Resolves the runner Dockerfile to the lint-standard Acquire::Retries=3
and keeps the collabora TODO wording; hardens the merged tree for the
stricter lints (apt retries in the tor Dockerfile, shell-or-true
markers, comment cleanup).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A transient Debian/Ubuntu mirror fetch aborts a docker build layer with exit 100 (it killed the web-app-nextcloud swarm openldap build while the same image built fine elsewhere). New lint under tests/lint/docker/dockerfile/apt/ flags any RUN with apt-get update/install that omits Acquire::Retries; retrofit all 15 apt Dockerfiles with -o Acquire::Retries=3. Both apt lints move into the apt/ subpackage. dnf retries by default and apk has no equivalent flag, so both stay out of scope.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
BookWyrm core has no OIDC/LDAP login, so behind the oauth2-proxy a gated visitor only reaches BookWyrm's own login form. Add a trusted-header SSO bridge (files/sso/header_auth.py: RemoteUser middleware + backend) that turns the oauth2-proxy identity (X-Forwarded-Preferred-Username, set by Keycloak after OIDC or LDAP-federated login) into a real BookWyrm session, auto-provisioning the local user. Active only when PROXY_HEADER_SSO is truthy (= sso is_proxy_gated, centralised in BOOKWYRM_SSO_PROXY_GATED).
Supporting fixes: USE_S3_FOR_EXPORTS=false (exports stay local; SeaweedFS has no per-bucket ACL so private exports must not share the public media bucket) fixes the fresh-build settings crash / preferences 502; proxy_pass_request_body off on the keycloak sso_proxy /oauth2/ block so the auth_request subrequest no longer hangs 60s on gated POST bodies (504->500); split playwright.spec.js into per-test files; add positive (oidc/ldap -> authenticated session) + negative (forged header -> gated) SSO e2e tests; fix the avatar test (form-scoped Save locator + valid PNG); remove dead BookWyrm OIDC_* env; unit tests for the bridge + the gated settings patch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Move `rm -rf /var/lib/apt/lists/*` before `apt-get update` in every
Debian-based Dockerfile so a stale base-image-baked InRelease
(Valid-Until expired) cannot abort the build layer with exit 100. The
trailing rm at end-of-RUN never ran because `apt-get update` aborted
first; the leading rm forces a fresh fetch from the configured source.
Affected: moodle, bridgy-fed, bookwyrm (2 RUN), postmarks, taiga
backend, svc-db-openldap, svc-db-postgres, jenkins, joomla, mediawiki,
odoo, suitecrm (2 RUN), wordpress.
Add tests/lint/docker/dockerfile/test_apt_update_purge_lists.py to
enforce the contract repo-wide: every `RUN` containing `apt-get
update` MUST `rm -rf /var/lib/apt/lists/*` first in the same RUN, and
MUST NOT pass `Acquire::Check-Valid-Until=false` (which would silence
apt's replay-protection rather than refresh the list).
Rename roles/web-app-taiga/templates/Dockerfile.{back,front}.j2 to
Dockerfile.{backend,frontend}.j2 and update the matching tasks/
main.yml template refs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
BookWyrm v0.8.5 dropped requirements.txt and now declares its runtime
dependencies in pyproject.toml under [dependency-groups]. The previous
build step `pip wheel --wheel-dir /wheels -r requirements.txt` failed
the first reuse-kept deploy with `Could not open requirements file`.
Re-shape the image around the upstream pattern:
* Builder installs pip>=25.1 (PEP 735 support) then `pip install --group main`
into an isolated `/venv`. The runtime stage copies that venv via
`COPY --from=builder /venv /venv` and puts it on PATH; no offline
wheelhouse layer in between.
* Add `libsass-dev` + `SYSTEM_SASS=True` to the build stage so the
Python libsass package links against the distro library instead of
spending ~25 min compiling its own copy on arm64. Match with
`libsass1` on the runtime stage.
* Add `gettext` + `tidy` to both stages (i18n + HTML sanitisation that
BookWyrm runs at request time).
* `chown` the venv to the unprivileged `bookwyrm` user so .pyc
compile-on-import works after the USER switch.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Disentangle the docker-image vs source-repository dimensions in
`meta/services.yml`:
* `image` + `version` → OCI image used as `FROM image:version` (and
the final stage). Matches the existing convention used by every
pre-built role.
* `repository` + `ref` → git source clone. `ref` is the umbrella term
for tag / branch / commit SHA (matches `git ls-remote`,
GitHub Actions `with: { ref }`, GitLab CI `ref:` etc.), avoiding
the misleading "tag" when the value is a branch.
Propagation:
* `vars/main.yml`: `BOOKWYRM_IMAGE` + `BOOKWYRM_VERSION` +
`BOOKWYRM_REPOSITORY` + `BOOKWYRM_REF`. The custom image is now
tagged with `BOOKWYRM_REF` so the in-registry tag reflects the
upstream source revision (more useful than the base-image tag).
* `compose.yml.j2`: passes all four through as build args.
* `files/Dockerfile`: `ARG BOOKWYRM_IMAGE/VERSION/REPOSITORY/REF`,
both `FROM` stages use `${BOOKWYRM_IMAGE}:${BOOKWYRM_VERSION}`,
`git clone --branch "${BOOKWYRM_REF}" "${BOOKWYRM_REPOSITORY}"`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Fable 5
Environment TestandClaude Sonnet 4.6