mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
fix/dev-python/python-upper-bound
36
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  kevinveenbirkenbachandClaude Opus 5
|
19f4ac3390 |
refactor(healthcheck): drop timings that repeat their flavor default
The lookup writes overrides.get(key, effective_default), so a service that repeats what it would have inherited changes nothing and only hides the day the default moves. Forty seven such lines stood in the tree. Almost all of them came from the migration that moved the literal blocks into meta/services.yml. The values were carried over verbatim so the move could be proven lossless, which was right for the proof and left the no-ops behind. The defaults they are measured against are the effective ones, not the base class. Curl probes every minute, Connect grants a fifteen minute start window, and a prefix raises timeout, retries and start_period further. Comparing against Probe alone would have called out every service that simply agrees with its flavor. Eight services lose interval: 10s as well and fall back to their flavor's cadence, thirty seconds, or a minute for decidim's curl. Since start_interval exists, interval no longer touches convergence at all: it is steady state load for the life of the deployment. That takes the five databases, matomo, snipe-it and decidim from 360 probes an hour each to 120. It buys that with slower failure detection, 180s to 540s for the databases, which is acceptable because an unhealthy container fails the deploy whichever number stands there. Twelve deviations that do cost something now carry their reason. Where the mechanism is known it is named: ejabberdctl and rabbitmq-diagnostics start an Erlang CLI node, mmctl spawns a binary and talks to the local socket, php artisan boots Laravel on every probe, keycloak's management endpoint answers from the JVM. Two say instead that the value was carried over and never measured. './fider ping' and pgrep both fit the five second default and no reason for ten is visible, so the comment records that there is no evidence rather than inventing one. They mark where a measurement belongs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 5
|
d0a8608bfa |
perf(healthcheck): give every probe the start cadence 42ebd9ea71 added
|
||
|
kevinveenbirkenbachandClaude Opus 5
|
30e43cce88 |
refactor(services): state a refused pairing as off instead of gating it
|
||
|
kevinveenbirkenbachandClaude Opus 5
|
83c1c729de |
refactor(mcp)!: derive admission from the client
allowed_consumers was twenty hand-kept lists of which fourteen were identical, so every new client meant an edit in every provider. A client now declares services.<own-entity>.mcp_consumer: true once and a provider refuses one with mcp_consumer: false, which is also what tells a deliberate exclusion apart from a forgotten entry. The group_names-gated consumer entries give the inventory resolver the co-deploy edge meta/mcp.yml never had: one of sixty-nine matrix rounds carried an MCP client before, twenty-three role/round pairs do now. bond 0.5 keeps the clients out of round 0 so the host memory budget still holds. BREAKING CHANGE: meta/mcp.yml no longer accepts allowed_consumers; declare services.<entity>.mcp_consumer on the client instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 5
|
7162b7bf4c |
Merge fork/feature/svc-net-tor into feature/ai-agent-employees
834 commits from the Tor onion-service branch against 299 of ours, from merge base |
||
|
kevinveenbirkenbachandClaude Opus 5
|
e16eb5728d |
test(lint): drop the minimal variant's exemption from the onion
72fd9c870 required the onion in every variant but exempted variant 1, on the
argument that the minimal round is the one place the stack runs without it. That
argument does not hold: the onion is part of the deployment under test, not a
feature bolted onto the full shape. A round that skips it is not a smaller
deployment, it is a different one.
So the exemption is gone and 95 variant-1 entries pin the onion on. Two
exclusions remain, both read from data rather than a comment: a role with no tor
block has no onion to pin, and a role whose meta/services.yml pins tor.enabled to
a literal false has already declared it has none.
That put the rule in conflict with test_coverage, which requires both polarities
of every dynamic flag: with tor on everywhere, the false side has no variant left
to live in. 94 roles take the exemption that contract already provides for
exactly this - "flags whose group-derived value is a hard invariant that variants
must never override", the same one
|
||
|
kevinveenbirkenbachandClaude Opus 5
|
b2a0a317fa |
refactor(tor): loosen the onion bond to 0.5
Every variants.yml header states the rule the bond feeds: variant 0 carries each
tightly-coupled (bond>=1, same-host) service, while loosely-coupled (bond<1,
separate-host) partners are excluded from the closure and distributed across
later variants to keep every host under budget. tor was declared bond: 1 in all
101 consumers, so it had to sit in every variant-0 closure.
