* scripts/lint/autoformat.sh: rename AUTOFORMAT_PARALLEL to PARALLEL,
declare it at file start with default `true`; still env-overridable.
Reword the worker comment so the literal `# shellcheck` token no
longer appears at start-of-line and trips SC1072/SC1073.
* scripts/lint/galaxy.sh: drop the GALAXY_FATAL / GALAXY_NAMESPACE /
GALAXY_PARALLEL env vars (over-engineered for a single repo). Failure
is always fatal. NAMESPACE is an internal constant. Add the same
PARALLEL env var (default `true`, env-overridable); falsy demotes the
xargs fan-out to one worker.
* docs/contributing/environment/variables.md: collapse the four
AUTOFORMAT_*/GALAXY_* rows into one `PARALLEL` row covering both
consumers.
* docs/contributing/tools/make.md: refer to `PARALLEL=0` everywhere;
add the lint-galaxy parallelism note.
Plus working-tree drift across roles/, group_vars/, inventories/, and
tasks/ that accumulated from the make-test setup phase regenerating
generated artefacts during recent test runs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reintroduce the no_raw_docker integration test that was lost in the
flat-to-clustered tests/integration reorg, scoped to .yml/.yaml/.j2/.sh
and powered by utils.cache.files.iter_non_ignored_files plus read_text
so file enumeration respects .gitignore and content reads are
lru-cached. Catch two argv-/inline-form blind spots that the original
single-line regex missed (argv: - docker / shell: "docker exec ...")
and add a `no-raw-docker: skip` header marker for files where the
container wrapper is genuinely unavailable.
Apply the marker to the 6 GitHub-hosted-runner workflows that cannot
reach the wrapper, and rewrite the 7 role-task argv invocations
(BigBlueButton, Discourse, Matomo, Joomla 03/04/06) onto
'container' so the engine stays swappable.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Multi-round / re-deploy scenarios that change MariaDB credentials
between deploys (matrix-deploy round 2 against the same persistent
volume; rotated vault) deadlocked the matomo install at
"Wait for Matomo container to be healthy". The persistent
`config.ini.php` still carries the previous round's credentials,
matomo loops on `Could not connect to the database: Database access
denied`, the healthcheck never goes green, and the play aborts
before `04_patch_database.yml` can run.
Reorder `roles/web-app-matomo/tasks/01_core.yml`:
- Replace the early wait-for-healthy with a lightweight
wait-for-running (`Running: true`) so subsequent tasks have a
container they can `docker exec` into without depending on a DB
connection.
- Bootstrap (first install) and `04_patch_database.yml`
(re-deploy) run as before, in the same mutually-exclusive shape
driven by `matomo_config_exists`.
- Move wait-for-healthy AFTER the post-patch `flush_handlers`,
so the API-config phase (`06_config.yml`) is gated by an
explicit healthcheck on the patched container — strictly
better than the previous flow, where the API phase implicitly
relied on the initial healthcheck "lasting" through the
patch-driven restart.
Verified end-to-end via `deploy-fresh-purged-apps APPS="…" FULL_CYCLE=true`
matrix run with both rounds and both PASS 1/PASS 2 cycles green
(`failed=0 rescued=0` per round/pass) including round 2 / variant 1
(multisite WordPress) which exercises the cred-sync-after-restart
path that previously deadlocked.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Task-local `domain:` override does NOT shield against eager evaluation
of the role-layer `domain = lookup('domain', application_id)` template
when application_id is polluted in the role-vars layer by nested
include_role chains. Reverting to inline literal lookup in the shell
arg; task-local `application_id` pin stays (still needed for lazy
MATOMO_* var resolution).
Nested include_role chains (sys-stk-front-base → web-opt-rdr-domains /
svc-prx-openresty) pollute the role-vars layer and make {{ domain }} /
{{ MATOMO_* }} resolve against the wrong application_id. Task-level
vars take precedence over role vars, so pinning them here shields the
lookups from pollution.
