Replaces inline `applications`/`users` merging with dedicated lookup
plugins and runtime hydration. Introduces `add_csp_hash` filter,
integrates sort into `find_dock_val_by_bkp_entr`, splits the Keycloak
one-shot realm import into `05a_realm_import_run.yml`, and fixes the
Mastodon administrator task YAML. Removes obsolete `csp_hashes` filter,
`sys-token-store` Jinja filter, and empty CLI setup modules.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces role-local `kcadm_json` filter + `module_utils/kcadm_json.py` to reliably parse kcadm output with JVM noise, and reuses it in `keycloak_kcadm_update` and LDAP/RBAC/recaptcha tasks to eliminate jq/`--query`. Also refactors LDAP groups.path handling via `include_tasks` to avoid repeated `when` conditions and adds unit tests for filter/module utils/library behavior.
https://chatgpt.com/share/69743d89-b1c0-800f-b571-90f64605dfe4
Ensure the ldap-roles group mapper always uses the correct parent group id
by injecting groups.path.group based on the actual Keycloak group.
Trigger LDAP → Keycloak group synchronization via a handler whenever the
mapper configuration changes, ensuring deterministic and reproducible
group imports under /roles.
https://chatgpt.com/share/696d02b4-1418-800f-8fe5-864f4e7494e8
* Run LDAP assertions only when MODE_ASSERT is enabled (guarded at include level)
* Remove redundant MODE_ASSERT conditions inside assert/05_ldap.yml
* Simplify mapper-id refresh logic by relying on the surrounding block condition
https://chatgpt.com/share/694927e3-2794-800f-9bc7-749c1e32a541
- Resolve LDAP UserStorageProvider via client-side filtering (avoid unreliable kcadm --query)
- Enforce exactly one canonical 'ldap-roles' LDAP mapper per LDAP component
- Deterministically deduplicate existing ldap-roles mappers (lexicographic id order)
- Safely parse created mapper id and fallback to authoritative refresh
- Add read-only assert tasks to validate LDAP, mapper uniqueness, groups.path and top-level group
- Wire LDAP asserts into role execution when MODE_ASSERT is enabled
- Improve idempotency, robustness and CI failure diagnostics
https://chatgpt.com/share/69487ed5-3b58-800f-8ac6-bbb1bbe3688a
Implements automated merging of kc.user.profile.config using the generic _update.yml handler.
Fixes missing safety guard for components without a 'name' attribute and aligns providerId validation logic.
Reference: https://chatgpt.com/share/692b3337-a224-800f-8617-32f47a5af1df
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
kevinveenbirkenbachandClaude Opus 4.6