meta/services.yml switches the SSO integration of SeaweedFS off on a Tor
node, but variant 0 pinned services.sso to a literal true (#868). A round
writes the variant pins into its inventory, the inventory value wins over
the expression in services.yml, and a Tor round therefore enabled SSO for
a frontend it does not deploy. Measured in a round inventory:
`sso {'enabled': True, 'shared': True}` with svc-net-tor in its groups.
The pin now carries the same gate as logout, dashboard and prometheus,
which #832 already fixed the same way. The sso block in services.yml is
marked for the variants-coverage and bond-baseline guards like the
frontend block, since no variant may force this consumer on a Tor node.
Verified on a local Tor round of variant 0: the round inventory holds
`{'enabled': "{{ 'svc-net-tor' not in group_names }}", 'shared': ...}`
for the sso block instead of True, and after the deploy only the
seaweedfs container runs; seaweedfs-sso-proxy and seaweedfs-redis, which
an earlier deploy had started, are gone, and the rendered compose file
holds no SSO service. tests/integration/roles/meta/variants and the
sso-variant-tor lint pass; without the two markers test_bond_baseline
and test_coverage fail on services.sso.
feature/store-i18n carries the same pin change for all four services in
d70e2bb967, so the two branches merge without a conflict in
meta/variants.yml.
Closes#868
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The tor gate that 312d09e290 put into the services.yml of web-app-seaweedfs
and web-svc-coturn never took effect on a deployed round. Both roles pin
the same flags to a literal true in variant 0, the round writes those pins
into the inventory, and an inventory value wins over the expression in
services.yml.
Measured on a compose round of web-app-matrix variant 0 with tor: the
inventory carried prometheus enabled true for both roles, so both stayed
in the Prometheus target list and the spec failed on the missing
web-app-seaweedfs label and probe.
Variant 0 now carries the gate itself for prometheus on both roles and
for logout and dashboard on seaweedfs, the three flags 312d09e290 names.
The bond-baseline and variants-coverage guards require a literal true in
variant 0 for these blocks, so they carry the same markers the frontend
block of seaweedfs already has, for the same reason.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
SSO over a plaintext onion is where this platform actually breaks, and none of
it shows on clearnet: a framework's Secure session-cookie default makes Chromium
drop the cookie, an https identity provider cannot be embedded in an http page,
and crypto.subtle is undefined because an onion is no secure context. Pixelfed,
Taiga, Joomla and WordPress each cost a red job over exactly that. The
combination is only exercised if a variant deploys both, so the lint requires
it: services.sso.enabled true implies services.tor.enabled true.
69 variants enable SSO; 59 already complied. Of the ten that did not, seven are
flipped on because the mechanism is proven there - matrix and nextcloud both run
SSO behind the onion in variant 0 already (20ddda8c1), and their later variants
were pinned false only by the blanket rule from 1d9d355bc. Nextcloud variant 1
stays false: SSO is off there, and it is what gives the coverage test its
false-pinning variant.
Three roles opt out, each for a structural reason named in the marker. jitsi and
bigbluebutton pin tor.enabled false in meta/services.yml because the conference
needs getUserMedia, which no plaintext onion can offer. seaweedfs gates its own
sso flag on 'svc-net-tor not in group_names', so on a tor node there is no login
flow to test.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Variant 0 pins the backup consumer flag enabled so the matrix baseline exercises the in-group branch; every other variant pins it disabled (shared: false carries the static-override suppression since the base value stays literally true). The matrix and wordpress variant entries move their services mapping to the list-item head so the static-override line parser resolves the override paths; yaml semantics are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
akaunting, flowise, bluesky, opentalk and seaweedfs do not natively consume LDAP — their auth is OIDC / Keycloak-federated, so the LDAP deploy variant tested nothing app-specific. Set services.ldap.enabled/shared to false, remove the dedicated LDAP matrix variant plus the ldap: entries from the remaining variants, and drop the now-redundant LDAP playwright tests (akaunting/flowise test-ldap-login.js, bluesky test-ldap-broker-handoff.js). Matches the joomla/mattermost (enabled:false) and baserow (removed) precedent. opencloud is intentionally left untouched (LDAP is its real directory backend).
akaunting additionally bundles an unrelated seaweedfs object-store consumer change (test-seaweedfs.js, S3 env block, SEAWEEDFS_* flags) from concurrent work in the same role dir.
Verified against the staged tree: full lint suite passes (141 tests, 235 subtests), all meta YAML valid, node --check clean on the 3 modified specs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a database-style object-store abstraction: the objstore lookup resolves the active engine (seaweedfs|minio) per consumer and yields a uniform S3 payload, objstore_secret_key is auto-generated like database_password, sys-svc-objstore delegates per-consumer provisioning to the resolved provider's objstore_init entrypoint (lazy-loading the provider when it was not preloaded), and compose/network/volume plumbing supports both a shared central instance and an embedded storage-only instance per consumer.
Add the web-app-seaweedfs provider role: Filer and Master UIs behind the admin-only oauth2-proxy via a role-local nginx and proxy.conf.j2 (S3 API domain stays ungated, admin UIs deny with 403 when SSO is disabled), per-consumer S3 identities from s3.json, idempotent bucket provisioning via weed shell, a /24 on the central-provider subnet range, Playwright coverage for admin/biber/guest plus consumer bucket existence, and unit tests for the objstore lookup and the per-engine compose volumes.
Mark web-app-minio lifecycle: unsupported, move its mc client image into a dedicated services.client entry, align it with the objstore credential contract, and make its consumer provisioning idempotent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5