computer-playbook

14,682 Commits 8 Branches 78 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
kevinveenbirkenbachandClaude Opus 4.8	7dd22661d6	feat(web-app-bookwyrm): trusted-header SSO bridge + seaweedfs object-store fix BookWyrm core has no OIDC/LDAP login, so behind the oauth2-proxy a gated visitor only reaches BookWyrm's own login form. Add a trusted-header SSO bridge (files/sso/header_auth.py: RemoteUser middleware + backend) that turns the oauth2-proxy identity (X-Forwarded-Preferred-Username, set by Keycloak after OIDC or LDAP-federated login) into a real BookWyrm session, auto-provisioning the local user. Active only when PROXY_HEADER_SSO is truthy (= sso is_proxy_gated, centralised in BOOKWYRM_SSO_PROXY_GATED). Supporting fixes: USE_S3_FOR_EXPORTS=false (exports stay local; SeaweedFS has no per-bucket ACL so private exports must not share the public media bucket) fixes the fresh-build settings crash / preferences 502; proxy_pass_request_body off on the keycloak sso_proxy /oauth2/ block so the auth_request subrequest no longer hangs 60s on gated POST bodies (504->500); split playwright.spec.js into per-test files; add positive (oidc/ldap -> authenticated session) + negative (forged header -> gated) SSO e2e tests; fix the avatar test (form-scoped Save locator + valid PNG); remove dead BookWyrm OIDC_* env; unit tests for the bridge + the gated settings patch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-13 11:07:35 +02:00
kevinveenbirkenbach	bc56940e55	Implement initial BookWyrm role - Removed obsolete TODO.md - Added config/main.yml with service, feature, CSP, and registration settings - Added schema/main.yml defining vaulted SECRET_KEY (alphanumeric) - Added tasks/main.yml to load stateful stack - Added Dockerfile.j2 ensuring data/media dirs - Added docker-compose.yml.j2 with application, worker, redis, volumes - Added env.j2 with registration, secrets, DB, Redis, OIDC support - Extended vars/main.yml with BookWyrm variables and OIDC, Docker, Redis settings - Updated meta/main.yml with logo and run_after dependencies Ref: https://chatgpt.com/share/68b6c060-3a0c-800f-89f8-e114a16a4a80	2025-09-02 12:03:11 +02:00
kevinveenbirkenbach	2fccebbd1f	Enforce uppercase README.md and TODO.md filenames - Renamed all Readme.md → README.md - Renamed all Todo.md → TODO.md - Added integration test (tests/integration/test_filename_conventions.py) to automatically check naming convention. Background: Consistency in file naming (uppercase README.md and TODO.md) avoids issues with case-sensitive filesystems and ensures desktop cards (e.g. Pretix) are properly included. Ref: https://chatgpt.com/share/68b1d135-c688-800f-9441-46a3cbfee175	2025-08-29 18:11:53 +02:00

Author

SHA1

Message

Date

kevinveenbirkenbachandClaude Opus 4.8

7dd22661d6

feat(web-app-bookwyrm): trusted-header SSO bridge + seaweedfs object-store fix

BookWyrm core has no OIDC/LDAP login, so behind the oauth2-proxy a gated visitor only reaches BookWyrm's own login form. Add a trusted-header SSO bridge (files/sso/header_auth.py: RemoteUser middleware + backend) that turns the oauth2-proxy identity (X-Forwarded-Preferred-Username, set by Keycloak after OIDC or LDAP-federated login) into a real BookWyrm session, auto-provisioning the local user. Active only when PROXY_HEADER_SSO is truthy (= sso is_proxy_gated, centralised in BOOKWYRM_SSO_PROXY_GATED).

Supporting fixes: USE_S3_FOR_EXPORTS=false (exports stay local; SeaweedFS has no per-bucket ACL so private exports must not share the public media bucket) fixes the fresh-build settings crash / preferences 502; proxy_pass_request_body off on the keycloak sso_proxy /oauth2/ block so the auth_request subrequest no longer hangs 60s on gated POST bodies (504->500); split playwright.spec.js into per-test files; add positive (oidc/ldap -> authenticated session) + negative (forged header -> gated) SSO e2e tests; fix the avatar test (form-scoped Save locator + valid PNG); remove dead BookWyrm OIDC_* env; unit tests for the bridge + the gated settings patch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-13 11:07:35 +02:00

kevinveenbirkenbach

bc56940e55

Implement initial BookWyrm role

- Removed obsolete TODO.md
- Added config/main.yml with service, feature, CSP, and registration settings
- Added schema/main.yml defining vaulted SECRET_KEY (alphanumeric)
- Added tasks/main.yml to load stateful stack
- Added Dockerfile.j2 ensuring data/media dirs
- Added docker-compose.yml.j2 with application, worker, redis, volumes
- Added env.j2 with registration, secrets, DB, Redis, OIDC support
- Extended vars/main.yml with BookWyrm variables and OIDC, Docker, Redis settings
- Updated meta/main.yml with logo and run_after dependencies

Ref: https://chatgpt.com/share/68b6c060-3a0c-800f-89f8-e114a16a4a80

2025-09-02 12:03:11 +02:00

kevinveenbirkenbach

2fccebbd1f

Enforce uppercase README.md and TODO.md filenames

- Renamed all Readme.md → README.md
- Renamed all Todo.md → TODO.md
- Added integration test (tests/integration/test_filename_conventions.py) to automatically check naming convention.

Background:
Consistency in file naming (uppercase README.md and TODO.md) avoids issues with case-sensitive filesystems and ensures desktop cards (e.g. Pretix) are properly included.
Ref: https://chatgpt.com/share/68b1d135-c688-800f-9441-46a3cbfee175

2025-08-29 18:11:53 +02:00