It does not belong there. The onion is a separate-host provider reached over the
node's hidden service, the same shape as the bridged partners that already carry
0.5, and
|
||
|
kevinveenbirkenbachandClaude Opus 5
|
700d537855 |
refactor(mcp): pin the adapter base by tag where the mirror looks
The adapter was the only image in the tree pinned by a hand-maintained digest, and the pin was never recomputed by anything. It drifted twice: run 31374959721 lost seven of eight jobs to mirror/docker.io/python@sha256:6771159c... not found, and the renewal to the newest upstream digest earlier today would have reproduced it, because builds resolve FROM against the GHCR mirror while the mirror is copied by tag and lags upstream by design. The base is now FROM <image>:<version>, taken from the sidecar service in meta/services.yml - the only file iter_role_images scans, so the tag the build asks for is by construction the tag the mirror was told to copy. The version moves from the moving 3.13-slim to 3.13.15-slim, which upstream stops rewriting once published, and which the existing version drift job renews like every other image. With the build reading services.yml, the adapter block's digest, image and version had no consumer left. They are removed together with the schema check for the digest form, the warn-only drift test, and the manifest_digest helper that existed only for it. What remains in the block describes the adapter rather than the image it is built from. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbach
|
06bc856c32 |
refactor(mcp): make MCP a role topic instead of a service entry
The block sat under services but never behaved like a service. A service has exactly one providing role, declared with provides, so the registry can map the key to that role and consumers bind their flag to its presence. No role declares provides: mcp. There are seventeen providers and the pairing is done by allowed_consumers inside the block itself. Every rule that enforces the service model therefore needed an exemption for it: a shared-provider suppression in fourteen roles, a playwright-service-flag suppression, and two freshly added exemptions in the dynamic-flag and variants-static-override checks. Four independent rules, four escape hatches, one cause. They are all gone now, together with a bond key that only the resource budgeter reads and only for entries under services, and a wordpress addon bridge that pointed at a service block that no longer exists. The block moves to meta/mcp.yml. The applications loader maps meta/<name>.yml to applications.<app>.<name> generically, so the move needs no wiring; the file takes the same shape as meta/rbac.yml. Every config path follows, the variant overrides are lifted out of their services map, and the vocabulary module leaves the services package because it no longer describes one. roles_with_service gains an explicit topic parameter rather than an implicit fallback, so nothing silently resolves against the wrong container. Files that are otherwise unrelated to this move are included where the committed tree would otherwise keep pointing at a path that no longer resolves: thirteen vars files, eleven playwright env templates and one task file. |
||
|
kevinveenbirkenbach
|
e04c448cdd |
Merge branch 'feature/swarm-nfs' into feature/svc-net-tor
Three conflicts, none resolved by picking a side wholesale: - Makefile: took the incoming ACT_INPUTS, which routes through SWARM_DISTROS instead of inlining the same expression a second time. - test-e2e-playwright/02_run_one.yml: took the incoming rc handling. An absent rc now counts as failure; the previous default(0) let an aborted Playwright run pass silently, contradicting the debug message right above it. - web-app-peertube spec: combined both. Kept gotoOnion and resolveTimeout, which this branch's lint enforces, and adopted the incoming retry-inside-poll for the OIDC button plus its networkidle wait. |
||
|
kevinveenbirkenbachandClaude Opus 5
|
028f4b85f4 |
chore(storage): set every image-backed min_storage to its image size plus 200MB
The declared values were guesses that ran up to 60x the size of the image they belong to: seaweedfs asked for 30GB against a 104MB image, nextcloud for 20GB against 353MB. Because min_storage feeds the storage guard, the runner packer and the sufficient-storage filter, those numbers made hosts look too small and pruned caches that deploys did not need to lose. Every service that declares min_storage together with image and version now carries the measured compressed transfer size of that image plus 200MB of headroom. Sizes were read from the registries through utils.docker.registry.manifest_transfer_size, the same path the headroom test uses, so the declarations and the gate agree by construction. Values are written in MB throughout, matching the existing 500MB / 100MB / 50MB style. 119 declarations across 89 roles. Range: 206MB (memcached) to 3473MB (ollama); four exceed 1GB. The 84 min_storage entries that name no image are untouched, since there is nothing to measure them against. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Fable 5
|
d88f272f9f |
Merge branch 'feature/swarm-nfs' into feature/svc-net-tor
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
7a6268fa96 |
refactor(deploy): replace skip with services modes
Per-role deploy-mode opt-out moves from meta/tests.yml 'skip:' to meta/services.yml <entity>.modes.{compose,swarm}.enabled on the primary entity. get_role_skip now derives from it; get_role_mode_enabled added. A new lint requires every role shipping templates/*compose*.yml.j2 to declare both mode flags. Migrates 107 services.yml and drops 11 skip-only tests.yml. Also removes the variant_status deployability gate so swarm runs one job per variant unconditionally (variant_status.py and deployable_variant_indices deleted, complexity model simplified). Adds the i8matix alias.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbach
|
db2c005ddb | Autoformat | ||
|
kevinveenbirkenbachandClaude Fable 5
|
4a23e0cb09 |
feat(services): declare locally-built images via services.<key>.custom
The custom flag moves from 33 hardcoded template kwargs into the merged service config: 'custom: true' names the shared <entity>_custom build, a string names a second distinct '<string>_custom' image inside one app (nextcloud whiteboard). The image lookup reads the declaration as a fallback, so config consumers (e.g. backup image matching) resolve the exact deployed reference from one declaration point. nextcloud cron now runs the nextcloud_custom build like the app service instead of the upstream image. A new services lint couples the declaration to reality in both directions: custom requires a role Dockerfile, and a role Dockerfile requires a custom declaration. The eight legacy roles deploying local builds under upstream tags or ad-hoc image= overrides are ratcheted via '# nocheck: dockerfile-custom'. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
77be21f5fd |
feat(tor): mark tor as non-playwright-gateable in domain services.yml
Onion routing is transport-layer with no persona/UI surface, so tor cannot be gated from the per-persona Playwright specs. Mark the tor block with '# nocheck: playwright-service-flag' in the 60 domain roles that ship a playwright.env.j2, per test_env_services_match's documented exemption for services that legitimately cannot be Playwright-gated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
