kevinveenbirkenbach and Claude Opus 4.7
91c57e0471
feat(req-013): alpha-to-beta promotion for 13 in-scope roles
...
Promote akaunting, baserow, bluesky, bookwyrm, bridgy-fed, flowise,
fusiondirectory, jenkins, joomla, minio, postmarks, libretranslate, xmpp
from `lifecycle: alpha` to `lifecycle: beta` per requirement 013.
socialhome stays alpha (operator-excluded).
SSO/LDAP integration per role:
- minio + jenkins + joomla + fusiondirectory: native first-party paths
(MINIO_IDENTITY_OPENID/_LDAP, oic-auth + ldap + role-strategy JCasC,
plg_system_keycloak, LDAP-as-storage). All V0+V1 verified.
- akaunting, baserow, bookwyrm, flowise, postmarks, libretranslate:
oauth2-proxy perimeter gate as universal glue path. Native in-app
OIDC integrations deferred to follow-up issues #219 (Baserow),
#220 (BookWyrm), #221 (Akaunting).
- bluesky: variant A+ login-broker (oauth2-proxy → broker → social-app)
with AES-256-GCM-encrypted PDS app-passwords cached in-process
(Keycloak user-attribute storage caused LDAP federation conflicts
that broke other realm-clients' OIDC logins).
- xmpp: native ejabberd LDAP backend for both variants
(mod_oauth2_client is contrib-only and deferred).
- bridgy-fed: documented SSO/LDAP/RBAC exception (federated source-
platform auth, no local user table).
Project-wide bugfixes:
- web-app-oauth2-proxy: propagate X-Forwarded-User /
-Preferred-Username / -Email / -Groups via auth_request_set bridge
(set_xauthrequest + pass_user_headers in cfg + nginx headers in
following_directives.conf). Benefits all 8 oauth2-proxy consumers.
- scripts/tests/deploy/local/deploy/fresh-kept-app.sh: bake
`RUNTIME=dev` into the matrix-init host vars so the Playwright
E2E gate fires (was silently skipped on kept-deploys).
From-scratch role implementations: jenkins (JCasC + plugin pre-bake +
JVM cacerts CA-trust entrypoint), fusiondirectory (LDAP-as-storage
compose), xmpp (ejabberd LDAP backend ejabberd.yml).
Verification:
- Per-role baseline: each in-scope role passed standalone V0/V1
Playwright suites green.
- Multi-app fresh-purged-apps over all 13 in-scope roles
(FULL_CYCLE=true): Pass 1 sync + Pass 2 async both `failed=0`,
every role's Playwright suite green.
Doc 013 acceptance section reflects the divergences (oauth2-proxy
glue path, in-memory bluesky cache, deferred contrib modules) with
explicit follow-up issue references.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-02 12:47:01 +02:00
kevinveenbirkenbachandClaude Fable 5