roles) without weakening the global schema enforcement.
Also document the exception behavior directly in the test.
https://chatgpt.com/share/69653e36-c058-800f-921d-b4af9014df04
fix(openldap): make memberof/refint provisioning idempotent and robust
Refactor OpenLDAP cn=config provisioning:
- load memberof and refint modules via ldapmodify
- add overlays via ldapadd with proper error handling
- make handlers idempotent (ignore duplicate/value-exists errors)
- dynamically resolve module DN and data backend DN (mdb/hdb)
- clean up legacy LDIF definitions
This fixes rc=80 handler failures and allows safe re-runs.
https://chatgpt.com/share/69653e42-e020-800f-a6c3-9c37ec5e8028
kevinveenbirkenbach