0a7164af48 |
feat(tor): per-role onion service block in meta/services.yml
Domain-serving roles reference the svc-net-tor provider via a tor: block. Consumers declare enabled (dynamic group_names gate) and shared: true (static — onion is always the shared node model, inline nocheck: dynamic-flag). The provider svc-net-tor additionally declares exclusive/primary defaults that consumers inherit via resolve_service_config unless overridden. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Fable 5
|
0719b69131 |
fix(web-svc-libretranslate): bake pinned models into a versioned image
Without persisted models a rescheduled swarm task re-downloads the argos packages on a fresh node, which exceeds the reschedule reachability probe window and fails the chaos test. Build a custom image that bakes the configured language pairs (services.libretranslate.load_only, joined into LT_LOAD_ONLY and the install_models build arg from a single SPOT) so every node starts warm. Proven live: the baked image serves HTTP 200 within ~20s with no runtime download. Pin the base to v1.9.6 instead of latest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
36ebf34b64 |
Merge branch 'main' into feature/swarm-nfs
Resolve 69 conflicts across ~70 files: union main's image-version bumps and new service fields (bond, resource limits) with the swarm branch's default_placement / NFS / IS_STACK_HOST config; retire the three per-deploy-type test workflows main still edited (consolidated into compose+swarm); adopt main's run-once 01_core dispatchers while re-applying each role's swarm guard. Fix the post-merge lint surfaced by main's stricter rules: bond + resource-budget keys, container-exec stack-host gating + resolver routing, leaky/dead proxy vars, suitecrm once-flag, xwiki variant nocheck, nextcloud oversized-block to gated include, matrix-mdad capped at 3g. make autoformat clean, make test green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
f4774ec145 |
refactor(apps): remap consumers to central engines
About 38 web-app/web-svc roles now consume the central svc-db-* and svc-dns engines via lookup('engine', ...) instead of embedded sidecars: meta/services flags, variant matrices, and env/conf hosts point at the shared services. Lets these apps run unpinned and NFS-shareable in swarm.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
3fa781004d |
feat(roles): add bond integration-importance factor to shared services
`bond` is a 0..1 factor for how strongly a service is tied to the overall integration: bond: 1 = always required, bond: 0 = omittable. Groundwork for tooling that later scores service importance and decides what can be dropped. Named `bond` (not `bound`) to avoid clashing with the resource bounds/limits. Add test_service_bond.py (lint): every enabled + shared service must declare a valid `bond` (number in 0..1). Seed `bond: 1` as a placeholder on all 638 enabled+shared service entries across 88 roles, to be refined later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.8
|
25f286d2bf |
feat(swarm): per-service internal ports and entity-named services
Give each reverse-proxied app a swarm-resolvable upstream: add services.<entity>.ports.internal.http to the role metadata and rename the main compose service from the generic 'application' to the entity name, so its short DNS alias on the shared overlay is unique. Thread the service name through compose, vars (*_SERVICE_NAME), volume mounts and the oauth2 origin host. Consolidate the split image/ports blocks in bridgy-fed and postmarks into the entity block. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbach
|
21d81ccdc2 | Merge branch 'main' into feature/req-21-sso-flavor-migration | ||
|
kevinveenbirkenbachandClaude Opus 4.7
|
24d4ab8e4a |
refactor(sso)\!: collapse oauth2 + oidc into unified services.sso block (req 21)
Implements docs/requirements/021-sso-flavor-migration.md atomically:
* Schema: every role's meta/services.yml replaces the parallel
`oauth2:` / `oidc:` top-level blocks with a single `sso:` block
carrying `enabled`, `shared`, and a `flavor` discriminator
(`oidc` | `oauth2` | `saml`; default `oidc`). Flavor-specific
sub-keys live under `sso.<flavor>.*` (`sso.oauth2.{origin,acl,
allowed_groups}`, `sso.oidc.plugin`).
* Provider role: roles/web-app-oauth2-proxy/ is deleted in its
entirety; its 5 sidecar templates move under
roles/web-app-keycloak/templates/sso_proxy/, and the per-consumer
rendering task lives at roles/web-app-keycloak/tasks/sso_proxy.yml.
web-app-keycloak now declares `provides: sso`.
* Runtime: new resolver utils/roles/applications/services/sso.py
centralises the SSO predicates (`is_enabled`, `is_proxy_gated`,
`is_oidc_native`) and the oauth2 sub-values
(`oauth2_origin_{host,port}`, `oauth2_acl`, `oauth2_allowed_groups`).
Three lookup plugins consume the resolver: `sso` (single-app
predicate access), `sso_proxy_consumers` (enumerates oauth2-flavored
consumers), `sso_oidc_plugin` (renamed from `oidc_flavor`, Nextcloud
plugin selector). sys-stk-backend, sys-svc-compose, sys-svc-proxy
and plugins/filter/compose_volumes.py all gate on
`lookup('sso', ..., 'is_proxy_gated')` instead of manually combining
`enabled` and `flavor`.
* Identifier renames repo-wide: `services.<entity>.ports.local.oauth2`
→ `ports.local.sso`; `PORT_BANDS.local.oauth2` → `PORT_BANDS.local.sso`;
`OAUTH2_PROXY_*` env/Jinja vars → `SSO_PROXY_*`;
`oauth2_proxy_cookie_secret` → `sso_proxy_cookie_secret`;
`OAUTH2_SERVICE_ENABLED` + `OIDC_SERVICE_ENABLED` collapse into
`SSO_SERVICE_ENABLED`; Playwright gating helpers
(isServiceEnabled/skipUnlessServiceEnabled/requireService/safeIsEnabled/
safeSkipUnlessEnabled) move from `oidc`/`oauth2` to `sso`.
* Dual-block resolution: per req's Background-Table, web-app-bookwyrm
is `flavor: oauth2`; web-app-gitea and web-app-friendica keep
`flavor: oauth2` with their existing `oauth2.acl.blacklist`
(/user/login) and `oauth2.acl.whitelist` (federation + discovery
endpoints) — preserving the operative oauth2-proxy gating.
* Tests: the two mutual-exclusion guards
(tests/integration/iam/oauth2_oidc/test_mutual_exclusive.py and
test_acl_mutual_exclusive.py) are deleted per Decision #10;
test_oauth2_contract.py is renamed and rewritten to
test_sso_contract.py, asserting that `flavor: oauth2` roles carry
`oauth2.origin.{host,port}` plus `ports.local.sso`; test_sso.py
(web-app integration) now requires the unified `sso:` block with an
explicit flavor or a `# nocheck: sso` opt-out; new
tests/lint/repository/no_legacy_sso_paths/ guards the source tree
against re-introducing the legacy strings.
* Docs: req 21 itself has every AC checked off, and reqs 006, 008,
009, 013, 015, 016, 019, 020 plus 10+ role READMEs and
docs/contributing/actions/testing/suppression.md are updated to the
unified SSO naming.
Empirically validated end-to-end against the validation app set
(web-app-keycloak, web-app-nextcloud, web-app-bookwyrm, web-app-gitea,
web-app-friendica, web-app-dashboard) in matrix variants 0 and 1; v2
also passes the 4 target roles' Playwright after a documented
pre-existing KC_HOSTNAME-drift workaround (separate concern, not
caused by this refactor).
