kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 19:01:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,682 Commits 8 Branches 78 Tags
fix/dev-python/python-upper-bound
Commit Graph
3 Commits
Author SHA1 Message Date
kevinveenbirkenbachandClaude Opus 5 c9d42d81ee build(jenkins): pin the MCP Server plugin to the version in use 
The plugin tracked :latest, so nothing recorded which version served the MCP
endpoint. The pin is the version read out of the running container's
MANIFEST.MF, and a redeploy read it back unchanged.

Only mcp-server is pinned. The other twenty plugins and the jenkins/jenkins:lts
image keep this role's existing convention; changing that is a separate concern.

The README also gains the Authorization subject section that belongs with the
earlier auth_subject commit. It was missed there and cannot be split off a file
without an interactive stage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-03 22:12:12 +02:00
kevinveenbirkenbachandClaude Opus 5 41efbeda11 feat(jenkins): serve MCP behind the controller's own credentials 
Pin the MCP Server plugin and let a boot hook mint the API token MCP
clients present, then take that token over into sys-token-store and
verify it against the controller before the deploy continues.

Wait for the controller to answer before probing. A JCasC change restarts
Jenkins, and the probe carries no retries of its own, so a single 5xx
during startup failed the deploy with a credential that was valid all
along.

Authenticate with HTTP Basic. The plugin offers no bearer, which is why
basic_auth entered the service contract instead of the role working
around it.

Assert the guarded surface, not the handshake: the plugin answers
initialize anonymously because that call is capability negotiation and
carries no data, while an unauthenticated tools/list is refused and
leaks no tool inventory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-02 22:18:02 +02:00
kevinveenbirkenbachandClaude Opus 4.7 91c57e0471 feat(req-013): alpha-to-beta promotion for 13 in-scope roles 
Promote akaunting, baserow, bluesky, bookwyrm, bridgy-fed, flowise,
fusiondirectory, jenkins, joomla, minio, postmarks, libretranslate, xmpp
from `lifecycle: alpha` to `lifecycle: beta` per requirement 013.
socialhome stays alpha (operator-excluded).

SSO/LDAP integration per role:
- minio + jenkins + joomla + fusiondirectory: native first-party paths
  (MINIO_IDENTITY_OPENID/_LDAP, oic-auth + ldap + role-strategy JCasC,
  plg_system_keycloak, LDAP-as-storage). All V0+V1 verified.
- akaunting, baserow, bookwyrm, flowise, postmarks, libretranslate:
  oauth2-proxy perimeter gate as universal glue path. Native in-app
  OIDC integrations deferred to follow-up issues #219 (Baserow),
  #220 (BookWyrm), #221 (Akaunting).
- bluesky: variant A+ login-broker (oauth2-proxy → broker → social-app)
  with AES-256-GCM-encrypted PDS app-passwords cached in-process
  (Keycloak user-attribute storage caused LDAP federation conflicts
  that broke other realm-clients' OIDC logins).
- xmpp: native ejabberd LDAP backend for both variants
  (mod_oauth2_client is contrib-only and deferred).
- bridgy-fed: documented SSO/LDAP/RBAC exception (federated source-
  platform auth, no local user table).

Project-wide bugfixes:
- web-app-oauth2-proxy: propagate X-Forwarded-User /
  -Preferred-Username / -Email / -Groups via auth_request_set bridge
  (set_xauthrequest + pass_user_headers in cfg + nginx headers in
  following_directives.conf). Benefits all 8 oauth2-proxy consumers.
- scripts/tests/deploy/local/deploy/fresh-kept-app.sh: bake
  `RUNTIME=dev` into the matrix-init host vars so the Playwright
  E2E gate fires (was silently skipped on kept-deploys).

From-scratch role implementations: jenkins (JCasC + plugin pre-bake +
JVM cacerts CA-trust entrypoint), fusiondirectory (LDAP-as-storage
compose), xmpp (ejabberd LDAP backend ejabberd.yml).

Verification:
- Per-role baseline: each in-scope role passed standalone V0/V1
  Playwright suites green.
- Multi-app fresh-purged-apps over all 13 in-scope roles
  (FULL_CYCLE=true): Pass 1 sync + Pass 2 async both `failed=0`,
  every role's Playwright suite green.

Doc 013 acceptance section reflects the divergences (oauth2-proxy
glue path, in-memory bluesky cache, deferred contrib modules) with
explicit follow-up issue references.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-02 12:47:01 +02:00