Replaces inline `applications`/`users` merging with dedicated lookup
plugins and runtime hydration. Introduces `add_csp_hash` filter,
integrates sort into `find_dock_val_by_bkp_entr`, splits the Keycloak
one-shot realm import into `05a_realm_import_run.yml`, and fixes the
Mastodon administrator task YAML. Removes obsolete `csp_hashes` filter,
`sys-token-store` Jinja filter, and empty CLI setup modules.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extracts the shared frontend service loader from sys-front-inj-all into
tasks/utils/load_services.yml and tasks/utils/_load_frontend_service.yml,
called once from tasks/stages/02_server.yml before web-svc and web-app
roles. This decouples service loading from per-app injection and makes
load order explicit via SERVICE_REGISTRY entry order. Updates docs,
comments, and adds an integration test enforcing the new SPOT.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Introduces a SPOT for all frontend service loading in sys-front-inj-all/tasks/01_services.yml,
driven by a new generic `service` lookup plugin that resolves services by key or role name
and returns {id, role, enabled, shared, needed}. Needed = enabled AND shared (direct or
transitive). The canonical key→role mapping moves to group_vars/all/20_services.yml
(previously scattered hardcoded rules). Removes per-role service loads from bigbluebutton,
nextcloud, and dashboard. Renames 01_dependencies.yml→01_services.yml and
08_services.yml→08_daemons.yml. Adds flush_handlers after each service load.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Switch Matomo container healthcheck from curl to an internal PHP get_headers() check to avoid dependency on curl in the official image.
Accept HTTP 200 and 302 as healthy responses and increase start_period to 60s to prevent premature unhealthy states in slower CI environments.
https://chatgpt.com/share/698c5823-aa44-800f-978a-df9765e7f93d
Add retry logic with delay for the one-shot Matomo bootstrap, ensure change
is only reported on success, and provide a detailed but safe debug dump
(stdout/stderr lengths, effective compose config, env and compose files)
when the bootstrap ultimately fails.
https://chatgpt.com/share/698bc6e7-230c-800f-bd9a-b50494514db9
- Rename lookup plugin from `docker` to `container`
- Switch all lookups from `lookup('docker', ...)` to `lookup('container', ...)`
- Normalize compose file keys:
- docker_compose → compose
- docker_compose_override → compose_override
- docker_compose_ca_override → compose_ca_override
- Centralize compose path resolution via docker_paths_utils
- Update compose_file_args to always derive paths from DIR_COMPOSITIONS
- Align all roles, templates, and vars with container/compose naming
- Update and rename unit tests accordingly
This prepares the codebase for engine-agnostic container backends
(e.g. Docker ↔ Podman) and removes legacy docker-specific assumptions.
https://chatgpt.com/share/6987a7cc-d374-800f-99ad-bb4c8f92c59e
- Switch all docker compose invocations to the compose wrapper
- Update comments, task names, and log messages accordingly
- Simplify handlers and tasks to rely on wrapper-managed flags and env files
- Align tests and documentation with compose-based workflow
https://chatgpt.com/share/69866ede-be2c-800f-94b0-bffcf8fed260
- Replace lookup('docker', ..., want='...') with lookup('docker', ..., 'path')
- Allow both top-level keys (directories/files) and dotted paths
- Simplify docker lookup API and reduce lazy dict propagation
- Update unit tests to reflect new lookup semantics
https://chatgpt.com/share/6984ccea-8290-800f-a6d7-ec0e94df95a0
Remove implicit docker_compose variable usage and resolve all docker paths
(files, directories, env) via lookup('docker', application_id).
