web-app-matrix forces compose mode for its own ansible flavor; when it
was the first consumer to lazy-load the object-store provider, the
include_role inherited that override and web-app-seaweedfs came up via
compose up instead of docker stack deploy, so seaweedfs_seaweedfs never
existed and the next consumer's bucket provisioning died on
resolve-container-id. Neutralize compose_mode_force on the lazy
provider includes of sys-svc-objstore and sys-svc-engine, matching the
neutralization sys-svc-rdbms already carries.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add tests/lint/repository/test_name_emoji_and_length.py: every Ansible task
name and GitHub Actions workflow/job/step name must start with an emoji (first
char not 0-9/A-Za-z) and be <= 80 chars.
- emit emoji names at the source: cli/build/include generator now writes
"🔧 setup <app>" / "🚿 flush handlers after <app>" so generated
tasks/groups/*-roles.yml satisfy the convention too
- convert existing task/step/job/workflow names to emoji-prefixed, choosing a
task-fitting icon per action (📦 install, ✅ ensure, 🔍 probe, 🥾 bootstrap,
🚀 deploy, 🧩 service-module load, ⬇️ checkout, 📂 include-routines, ...)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The lazy object-store provider include cleared compose_repository_url with an inline literal "" to stop the consumer's repo coordinates leaking into the provider, but the compose-repository lint requires the URL to be a Jinja expression paired with compose_repository_ref. Express the empty clearing as "{{ '' }}" and pair it with an empty compose_repository_ref — same runtime effect (the object-store provider is image-based, no git clone), now lint-clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A consumer (e.g. web-app-openproject) sets compose_repository_url + pull=true
and database_consumer_id; sys-svc-objstore then lazily loads the shared
object-store provider (web-app-seaweedfs), which inherited those and tried to
clone the consumer's repo / target the consumer's DB under its own
application_id, failing the play. Pin the provider's own context (empty repo
url, no pull, provider's own database_consumer_id) on the lazy provider
include so it runs self-contained; the consumer's own clone is unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a database-style object-store abstraction: the objstore lookup resolves the active engine (seaweedfs|minio) per consumer and yields a uniform S3 payload, objstore_secret_key is auto-generated like database_password, sys-svc-objstore delegates per-consumer provisioning to the resolved provider's objstore_init entrypoint (lazy-loading the provider when it was not preloaded), and compose/network/volume plumbing supports both a shared central instance and an embedded storage-only instance per consumer.
Add the web-app-seaweedfs provider role: Filer and Master UIs behind the admin-only oauth2-proxy via a role-local nginx and proxy.conf.j2 (S3 API domain stays ungated, admin UIs deny with 403 when SSO is disabled), per-consumer S3 identities from s3.json, idempotent bucket provisioning via weed shell, a /24 on the central-provider subnet range, Playwright coverage for admin/biber/guest plus consumer bucket existence, and unit tests for the objstore lookup and the per-engine compose volumes.
Mark web-app-minio lifecycle: unsupported, move its mc client image into a dedicated services.client entry, align it with the objstore credential contract, and make its consumer provisioning idempotent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 4.8