Add a unittest-based integration test that scans all roles/*/config/main.yml
and validates docker.services.*.image and *.version only when present.
Ensures allowed Docker image name and tag characters without enforcing
image/version coupling.
https://chatgpt.com/share/6980cd2d-0644-800f-9e1f-0c8daa98e85c
- Add integration test ensuring docker-compose.yml.j2 services that include build.yml.j2
also define an image tag or YAML merge (<<:) at the same level
- Fix false positives by allowing image inheritance via anchors
- Add explicit custom image variables for littlejs and roulette-wheel services
- Minor formatting cleanup
https://chatgpt.com/share/697e8c69-0298-800f-ab25-2f650d6e7df9
compose_ca_inject now discovers profiles from compose files, merges services from default + each profile config, and ensures missing images are built/pulled before inspecting entrypoint/cmd. Tests were updated to cover entrypoint normalization and the new profile-scan behavior.
Adds an integration test that fails when a service defines `build:` without an `image:` on the same indentation level. This enforces stable image names for tooling like CA-injection and makes compose behavior more predictable.
https://chatgpt.com/share/697bb4af-0d58-800f-8edd-aaef4c224319
Move TLS/ACME/CA vars out of 00_general into group_vars/all/02_tls.yml and renumber subsequent group_vars files. Add sys-ca-selfsigned to generate /etc/<software>/ca/root-ca.crt and make docker-compose-ca depend on it. Update setup script, templates, and tests to use the new applications/users file numbering.
https://chatgpt.com/share/697b8150-22ac-800f-98b1-e063a659b684
- add sed_escape Jinja filter for sed replacement safety
- escapes \, &, and the active sed delimiter
- designed explicitly for sed s/// replacement context
- patch all sed-based config updates across roles
- espocrm, friendica, gitea, matomo, moodle, wordpress
- ensure every Jinja value in sed replacements uses sed_escape
- use correct delimiter-specific escaping (/, |, #)
- add robust integration test to enforce sed_escape usage
- scans all roles/*/tasks/**/*.yml
- detects sed substitutions with Jinja in replacement part
- ignores delimiters inside {{ ... }} blocks
- fails CI if sed_escape is missing
- harden repository against sed injection, delimiter breakage,
and credential corruption in config patching tasks
https://chatgpt.com/share/6974fb45-1ee8-800f-80bd-c71122e4ac02
Extend password-quoting integration test to:
- fail when password variables in shell tasks miss the `| quote` filter
- fail when `| quote` is used but the Jinja expression is wrapped in quotes
(double-quoting)
This ensures shell-safe password handling and prevents quoted secrets
from being passed literally to CLI tools.
https://chatgpt.com/share/6974dd33-9470-800f-b469-d31fabcd59e1
- add integration test to ensure password variable definitions never use '| quote'
- add integration test to ensure password usage in shell tasks always uses '| quote'
- scope checks to roles/**.yml using regex-based best-effort parsing
https://chatgpt.com/share/6974da97-e6dc-800f-8acc-43aa45e6cf8f
- Skip Python attribute matches that are used as method calls (e.g. applications.setdefault(...))
- Add line and column information to assertion errors
- Print the exact source line for faster debugging of invalid application references
https://chatgpt.com/share/697215ce-df3c-800f-b81f-641c75939e7f
Exclude the .github directory from template/YAML scanning to avoid
false positives from GitHub Actions expressions. Directory exclusion
is now centralized via EXCLUDE_DIRS and respects EXCLUDE_TESTS.
https://chatgpt.com/share/6965b7a8-8084-800f-a8b5-446f265d5bf2
Add support for ignoring individual run_once_* when-conditions if the same
line contains the marker comment:
# pass test_run_once_suffix_matches_role
This allows intentional cross-role run_once usage (e.g. shared provider
roles) without weakening the global schema enforcement.