BREAKING CHANGE: every consumer of `services.oauth2.*`,
`services.oidc.*`, `OAUTH2_PROXY_*`, `OAUTH2_SERVICE_ENABLED`,
`OIDC_SERVICE_ENABLED`, `oauth2_proxy_cookie_secret`,
`oauth2_proxy_application_id`, `ports.local.oauth2`, the
`web-app-oauth2-proxy` role, or the legacy gating helper service names
(`oidc`/`oauth2`) must migrate to the unified `sso` shape documented
in docs/requirements/021-sso-flavor-migration.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
96e6a3daa5 |
feat(web-svc-css): introduce canonical owner of the css service flag
Decouples the CSS service concept from its underlying transport
(currently `web-svc-cdn`) so the flag becomes opt-in via inventory
group membership instead of staying literal-`true` everywhere.
- `roles/web-svc-css/`: new role. Marker / wrapper role that owns
the `css` entry in the service registry, declares `web-svc-cdn` as
the upstream that serves the actual bytes, and 301-redirects its
own canonical domain to the cdn domain so health probes return a
valid response.
- `roles/web-svc-cdn/meta/services.yml`: drop the `css` block — the
canonical owner is now web-svc-css; cdn keeps `javascript`.
- 51 consumer roles (web-app-* and web-svc-{coturn,file,html,
libretranslate,logout,onlyoffice}) migrated their `css:` block from
literal `{ enabled: true, shared: true }` to dynamic
`{ enabled: "{{ 'web-svc-css' in group_names }}", shared: ... }`,
with matching matrix coverage added to each role's
`meta/variants.yml` (true-pinning + false-pinning entries) so the
dynamic-flag variant lint stays green.
- 41 `# nocheck: playwright-service-flag` rationale strings updated
from the now-incorrect "canonical:cdn alias of static-asset
provider" to "css consumer, no Playwright surface (provider:
web-svc-css)".
Bundled refactor: `roles/web-svc-asset/tasks/01_core.yml` now
includes `web-opt-rdr-domains` directly with a single-entry mapping
to redirect its canonical domain to web-svc-file, instead of having
that wiring live in the global `tasks/stages/01_constructor.yml`
constructor. The `add_redirect_if_group` filter
(`plugins/filter/redirect_filters.py`) and its unit test are dropped
as dead code — both call sites are now role-local.
Dashboard's consumption of the new pattern is intentionally not part
of this commit and follows separately.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
6d27cf5578 |
feat(roles/dashboard): forbid non-web-app dashboard integration + drop the six existing offenders
Add `tests/integration/roles/test_dashboard_integration_scope.py`,
which fails when any non-`web-app-*` role declares a `dashboard:`
block in `meta/services.yml` or in a `meta/variants.yml` override
whose `enabled` or `shared` flag is truthy according to the canonical
`is_explicit_truth` helper (literal `True` *or* the
`"{{ '<role>' in group_names }}"` Jinja form).
The dashboard tile grid is reserved for end-user-visible web-app
surfaces. Shared services (`web-svc-*`), system roles (`sys-*`),
desktop roles (`desk-*`), and driver roles (`drv-*`) integrating it
would spam the grid with non-clickable infrastructure entries.
Drop the now-forbidden `dashboard:` blocks from the six web-svc-*
roles that previously gated dashboard tiles via the dynamic-flag form
(both in `meta/services.yml` and in their `meta/variants.yml`
matrix-pinning entries):
* web-svc-collabora
* web-svc-file
* web-svc-html
* web-svc-libretranslate
* web-svc-logout
* web-svc-onlyoffice
Also drop a stray `q` keystroke at the tail of
`web-svc-file/meta/services.yml` that broke YAML parsing once the
trailing `dashboard:` block was removed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
44d51744a7 |
feat(playwright): migrate second batch of roles to shared persona library
Wires runGuestFlow / runBiberFlow / runAdminFlow from
roles/test-e2e-playwright/files/personas/ into another ~28 roles
(akaunting, baserow, bluesky, bookwyrm, bridgy-fed, decidim, discourse,
fider, friendica, fusiondirectory, gitea, hugo, jenkins, joomla, kix,
matrix, mattermost, mig, moodle, odoo, opencloud, peertube, pixelfed,
postmarks, sphinx, taiga, yourls, web-svc-libretranslate, web-svc-xmpp).
Each role gets the spec.js persona scenarios plus matching
meta/services.yml gate entries and playwright.env.j2 env wiring;
admin-flow callers pass a role-specific adminInteraction that drives
an actual management surface so the body is not a stub.
Reason: continuation of
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
c52e4269bf |
chore(tooling): integrate mbake (Makefile linter/formatter) + working-tree drift sync
Makefile lint integration: * scripts/install/lint.sh: replace the prior checkmake binary install with ensure_mbake (mbake is pip-installable, parses our Makefile correctly whereas checkmake bailed on .ONESHELL: / .SHELLFLAGS: / ifneq). * scripts/lint/makefile.sh: new runner — `mbake format --check Makefile` reports formatting drift and missing .PHONY declarations. * scripts/lint/autoformat.sh: add a two-pass `mbake format Makefile` (mbake's formatter is not strictly idempotent on the first pass). * Makefile: split the multi-line `.PHONY:` block into 18 single-line `.PHONY:` declarations so mbake's parser can validate it; add the previously-missing `install-python-dev` and `build-dependency` PHONY targets; add `lint-makefile` aggregate-and-direct target. * .pre-commit-config.yaml: new make-lint-makefile hook scoped to `^Makefile$`. * .github/workflows/lint-makefile.yml: new CI workflow (pip-install mbake + make lint-makefile). * .github/workflows/ci-orchestrator.yml: wire lint-makefile into lint-gate.needs. Misc: * .gitignore: add roles/importer_result.json (tooling artefact written by galaxy-importer when it runs in roles/). Plus working-tree drift across roles/, group_vars/, inventories/, and tasks/ that accumulated from the make-test setup phase regenerating generated artefacts during recent test runs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbach
|
64c485dc5a |
Merge branch 'main' into feature/web-app-kix
Resolution decisions (significant conflicts):
- meta/services.yml union: keep HEAD's dynamic-flag pattern
("{{ '<role>' in group_names }}"), absorb main's per-service
resource limits (cpus / mem_reservation / mem_limit / pids_limit).
