- Persist CA_TRUST_* variables in /etc/environment for self-signed TLS
- Remove CA trust environment when switching to letsencrypt
- Enable container.py to auto-detect CA injection context via env
https://chatgpt.com/share/69864bf2-7830-800f-ae8a-dad17c4f6e13
Renamed docker-compose and docker-compose-ca roles to sys-svc-compose and sys-svc-compose-ca, updated template includes, handlers, lookups, tests, and variables, and moved compose instances to /opt/compose.
https://chatgpt.com/share/6985ab2c-8344-800f-9e9a-768f562d138d
Provide SSL_CERT_FILE / REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE as a fallback
when OS-level CA installation is not possible (e.g. non-root containers).
OS trust store installation is now best-effort and no longer hard-fails,
making with-ca-trust usable across mixed privilege Docker images.
https://chatgpt.com/share/697ceee0-4e48-800f-b4ed-d240fcb0968a
- Do not fail if no CA trust mechanism is available
- Log INFO instead of exiting with error in minimal environments
- Always exec wrapped command when provided
- Exit successfully in standalone (host install) mode
- Simplify trust detection logs and Arch/p11-kit handling
https://chatgpt.com/share/697ca66a-8310-800f-94fd-c0130e05e704
Move `with-ca-trust.sh` to `sys-ca-selfsigned` as the single source of truth, add `CA_TRUST_NAME`/`trust_name`, and pass it through `compose_ca_inject.py` + `compose_ca_inject_cmd`. Introduce `module_utils/templating.py` for strict multi-pass rendering with fallback env lookup, update TLS self-signed regen logic, purge script, and extend unit tests accordingly.
https://chatgpt.com/share/697c876d-7140-800f-9981-762dfeeafdfe
Move TLS/ACME/CA vars out of 00_general into group_vars/all/02_tls.yml and renumber subsequent group_vars files. Add sys-ca-selfsigned to generate /etc/<software>/ca/root-ca.crt and make docker-compose-ca depend on it. Update setup script, templates, and tests to use the new applications/users file numbering.
https://chatgpt.com/share/697b8150-22ac-800f-98b1-e063a659b684
kevinveenbirkenbach