- rename mailu_password to mailu_user_password for clarity
- switch to shell execution to support proper argument quoting
- define correct changed_when/failed_when based on Mailu CLI behavior
- tolerate duplicate-user errors without failing the run
https://chatgpt.com/share/6974adda-1808-800f-8204-40d94a908bd0
Make has_domain filter self-contained (no module_utils/sys.path hacks) and let compose_f_args detect domains internally to avoid missing-filter failures. Adjust unit tests accordingly and increase Mailu user creation retry delay.
https://chatgpt.com/share/6973e02e-f22c-800f-aae3-1f57637a746c
- Remove deprecated filter_plugins/tls.py and all dependent filters
- Introduce strict lookup plugin lookup_plugins/tls_resolve.py as single TLS authority
- Migrate all roles, templates, vars, and tasks to use tls_resolve (protocols, ports, URLs, cert paths)
- Enforce explicit TLS context (domains, applications, TLS_ENABLED, TLS_MODE)
- Support letsencrypt and self_signed with SAN handling and per-app overrides
- Update TLS provider roles to assert resolver state instead of setting facts
- Add comprehensive unit tests for tls_resolve lookup
https://chatgpt.com/share/6972b49b-b074-800f-a323-dd9fe69d02eb
with explicit per-application TLS resolution.
Key changes:
- Introduce sys-front-tls-layer as the single TLS abstraction
- Centralize certificate paths via TLS_CERT_FILE / TLS_KEY_FILE / TLS_CA_FILE
- Replace sys-svc-letsencrypt SSL templates with generic TLS layer includes
- Add tls_* Jinja filters (enabled, mode, protocol, port, websocket)
- Resolve TLS mode per application (letsencrypt | self_signed | off)
- Remove implicit defaults and WEB_* globals to fail fast on misconfiguration
- Support self-signed certificates with SAN awareness
- Make TLS behavior explicit and consistent across all roles
This decouples application logic from certificate providers and
allows switching TLS flavor without touching app roles.
https://chatgpt.com/share/69727c61-8e68-800f-a267-473a7e627978
Replace legacy volumes*.yml.j2 includes with the new compose_volumes filter across roles.
Add YAML-safe serialization for Ansible/Jinja proxy types to avoid PyYAML representer errors.
Remove obsolete volumes templates and extend unit tests to enforce required database_volume behavior.
https://chatgpt.com/share/696c2722-fd30-800f-bf01-dfcd3cb7ba72
- move sys-token-store initialization to constructor stage
- remove duplicate token store includes from frontend and app roles
- allow Mailu reachability check to accept configurable status codes (200, 301)
- make Mailu health check consistent with web-app-mailu config
- increase test-local-rapid verbosity for better diagnostics
https://chatgpt.com/share/696c0f49-7888-800f-8175-fb21893c0d67
- Use SYSTEM_EMAIL_HOST as single canonical Mailu hostname
- Remove MAILU_HOSTNAMES list handling and related assertion
- Simplify Mailu env HOSTNAMES to single hostname
- Align Mailu server domain config with primary mail domain
- Ensure consistent hostname resolution across email + web services
https://chatgpt.com/share/696ac991-db50-800f-9d3c-ca41bdb7058a
Disable the Mailu webmail healthcheck when MODE_TEST is enabled to avoid
local AppArmor and startup timing issues on Manjaro during act-based CI
runs. This keeps production and GitHub CI behavior unchanged while
allowing reliable local testing.
Also introduce MODE_TEST flag in inventory and modes configuration.