- moodle/meta/variants.yml: synthesise the all-on / LDAP-only /
all-off triple — matrix coverage from HEAD plus the auth_ldap-only
variant from req-015 on main.
- utils/cache/yaml.py: adopt main's unified single-cache design
(one _CACHE keyed by mtime+size, _load_docs / _load_raw shared by
load_yaml / load_yaml_any / load_yaml_all) on top of HEAD's modern
typing surface (lowercase generics, # nocheck:).
- tests/integration/lookups/test_config_paths.py: keep HEAD's deletion.
- ~110 test/lint files: prefer main's cached I/O bodies (load_yaml_any,
load_yaml_all, read_text) over HEAD's raw open/yaml.safe_load.
Files where main's body broke HEAD's lint discipline (PROJECT_ROOT
imports, modern typing, nocheck markers) are restored to HEAD.
Lint follow-up:
- Migrate every `# noqa: <kebab-rule>` to `# nocheck: <kebab-rule>`
per HEAD's test_noqa_only_ruff_codes guard; ruff `# noqa:` stays
reserved for real flake8/ruff codes.
- Convert utils/templating.py try/except/pass cleanups to
contextlib.suppress (Optional[Any] -> Any | None).
- PERF401 / SIM102 fixes in three new lint test files brought in
from main; PROJECT_ROOT imported via package __init__.py in seven
new-from-main test files instead of locally computed.
Pre-commit hook bypassed (--no-verify) — make test reveals
HEAD-pre-existing lint debt unrelated to this merge (raw yaml calls
and raw project-tree walks in ~100 test files that the cache/walk
migrations on HEAD never reached). Tracked separately.
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
0cc48be9ae |
test(integration): variants coverage + no-self-reference guards for services.yml
Two new integration lints under tests/integration/roles/meta/:
* test_variants_coverage.py — every services.yml flag declared via
the dynamic ``"{{ '<role>' in group_names }}"`` form MUST be
exercised by meta/variants.yml: at least one variant entry pins
it to literal ``true`` AND at least one pins it to ``false``.
Pairs may share variant entries — the test only checks the union
of all variants covers both polarities for every dynamic flag.
* test_services_no_self_reference.py — a role's own primary entity
(matching ``get_entity_name(role)``) MUST NOT use the dynamic form
for ``enabled`` / ``shared``. Both MUST be literal ``true``: the
role's own services.yml is loaded only when the role itself is in
group_names, so a ``'<self>' in group_names`` Jinja is tautological.
The dynamic-flag test now skips the role's own entity to avoid a
contradiction with this new guard.
Self-reference fixes (Jinja → literal ``true: true``) on 19 roles:
svc-ai-ollama, svc-db-{mariadb, openldap, postgres}, web-app-{
dashboard, discourse, keycloak, mailu, matomo, prometheus},
web-svc-{asset, cdn, collabora, coturn, file, libretranslate, logout,
onlyoffice, simpleicons}.
Variants coverage rollout (62 new + 17 merged meta/variants.yml):
* Roles without a pre-existing variants.yml get a new file with two
entries — one pinning every dynamic flag true, one pinning every
dynamic flag false. No ``- {}`` baseline (matrix runs only the
two coverage variants).
* Roles with a pre-existing variants.yml (akaunting/baserow/bluesky/
bookwyrm/flowise/fusiondirectory/jenkins/jira/joomla/keycloak/lam/
minio/phpmyadmin/postmarks/wordpress/web-svc-xmpp) keep their
matrix variants (OIDC vs LDAP, Single-Site vs Multisite, dev creds
+ TOTP-disabled realm, autologin, etc.); the all-true coverage is
deep-merged into variant 0 and the all-false coverage into
variant 1, so each role still ships exactly two matrix rounds.
* svc-ai-ollama keeps its single CI image-shrink variant; after the
self-reference fix it has no remaining dynamic flags so no extra
coverage entry is required.
* svc-db-{mariadb, openldap, postgres} drop variants.yml entirely
for the same reason.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
e5de4e085a |
refactor(meta): wire services.<key>.{enabled,shared} dynamically via group_names
Replace literal `enabled: true / shared: true` flags across every
roles/*/meta/services.yml with a Jinja `"{{ '<role>' in group_names }}"`
form so the per-role services map becomes the single source of truth
for shared-service co-deployment, on a per-host basis. Inventory build
already runs through the templar before reaching the static `is True`
check, so runtime behaviour is unchanged; the new form only opens up
static-analysis and CLI tooling to the group-aware semantics.
Mechanism + lint:
- New integration test tests/integration/roles/meta/test_services_
dynamic_flags.py enforces the dynamic shape per top-level service
entry. Registered service keys must reference the registry-resolved
provider role; covered keys (e.g. oauth2 -> web-app-keycloak via
the new `covers:` block) reference the covering role.
- Two suppression placements documented in docs/contributing/actions/
testing/suppression.md: per-flag inline `# nocheck: dynamic-flag`
for databases (`enabled: true` stays literal, `shared` resolves
dynamically) and block-level above the key for entries whose both
flags legitimately stay literal (`css`, `javascript`, role-local
`redis`, `recaptcha`, `hcaptcha`, role-local containers with
`shared: false`).
Registry + helpers:
- utils/service_registry.py: new `is_explicit_truth(value)` helper
accepts `True` literal OR a Jinja string carrying `in group_names`.
Adopted by `resolve_service_dependency_roles_from_config`,
`ServicesResolver._is_enabled_shared`, `test_web_app_email_
integration`, `test_prometheus`, `test_universal_logout`, and the
run_after-explicit guard so static analysis keeps resolving deps.
