2 Commits

Include renames

Author	SHA1	Message	Date
kevinveenbirkenbach	9ee4cd0fb9	Merge branch 'main' of github.com:infinito-nexus/core into feature/swarm-nfs ... # Conflicts: # docs/agents/action/iteration/compose.md # roles/svc-db-openldap/vars/main.yml # roles/svc-runner/defaults/main.yml # roles/svc-runner/tasks/02_cleanup_instance.yml # roles/web-app-discourse/meta/server.yml # roles/web-app-mailu/tasks/01_core.yml # roles/web-app-odoo/tasks/main.yml	2026-07-04 18:16:12 +02:00
kevinveenbirkenbachandClaude Opus 4.8	defa2d6db3	feat(web-app-semaphore): add Semaphore UI role with OIDC SSO + LDAP ... Implements requirement 028: web-app-semaphore deploying semaphoreui/semaphore v2.18.13 behind sys-svc-proxy with central PostgreSQL, native Keycloak OIDC SSO, and LDAP login, plus guest/biber/administrator Playwright personas. Auth/admin model verified against the upstream v2.18.13 source (config.go, api/login.go, api/router.go, web/src/views/Auth.vue, config.schema.yaml, cli/cmd/user_add.go): the OIDC callback matches by email and rejects local users, the login form is LDAP-only when ldap_enable=true, and OIDC users are never admin from a claim. The role therefore seeds a distinct break-glass local admin and creates the Keycloak administrator as an external admin at deploy time (semaphore user add --admin --external). Correct v2.x env names (SEMAPHORE_LDAP_ENABLE/_SERVER/_BIND_DN/_BIND_PASSWORD/_SEARCH_DN, OIDC provider JSON) confirmed against the source. Validation: make autoformat clean; make test green (lint, test-lint, test-unit, test-integration 190, test-external). Live full-matrix deploy + Playwright still pending (host container runtime fault, environment-only). Refs: docs/requirements/028-web-app-semaphore.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-28 22:40:26 +02:00