https://chatgpt.com/share/6965806a-daa0-800f-ad9a-28ddf1c8eabc
* Move top-level features flags to docker.services.<feature>.enabled
* Replace features.local_ai with docker.services.ollama.shared for central AI networking
* Switch central LDAP network gating from docker.services.ldap.enabled to docker.services.ldap.shared
* Add per-app service feature entries like css, javascript, hcaptcha, recaptcha under docker.services
* Update Gitea to use derived GITEA_LDAP_ENABLED and adjust IAM conditions
https://chatgpt.com/share/69641f2f-5d6c-800f-8927-fdb3580e7964
- Make user roles optional and default to empty list
- Avoid failures when roles key is missing or null
- Centralize role-based logic via mailu_user_roles
- Ensure admin/user action selection remains consistent
https://chatgpt.com/share/695ea61f-2fc8-800f-adba-60b2f12763e8
- Replace DEFAULT_SYSTEM_EMAIL merge with flat SYSTEM_EMAIL_* variables
- Update templates across apps to new variable names
- Fix msmtp health check to use -t and local username fallback
- Improve postfix localhost config (localdomain, mydestination, timeouts)
- Extend sys-hostname to ensure /etc/hosts mapping once
https://chatgpt.com/share/695e8f39-0694-800f-b91c-a74f4b78d7c8
**Body**
* add sys-token-store filter plugin to hydrate users.*.tokens from persisted store (users win if non-empty)
* load token store during sys-token-store core run and inject hydrated tokens into users fact
* remove legacy lookup task and simplify docs + store path naming
* switch Matomo frontend injection to use hydrated users.administrator.tokens[web-app-matomo] directly
* ensure Mailu token handling uses sys-token-store write task and checks token presence via users.*.tokens
* add unittest for token hydration filter plugin with path-based module loading
- Switch SMTP port dynamically: 465 with TLS, 25 without TLS
- Disable SMTP AUTH automatically when TLS/STARTTLS is not enabled
- Bind Mailu SMTP ports to 0.0.0.0 in Docker-in-Docker environments
- Fix boolean handling in msmtp and Mobilizon SMTP templates
- Ensure plain SMTP (no TLS, no AUTH) works reliably in CI/test setups
https://chatgpt.com/share/69540941-279c-800f-a2b1-79a189c2bdcc
- replace localhost special-casing with valid FQDN (infinito.localhost)
- derive system email DOMAIN and HOST directly from DOMAIN_PRIMARY
- align Mailu TLS_FLAVOR with SYSTEM_EMAIL.TLS (mail vs notls)
- tie OIDC_VERIFY_SSL to TLS_ENABLED for consistent test/CI behavior
- update CI deploy script to use new primary domain
https://chatgpt.com/share/695311c0-fbe8-800f-8058-9d40a06b189a
* Replace global `SSL_ENABLED` flag with `TLS_ENABLED`
* Update web protocol/ports (http/https, ws/wss) to use `TLS_ENABLED`
* Switch cert-related roles and nginx TLS header gating to `TLS_ENABLED`
* Update app env templates (BookWyrm, Confluence, Jira, Magento, OpenProject, WordPress, etc.) to use `TLS_ENABLED`
* Adjust inventory generator to write `TLS_ENABLED` and update CLI help text accordingly
* Update unit tests for inventory vars overrides to expect `TLS_ENABLED`
https://chatgpt.com/share/695306ef-a798-800f-b118-e07b525e1811
- add explicit wait task for Mailu DB initialization (domain table)
- fail fast with last 300 lines of admin container logs if schema is missing
- prevent race condition between container startup and user creation
- rename manage_user task to keep execution order explicit
https://chatgpt.com/share/6952f1e3-3690-800f-950d-3ce55e90b6b4
- drop unused credentials.dkim_public_key from schema (runtime-generated only)
- switch Mailu API token to alphanumeric with stronger validation
- remove obsolete hard-restart todo entry
https://chatgpt.com/share/6952e8dd-fee8-800f-989d-5268b33caf02
- derive internal email domain with .localdomain fallback for localhost
- ensure valid email domains for local installations
- remove hardcoded administrator emails from all roles
- prepare roles to consume centrally defined system email settings
https://chatgpt.com/share/694c05d5-e8c0-800f-8d86-602aaa82be21
- add Matomo CLI-based installation using core:install
- wait for container readiness before installation
- split database and trusted hosts configuration into dedicated tasks
- move trusted_hosts patch into separate task file
- add site_name support via role configuration
- introduce users definition for Matomo administrator
- clean up formatting and minor config inconsistencies
https://chatgpt.com/share/6949818b-ad30-800f-95ba-c9c54ccd1ce8
This change removes --network=host usage, introduces DOCKER_IN_CONTAINER
for reliable environment detection, and replaces hardcoded localhost
bindings with an explicit DOCKER_BIND_HOST abstraction to avoid nftables
issues in CI/DiD environments.
https://chatgpt.com/share/69497616-7b00-800f-8fa3-ddc6eb9c5e98
Refactor proxy/webserver configuration variables to a consistent webserver_* naming scheme across roles. Replace legacy variables like proxy_extra_configuration, client_max_body_size, vhost_flavour, location_ws and ws_port with webserver_extra_configuration, webserver_client_max_body_size, webserver_vhost_flavour, webserver_websocket_location and webserver_websocket_port. Update NGINX vhost and location templates (html, upload, ws, basic, ws_generic) as well as callers (sys-front-inj-all, sys-stk-front-proxy, various web-app-* and web-svc-* roles) to use the new naming.