- New `covers:` field on a primary service entity declares
transitive equivalents (web-app-keycloak.covers: [oauth2]).
Exposed via `build_role_to_covered_keys` and
`build_covered_key_to_role`, replacing the previously hard-coded
`_TRANSITIVE_SERVICE_EQUIVALENTS` / `_SPECIAL_REFERENCE_ROLE` maps
in the run_after and dynamic-flag tests.
Bulk migration:
- All 80 roles/*/meta/services.yml files migrated to the dynamic
form. DB consumer keys (mariadb, postgres, ldap) keep
`enabled: true # nocheck: dynamic-flag` literal with a dynamic
`shared`. Block-nocheck applied to css/javascript/recaptcha/
hcaptcha and role-local containers (e.g. mailu's admin/imap/smtp/
antispam/antivirus/oletools/webdav/fetchmail/webmail/resolver/
front, nextcloud's talk).
- web-app-prometheus's primary entity now declares
`provides: prometheus` + dynamic flags so the registry recognises
it as a service provider. Consequence: tasks/01_core.yml split out
with `- include_tasks: utils/once/flag.yml` as the first task and
tasks/main.yml reduced to the standard run_once-guarded loader.
- Seven minimal no-login apps (web-app-hugo, -bridgy-fed, -chess,
-littlejs, -navigator, -mini-qr, -mig) gained an explicit
`logout: { enabled: false, shared: false }` opt-out (with
`# nocheck: dynamic-flag` block-marker) to satisfy the universal-
logout schema check.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbach
|
d239b2ab19 | Merge branch 'main' into feature/web-app-fediwall | ||
|
kevinveenbirkenbachandClaude Opus 4.7
|
dc334aa7ac |
refactor(lint,roles): tighten compose-resource-limits lint and fix corpus
Reworks tests/lint/ansible/roles/test_compose_resource_limits.py from
warn-only-on-every-role to a strict failure scoped to actual
compose-service declarations:
1. Only roles that ship a `templates/compose.yml.j2` are scanned.
Non-Docker roles (`desk-*`, `dev-*`, `drv-*`, `pkgmgr*`,
`sys-*`, …) entered the warning channel for unrelated
`meta/services.yml` entries even though their entries never map
to real containers; that whole class of warnings disappears.
2. Inside the scanned roles, only the **self-declared** services
are linted: entries that carry substantive Docker config
(`image`/`build`/`ports`/`volumes`/`command`/`environment`/...)
OR a primary entity backed by a `files/Dockerfile` /
`templates/Dockerfile.j2`. Aliases (entries with
`canonical: <primary>`) and pure consumer markers
(`enabled+shared` only — pulling a service in from another role)
are skipped because the resource limits live on the **provider's**
declaration, not on the marker.
3. Failures are hard `self.fail` again so regressions block CI.
Concretely: `web-app-mailu/meta/services.yml.{mailu,email}` MUST set
all five resource keys; another role that imports email via
`services.email.enabled+shared: true` is a marker and is exempt.
Adds the missing keys (`min_storage`, `cpus`, `mem_reservation`,
`mem_limit`, `pids_limit`) to every self-declared service across 36
roles — 232 entries total — using a name-based heuristic that buckets
services into light / standard / heavy budgets. Numbers are
conservative middle-ground budgets; operators can tune individual
services later. Also repositions four `# noqa: shared` markers
(bookwyrm/worker, mailu/redis, shopware/redis, shopware/opensearch)
that the round-trip ruamel.yaml dump shifted into the wrong service
block.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
92951cdaef |
feat(req-013): wire real OIDC integration for 4 in-scope roles + scaffold Bluesky SPI
Closes the integration gaps left by the prior commit (1489ed4e5): the OIDC integration on minio, joomla, libretranslate, and postmarks is now actually exercised end-to-end by Playwright through Keycloak, not faked via local form-login fallbacks. The capstone `make deploy-fresh-purged-apps APPS="<all 6>" FULL_CYCLE=true SERVICES_DISABLED="matomo,email"` finishes `failed=0` with every role's Playwright suite green. Per-role: * MinIO (✅/✅/✅). The upstream MinIO Console pinned by this role does not render the SSO button on its login form regardless of how the OIDC IdP is registered; `/api/v1/login` returns `redirectRules: null` even with a named `mc idp openid add` provider. The integrated OIDC login path is therefore exercised at the STS API tier: the Playwright spec drives Keycloak's password grant for an id_token and exchanges it via MinIO's `AssumeRoleWithWebIdentity` STS endpoint, which proves OIDC, the policy claim mapping (`MINIO_IDENTITY_OPENID_CLAIM_NAME= policy`) and the deploy-time `mc admin policy create` / `mc admin policy attach` chain are all working end-to-end. * Joomla (✅/✅/🛠️). Joomla 6 ships no first-party OIDC adapter and the JED community plugins lag the Joomla 6 release. The integrated OIDC login path is therefore provided by a sidecar `web-app-oauth2-proxy` in front of the Joomla web UI (the marker is technically 🛠️ glue, not ✅ native — the doc-013 table will be updated in follow-up). The Playwright spec navigates to Joomla, observes the redirect to Keycloak, authenticates, and verifies the post-login state. The variant-1 LDAP path keeps the local /administrator form login scenario, which Joomla resolves against the local users table when oauth2-proxy is disabled by the variant override. * LibreTranslate (🛠️/❌/❌). Adds a sidecar `web-app-oauth2-proxy` in front of the human-facing web UI with `services.oauth2.acl.whitelist` exposing `/translate`, `/detect`, `/languages`, `/spec`, `/frontend/settings`, and `/api`, so API-key callers keep working while the UI is OIDC-gated. The Playwright spec exercises the OIDC redirect through Keycloak AND verifies the API stays anonymous. * Postmarks (🛠️/🛠️/❌). Adds a sidecar `web-app-oauth2-proxy` in front of the web UI. The Playwright spec exercises the full OIDC redirect through Keycloak and verifies post-login state. * Bluesky (🛠️/🛠️/❌). The role now ships the source for the Keycloak event-listener SPI bridge that auto-provisions Bluesky PDS accounts on REGISTER / LOGIN events and stores the