kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 03:38:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,682 Commits 7 Branches 78 Tags
fix/dev-python/python-upper-bound
Commit Graph
5 Commits
Author SHA1 Message Date
kevinveenbirkenbachandClaude Opus 4.8 00829757a0 feat(checkmk): pin to swarm manager so its node-local OMD volume survives 
The checkmk OMD site cannot live on NFS (fcntl locks return EBADF) and must stay node-local, but an unpinned single-replica service loses that data on a swarm reschedule. Pin checkmk to the manager so the task never leaves the node holding its data, and teach the nfs-false-data-loss lint to accept a manager-pinned role as justification (dropping checkmk's now-redundant per-volume opt-out).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 02:19:09 +02:00
kevinveenbirkenbachandClaude Opus 4.8 22a391ac56 test(lint): require data-loss justification for nfs: false volumes 
A node-local volume does not follow a swarm reschedule, so its data is lost on drain. Add a meta/volumes.yml lint that fails when a 'nfs: false' opt-out lacks both '# nocheck: nfs-false-data-loss' and a '# Reason:' arguing why that loss is acceptable. Justify the 10 existing entries (checkmk OMD site; gitlab repositories, logs, runtime state).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 01:03:05 +02:00
kevinveenbirkenbachandClaude Opus 4.8 485574bcae fix(checkmk): keep the OMD site store node-local (nfs:false) 
The OMD site config store uses fcntl.flock, which returns EBADF over NFS, so in swarm the checkmk site never serves and oauth2-proxy 502s. Opt checkmk_data out of the swarm NFS rewrite so it stays node-local.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 00:03:34 +02:00
kevinveenbirkenbach 9ee4cd0fb9 Merge branch 'main' of github.com:infinito-nexus/core into feature/swarm-nfs 
# Conflicts:
#	docs/agents/action/iteration/compose.md
#	roles/svc-db-openldap/vars/main.yml
#	roles/svc-runner/defaults/main.yml
#	roles/svc-runner/tasks/02_cleanup_instance.yml
#	roles/web-app-discourse/meta/server.yml
#	roles/web-app-mailu/tasks/01_core.yml
#	roles/web-app-odoo/tasks/main.yml
 2026-07-04 18:16:12 +02:00
kevinveenbirkenbachandClaude Opus 4.8 059232bd0d feat(web-app-checkmk): add Checkmk role with oauth2-proxy SSO + LDAP 
Implements requirement 029: web-app-checkmk deploying checkmk/check-mk-raw
2.4.0p32 (Raw/Community) behind sys-svc-proxy. No native OIDC, so SSO uses the
platform oauth2-proxy gate + Checkmk header-auth (auth_by_http_header =
X-Remote-User, injected by the role proxy.conf.j2 from $authrequest_username =
Keycloak preferred_username), plus a native LDAP connection for user records.
No external DB. Agent receiver (8000) host-port mapped via a new
PORT_BANDS.local.agent band.

Auth/LDAP/proxy mechanisms source-verified against Checkmk v2.4.0p32
(cmk/gui/auth.py, userdb/ldap_connector.py, userdb/_connections.py) and the
infinito sso_proxy nginx chain: fixed the LDAP file path (user_connections.mk)
and directory_type ("openldap"). LDAP sync timing and classic-GUI Playwright
selectors remain live-deploy-validation items (env-blocked).

Validation: make autoformat clean; make test green (lint, test-lint, test-unit,
test-integration 190, test-external).

Refs: docs/requirements/029-web-app-checkmk.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-29 02:35:08 +02:00