Tighten docker-compose Git repository handling by making docker_git_repository_pull depend on docker_git_repository_address being defined, a string and non-empty. This avoids accidental Git operations when the repository address is unset or of the wrong type.
Refactor the BigBlueButton role structure and fix deployment bugs: introduce 01_core.yml to orchestrate docker/proxy setup, database seeding, websocket map deployment, docker-compose overrides and admin/bootstrap logic in a single once-executed entrypoint. Rename supporting task files (02_docker-compose.yml, 03_administrator.yml, 04_dependencies.yml) and update tasks/main.yml to delegate via include_tasks with run_once_web_app_bigbluebutton. Improve Greenlight admin creation behavior by treating the 'Email has already been taken' error as a non-fatal, unchanged outcome and running user:set_admin_role as a fallback, both for the primary password and the OIDC starred-password path.
Also standardize vhost flavour selection for services like Mailu, Discourse, CDN, Collabora, Coturn, OnlyOffice, Simpleicons and web-svc-logout by explicitly passing webserver_vhost_flavour where needed and aligning client_max_body_size and websocket configuration with the new webserver_* variables.
Reference: ChatGPT conversation https://chatgpt.com/share/6931c530-bba8-800f-9997-dd61dc1d497b
This commit updates multiple roles to ensure compatibility with Ansible 2.20.
Several include paths and task-loading mechanisms required adjustments,
as Ansible 2.20 applies stricter evaluation rules for complex Jinja expressions
and no longer resolves certain relative include paths the way Ansible 2.18 did.
Key changes:
- Replaced legacy once_finalize.yml and once_flag.yml with the new structure
under tasks/utils/once/finalize.yml and tasks/utils/once/flag.yml.
- Updated all include_tasks statements to use 'path_join' with playbook_dir,
ensuring deterministic and absolute file resolution across roles.
- Fixed all network helper includes by converting direct relative paths such as
'roles/docker-compose/tasks/utils/network.yml' to proper Jinja-evaluated paths.
- Normalized MATOMO_* variable names for consistency with the updated variable
scope behavior in Ansible 2.20.
- Removed deprecated patterns that were implicitly supported in Ansible 2.18
but break under the more strict variable and path resolution model in 2.20.
These changes are part of the full migration step required to ensure the
infinito-nexus roles remain stable, deterministic, and forward-compatible with
Ansible 2.20.
Details of the discussion and reasoning can be found in this conversation:
https://chatgpt.com/share/69300a8d-24d4-800f-bec0-e895a695618a
- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml
- Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags
- Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers
- Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes
- Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy
- Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern
- Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files
- Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent
- Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations
- Add CSP3 support for style/script: include -elem and -attr directives
- Base (style-src, script-src) now unions elem/attr (CSP2/Safari fallback)
- Respect explicit base disables (e.g. style-src.unsafe-inline: false)
- Hashes only when 'unsafe-inline' absent in the final base tokens
- Nginx: set CSP only for HTML/worker via header_filter_by_lua_block; drop for subresources
- Remove per-location header_filter; keep body_filter only
- Update app role flags to *-attr where appropriate; extend desktop CSS sources
- Add comprehensive unit tests for union/explicit-disable/no-mirror-back
Ref: https://chatgpt.com/share/68f87a0a-cebc-800f-bb3e-8c8ab4dee8ee
• Rename: 02_create-user.yml → 02_manage_user.yml; 03_create-token.yml → 03a_manage_user_token.yml + 03b_create_user_token.yml
• Only (re)run sys-svc-msmtp when no-reply token exists; set run_once_sys_svc_msmtp=true in 01_core
• Reset by setting run_once_sys_svc_msmtp=false after creating no-reply token; then include sys-svc-msmtp
• Harden when-guards (no '{{ }}' in when, safe .get lookups)
• Minor formatting and failed_when readability
Conversation: https://chatgpt.com/share/68ebd196-a264-800f-a215-3a89d0f96c79
kevinveenbirkenbach