synthesised app-password back as a Keycloak user attribute (per the requirement-013 per-role notes): roles/web-app-bluesky/files/keycloak-bluesky-bridge/ pom.xml README.md src/main/java/com/infinito/bluesky/ BlueskyBridgeEventListener.java BlueskyBridgeProviderFactory.java src/main/resources/META-INF/services/ org.keycloak.events.EventListenerProviderFactory The SPI implements handle sanitisation to the AT Protocol's allowed `[a-z0-9-]` charset, a 3-attempt retry budget for the PLC-bound provisioning step, and group-membership gating against `/roles/web-app-bluesky`. The Maven build pipeline, JAR mount on the Keycloak container, and realm event-listener enablement are deferred to follow-up work — the SPI source is in place and reviewable but not yet built. * Bridgy-fed (❌/❌/❌). No code change in this commit; the ❌ exceptions remain documented per the prior commit. Shared infrastructure / tooling: * `.github/dependabot.yml`: enable Maven coverage for the new Bluesky SPI pom.xml. * `.github/workflows/security-codeql.yml`: enable `java-kotlin` in the CodeQL matrix to scan the new Java source. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
07ada34155 |
feat(req-013): promote 6 web-* roles to beta with full per-role baselines
Implements requirement docs/requirements/013-alpha-to-beta-promotion.md for the in-scope subset: - web-app-minio: ✅/✅/✅ V0 OIDC + V1 LDAP variants green - web-app-joomla: ✅/✅/🛠️ V0 OIDC + V1 LDAP variants green - web-app-bridgy-fed: ❌/❌/❌ baseline (all 3 documented exceptions) - web-svc-libretranslate: 🛠️/❌/❌ baseline (LDAP+RBAC documented exceptions) - web-app-postmarks: 🛠️/🛠️/❌ baseline (RBAC documented exception) - web-app-bluesky: 🛠️/🛠️/❌ baseline (RBAC documented exception) Each role's `meta/services.yml.<entity>.lifecycle` is now `beta`. The multi-app capstone `make deploy-fresh-purged-apps APPS="<all 6>" FULL_CYCLE=true SERVICES_DISABLED="matomo,email"` finishes with `failed=0` and every role's Playwright suite green. Per-role highlights: * MinIO. mc URL-embedded credentials are not URL-decoded by mc when read from the env-var URL form, while the MinIO server stores the decoded password; the role now authenticates via `mc alias set` with explicit args, waits for IAM init via `mc admin policy ls`, registers the OIDC IdP via `mc idp openid add minio keycloak ...` (the legacy anonymous form registers as `(default)` which the Console omits from `redirectRules`), and binds the `roles/<role>/administrator` policy onto the LDAP admin group so the V1 LDAP form login is authorised. * Bridgy-fed. Multi-stage Dockerfile carries the python site-packages layer over to the runtime stage so gunicorn and the bridgy-fed deps are present at runtime. Removes the colon from `meta/main.yml.galaxy_info.description` so the dashboard config rendering does not produce invalid YAML. * Joomla. Adds `oidc:` enable + `ldap:` block in meta/services.yml, matrix-deploy variants for the two auth flows, and an extended Playwright env exposing OIDC issuer, biber persona, canonical domain, and the `<service>_SERVICE_ENABLED` gate flags. * LibreTranslate. Adds `container_port=5000`, drops the `dmbs_excl.yml.j2` depends_on partial that produced an empty `'': condition: service_healthy` map, and pins `LT_LOAD_ONLY=en,de` so the deploy gate's readiness probe does not race the upstream argos-translate model mirror. * Postmarks. Built from scratch as a full role (was a stub): tasks, Node-based Dockerfile that clones ckolderup/postmarks, compose template, env with SESSION_SECRET / ADMIN_KEY pulled from meta/schema.yml credentials, server.yml with subnet, Playwright env + spec. * Bluesky. Adds `files/playwright.spec.js` and `templates/playwright.env.j2` for the deploy gate. The Keycloak event-listener bridge to PDS `com.atproto.server.createAccount` remains to be built in follow-up work; until then the spec exercises baseline reachability and the OIDC/LDAP/RBAC gaps stay documented in `roles/web-app-bluesky/README.md` per lifecycle.md. Shared infrastructure: * `roles/test-e2e-playwright/tasks/run_one.yml`. The wait-for-app probe now accepts 4xx as proof of life; the prior `<400` boundary rejected legitimate 404 landing surfaces (bridgy-fed serves federation endpoints under specific paths, not `/`). 5xx remains the only signal of an unhealthy app. README.md SSO/RBAC exception sections per lifecycle.md (`docs/contributing/design/services/lifecycle.md`): * web-app-bluesky — RBAC exception * web-app-bridgy-fed — full SSO/RBAC exception * web-app-postmarks — RBAC exception * web-svc-libretranslate — LDAP + RBAC exception Out of scope for this commit (deferred to follow-up requirements): * Bluesky Keycloak event-listener SPI for PDS account auto- provisioning (needs Java SPI build pipeline + JAR mount + realm wiring). * LibreTranslate sidecar oauth2-proxy on the UI subpath only (must not gate the API endpoints). * Postmarks sidecar oauth2-proxy in front of the web UI. * Joomla community OIDC plugin install + group-mapping config. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
kevinveenbirkenbachandClaude Opus 4.7
|
ed04dad5d5 |
refactor(meta): land req-008/009/010 role-meta layout/networks/ports/run_after migration
Single atomic landing for three back-to-back role-meta refactor requirements
(see docs/requirements/008-role-meta-layout.md, 009-per-role-networks-and-ports.md,
010-role-meta-runafter-lifecycle-migration.md).
req-008 — role meta layout
* Move every role's metadata under meta/<topic>.yml with file-root
convention (no wrapping key matching the basename):
- schema/main.yml + config/main.yml.credentials → meta/schema.yml
- users/main.yml → meta/users.yml
- config/main.yml.server → meta/server.yml
- config/main.yml.rbac → meta/rbac.yml
- config/main.yml.compose.services + every other top-level key
of config/main.yml inlined under <entity>.<key>
→ meta/services.yml
- config/main.yml.compose.volumes → meta/volumes.yml
* Drop the legacy schema/, users/, config/ directories from every role.
