Follow-up to the initial web-app-jitsi commit. `make test` flagged 11
contract violations on the newly-added role; each is addressed here.
- group_vars/all/08_networks.yml: declare PORT_BANDS.public.media
(10000–10099) so the JVB media plane port (UDP/10000) falls in band.
- roles/web-app-jitsi/templates/env.j2: pipe every Jicofo/JVB/Jigasi/Jibri
XMPP password through `| dotenv_quote`.
- roles/web-app-jitsi/meta/services.yml: make `email` flag dynamic
(`'web-app-mailu' in group_names`) and add `# nocheck: dynamic-flag`
+ `# nocheck: playwright-service-flag` above `javascript:` (gated on
sso.enabled, not on group_names; runtime DOM patch, no probe-able
surface flag).
- roles/web-app-jitsi/meta/variants.yml: re-add explicit
email.enabled / email.shared pins per variant (variant-coverage rule
requires every dynamic flag to have both true- and false-pinning
variants).
- roles/web-app-jitsi/meta/schema.yml: drop unused jwt_app_secret
credential.
- roles/web-app-jitsi/vars/main.yml: drop unreferenced JITSI_HOSTNAME,
JITSI_WEB_PROTOCOL, JITSI_JWT_APP_SECRET.
- roles/web-app-jitsi/templates/playwright.env.j2: drop unused
ADMIN_EMAIL / JITSI_BASE_URL / OIDC_ISSUER_URL keys and collapse the
PERSONA_*_BLOCKED comment block to one line per key (env-file schema
rule allows at most one comment line above an entry).
- roles/web-app-jitsi/README.md: replace the dead
jitsi-contrib/prosody-plugins/tree/main/token_lobby URL with the
repository root.
Final result: `make test` 5/5 targets ✅ (186 tests OK),
`make autoformat` clean.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds the four-container Jitsi Meet stack (web, prosody, jicofo, jvb) with a
3-variant matrix: V1 oauth2-proxy gate + Keycloak LDAP federation, V2
no-auth anonymous, V3 direct prosody mod_auth_ldap2 against svc-db-openldap.
Auth model is oauth2-proxy at the reverse proxy because Jitsi has no
native OIDC adapter — JWT-via-Keycloak would require a custom token
server outside this repo. The role injects a fixed-position
`[data-injected-logout]` button via templates/javascript.js.j2 so the
no-built-in-logout React SPA satisfies the persona contract's
no-direct-URL logout rule. V2/V3 declare PERSONA_BIBER_BLOCKED /
PERSONA_ADMINISTRATOR_BLOCKED because the shared persona helpers only
model the OIDC redirect chain.
Final FULL-matrix `mode=reinstall full_cycle=true` run green across all
three variants (V1: 6/6 pass, V2/V3: 2 pass + 4 blocked skips).
Also lands utils/parse_trace.py — a small zipfile helper used during
the iteration to extract URL traces from playwright .trace bundles.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 4.7