This prevents scope leakage, centralizes path resolution, and makes docker
context deterministic across roles and handlers.
https://chatgpt.com/share/6984ccea-8290-800f-a6d7-ec0e94df95a0
- add sed_escape Jinja filter for sed replacement safety
- escapes \, &, and the active sed delimiter
- designed explicitly for sed s/// replacement context
- patch all sed-based config updates across roles
- espocrm, friendica, gitea, matomo, moodle, wordpress
- ensure every Jinja value in sed replacements uses sed_escape
- use correct delimiter-specific escaping (/, |, #)
- add robust integration test to enforce sed_escape usage
- scans all roles/*/tasks/**/*.yml
- detects sed substitutions with Jinja in replacement part
- ignores delimiters inside {{ ... }} blocks
- fails CI if sed_escape is missing
- harden repository against sed injection, delimiter breakage,
and credential corruption in config patching tasks
https://chatgpt.com/share/6974fb45-1ee8-800f-80bd-c71122e4ac02
- move sys-token-store initialization to constructor stage
- remove duplicate token store includes from frontend and app roles
- allow Mailu reachability check to accept configurable status codes (200, 301)
- make Mailu health check consistent with web-app-mailu config
- increase test-local-rapid verbosity for better diagnostics
https://chatgpt.com/share/696c0f49-7888-800f-8175-fb21893c0d67
- Ensure Matomo is bootstrapped when API token is missing, even if already installed
- Make Matomo load conditional on reachability and token availability
- Move run-once flag in sys-token-store to ensure proper token hydration
- Improve trusted_hosts patching to include service and Docker reach host
- Clean up redundant conditions and minor task inconsistencies
https://chatgpt.com/share/6957bc5f-ff70-800f-a3bd-c4cf2518a336
**Body**
* add sys-token-store filter plugin to hydrate users.*.tokens from persisted store (users win if non-empty)
* load token store during sys-token-store core run and inject hydrated tokens into users fact
* remove legacy lookup task and simplify docs + store path naming
* switch Matomo frontend injection to use hydrated users.administrator.tokens[web-app-matomo] directly
* ensure Mailu token handling uses sys-token-store write task and checks token presence via users.*.tokens
* add unittest for token hydration filter plugin with path-based module loading
- add `tokens` support to generated default_users
- normalize sys-token-store output variable to `sys_token_store_token`
- align Matomo role to new token-store interface
- reorder Matomo task files for clearer execution flow
https://chatgpt.com/share/69513d00-9a7c-800f-8b1f-5c31e0e21b75
* Set Matomo `trusted_hosts[]` to include both `{{ domain }}` and `{{ DOCKER_REACH_HOST }}:{{ http_port }}` (idempotent)
* Add `http_port` var for reuse
* Switch `MATOMO_INDEX_PHP_URL` to local reach URL to make API calls reliable on localhost
https://chatgpt.com/share/694c1e06-fcac-800f-9c03-d92a150a4c73
Wrap Matomo bootstrap in block/rescue to capture failures and
dump docker-compose.yml, effective compose config, and env files.
Env files are only shown when MASK_CREDENTIALS_IN_LOGS is false.
https://chatgpt.com/share/694bde08-a72c-800f-9ac3-a8aa9aef3bde
* add token configuration and bootstrap service to role config
* introduce dedicated bootstrap env file wired via env_file override
* replace nix/playwright-based installer with one-shot compose bootstrap
* determine bootstrap need based on config.ini.php and token presence
* move post-install API configuration into separate task file
https://chatgpt.com/share/694bcac4-1a00-800f-9aff-dbcd9a2003dc
Replace bash -lc with direct nix run to avoid .bashrc/TERM issues in CI.
Prevent flake.lock writes via --no-write-lock-file and add retries for
Playwright Chromium installation. Keep localhost base URL for reliable
host-side access.
https://chatgpt.com/share/694ab489-7028-800f-8398-a19a99faffd0
Introduce DOCKER_REACH_HOST as a single source of truth for service
reachability checks (wait_for), decoupled from DOCKER_BIND_HOST.
- Default reach host is 127.0.0.1 for host-based execution
- Automatically override to Docker bridge gateway when running
inside a container (Docker socket mounted)
- Add custom docker_bridge_gateway module for reliable detection
- Update all wait_for tasks to use DOCKER_REACH_HOST
- Remove ad-hoc debug TCP probing logic
This ensures consistent behavior across host runs and
container-based control nodes without breaking existing setups.
https://chatgpt.com/share/694aaf8b-1fe4-800f-88ac-b5f6e508a2e3