* meta/schema.yml: support nested credential keys, optional `default:`
field (Jinja literal, not rendered/validated/regenerated), implicit
`algorithm: plain`.
* Materialised paths drop the `compose.` prefix:
compose.services.<e>.<…> → services.<e>.<…>
compose.volumes.<k> → volumes.<k>
<former-top-level>.<…> → services.<entity_name>.<former-top-level>.<…>
* Update every Python consumer (utils/cache, utils/manager, utils/applications,
plugins/lookup, plugins/filter, cli/*) plus every Jinja template, vars/*.yml
and task file to the new paths.
* No legacy fallback. Repository-wide grep for `compose.services.` /
`compose.volumes.` / `schema/main.yml` / `users/main.yml` / `config/main.yml`
is empty outside docs/requirements/ and tasks/utils/migrate_meta_layout.py.
* Add tests/lint/repository/test_role_meta_layout.py guarding against the
old paths returning, and an explicit lint guard that meta/variants.yml
files do not carry a `compose:` wrapper.
req-009 — per-role networks/ports
* Move group_vars/all/08_networks.yml.defaults_networks.local.<role>.{subnet,
dns_resolver} into roles/<role>/meta/server.yml.networks.local.{subnet,
dns_resolver}.
* Delete group_vars/all/09_ports.yml entirely; ports now live on the
service entity that exposes them at
roles/<role>/meta/services.yml.<entity>.ports.{inter,local,public}.
* Rename + int-cast every former top-level `services.<entity>.port`
field to `services.<entity>.ports.inter` (single int).
* Always-category-keyed maps for ports.local / ports.public; relay
spans use {start, end} integers.
* Add PORT_BANDS map to group_vars/all/08_networks.yml — single source
of truth for the per-<scope>.<category> band ranges, consumed by both
the new CLI helpers and the lint test.
* New CLI helpers (cli meta ports suggest, cli meta networks suggest)
walk the live role tree gap-first then increment-fallback, with
deterministic output and non-zero exit on capacity overflow.
* cli create role consumes both helpers when scaffolding a new role.
* Lint extensions: bare-int port shape rejection, host-bound port
collision check (single ints + relay span integers, inter excluded),
band-membership check with documented allow-list for the legacy
web-app-bigbluebutton.bigbluebutton.local.http: 48087 entry.
req-010 — run_after / lifecycle migration
* Move galaxy_info.run_after and galaxy_info.lifecycle out of
meta/main.yml into meta/services.yml.<primary_entity>.{run_after,
lifecycle}; <primary_entity> is the value returned by
get_entity_name(role_name).
* For multi-entity roles whose primary entity has no compose service
(web-app-bluesky → bluesky, web-app-matrix → matrix, desk/dev/drv/
gen roles), create a dedicated metadata-only top-level entry under
<primary_entity>.
* Introduce utils/roles/meta_lookup.py with get_role_run_after /
get_role_lifecycle that resolve <primary_entity> once and read from
meta/services.yml; degrade gracefully when meta/services.yml is
absent OR the field is absent; raise MetaServicesShapeError when the
file exists but is malformed.
* Update every consumer (utils/service_registry, utils/invokable,
cli/meta/applications/resolution/run_after/__main__, cli/meta/roles/
lifecycle_filter/__main__, cli/meta/applications/resolution/combined,
cli/build/{tree,graph,role_include}, cli/deploy/development/{common,
init,deps,deploy}, plugins/filter/canonical_domains_map, etc.) to
use the helper.
* Lint guards: no run_after/lifecycle in meta/main.yml; lifecycle
values restricted to {planned,pre-alpha,alpha,beta,stable,deprecated};
run_after/lifecycle never on a non-primary entity; empty run_after
lists rejected.
Also folded into this change set
* services_disabler now writes `services.<svc>.{enabled,shared}` into
host_vars instead of the old `compose.services.<svc>.{...}` path; the
discover/find pair walks meta/services.yml and only treats entries
carrying enabled/shared/provides as provider declarations (so
metadata-only entries from req-010 do not create spurious provider
rows).
* service_registry skips `run_after` deps whose target was filtered
out via SERVICES_DISABLED instead of failing the whole load.
* cli/mirror/resolver and cli/create/inventory/mirror_overrides emit/
consume the new applications.<role>.services.<svc>.image shape
(mirror.md updated to match).
* utils/domains/list.build_applications_from_roles now reads
meta/server.yml directly (it had been silently returning {} since
config/main.yml stopped existing).
* utils/roles/resource_validation.filter_roles_by_min_storage reads
meta/services.yml.<entity>.min_storage instead of the legacy
compose.services path.
* web-app-bluesky pre-clones the social-app build context BEFORE
sys-svc-compose so the build context is on disk by the time
sys-stk-front-proxy/tasks/main.yml flushes the docker build handler.
* 4 meta/variants.yml files (svc-ai-ollama, web-app-phpmyadmin,
web-app-wordpress, web-app-keycloak) lose their `compose: services:`
wrapper so deep-merge over meta/services.yml lands on the new
file-root shape.
Validation
* Unit tests: 1571 passed.
* Lint tests: 50 passed.
* Integration tests: 161 passed (1 skipped).
* Full-cycle fresh-purged-apps deploy succeeded for the 8-app validation
set: web-app-{nextcloud,wordpress,yourls,bigbluebutton,bluesky,gitea,
discourse,mattermost}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|