Also document the exception behavior directly in the test.
https://chatgpt.com/share/69653e36-c058-800f-921d-b4af9014df04
fix(openldap): make memberof/refint provisioning idempotent and robust
Refactor OpenLDAP cn=config provisioning:
- load memberof and refint modules via ldapmodify
- add overlays via ldapadd with proper error handling
- make handlers idempotent (ignore duplicate/value-exists errors)
- dynamically resolve module DN and data backend DN (mdb/hdb)
- clean up legacy LDIF definitions
This fixes rc=80 handler failures and allows safe re-runs.
https://chatgpt.com/share/69653e42-e020-800f-a6c3-9c37ec5e8028
* Switch feature flag paths from docker.service.<name>.enabled to docker.services.<name>.enabled
* Update CSP builder and smart-default toggles and unit tests
* Update desktop cards iframe flag and desktop domain validation
* Update logout domain filter and tests
* Update recaptcha enable flags in Keycloak and EspoCRM
* Fix sys-ctl-cln-docker meta description formatting
* Follow-up: reorder imports in web_health_expectations so module_utils path injection runs before importing get_app_conf
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Add default status codes (403, 200) for web-svc-html to reflect missing index.html on init
- Normalize YAML formatting and ensure trailing newlines
- Fix integration test formatting for config generation
- Align vars indentation with project style
https://chatgpt.com/share/6963a552-9580-800f-b6f2-2547959d9dc8
- Allow credentials generator to run for roles without schema/main.yml so
transitive config-based generation still works.
- Make InventoryManager resilient to missing YAML by defaulting to {} and
only loading schema when schema/main.yml exists.
- Add recursive shared-provider include resolution based on docker.services
config and apply provider schemas/special rules transitively.
- Require database_password injection only when database.enabled=true and shared=true.
- Update unit/integration tests to create required files for .exists() checks and
validate transitive provider role credential generation.
https://chatgpt.com/share/69639d93-4c10-800f-bc6c-8e5b9fb75088
- Move generate_value/generate_secure_alphanumeric out of InventoryManager into new ValueGenerator
- Wire InventoryManager to use self.value_generator for all secret generation
- Tighten schema include logic for shared databases: require enabled=true and shared=true
- Update unit tests to patch ValueGenerator.generate_value instead of InventoryManager.generate_value
- Add end-to-end integration test for InventoryManager using real files and a fake VaultHandler
- Remove redundant legacy unit test file and add dedicated ValueGenerator unit tests
https://chatgpt.com/share/6962d2e6-7fdc-800f-ba83-9e150b19a5f0
- Migrate Mailu credentials from legacy mailu_token to tokens['web-app-mailu']
- Update all affected application templates to use the new token structure
- Adjust inventory validation to no longer special-case mailu_token
- Minor typing and formatting cleanups in inventory creation and tests
https://chatgpt.com/share/69554915-87c8-800f-afd5-12118dbb1107
The run_once integration test only detected short-form `set_fact`
and failed to recognize fully qualified module usage
(`ansible.builtin.set_fact`).
This caused false negatives for roles correctly using FQCN-compliant
Ansible syntax.
Fix:
- Accept both `set_fact` and `ansible.builtin.set_fact` when collecting
global run_once_<suffix> definitions
- Accept both forms when detecting per-role run_once definitions
- Remove redundant prefilter token, as structural detection is sufficient
No production logic is affected.
https://chatgpt.com/share/6950fe2c-4b24-800f-9f40-85b2fed3bfba
- Move databases.csv permission task from seed phase to core tasks
- Ensure root-only permissions are enforced early and unconditionally
- Remove custom run-once logic and related state tracking
- Simplify role logic and improve determinism
- Update run-once integration test documentation and expectations
- Add TODO to verify Docker-in-Docker behavior
Only handlers defined in handlers/main.yml/main.yaml are considered.
Task files included via include_tasks/import_tasks under handlers/ are
regular tasks and must not be treated as standalone handlers.
This prevents false positives where internal handler sub-steps were
incorrectly reported as missing notify targets.
https://chatgpt.com/share/6949290a-a694-800f-bb29-60cd96321f62
- Add new role sys-util-git-pull as a generic system utility
- Implement robust shallow clone/update logic in Python helper
- Support detached-safe branch updates and optional tag pinning
- Handle annotated vs lightweight tags and heal local tag conflicts
- Provide deterministic Ansible change detection via machine-readable output
- Add verbose logging to stderr for debuggability
- Integrate sys-util-git-pull into pkgmgr role to replace inline git logic
- Add comprehensive unit tests (option A: file-based import) for helper script
- Add role README and meta information with platform-agnostic support
- Ensure role conforms to existing test expectations (meta/main.yml present)
https://chatgpt.com/share/69481902-a98c-800f-9b3f-9ee13e8e50b7
Migrate most roles from community.general.pacman to the generic package module for better portability. Keep pacman where it is required (system upgrades and Arch-specific tasks). Split VirtualBox setup into an Arch-only task file and add a warning when skipped on non-Arch systems. Update integration test examples accordingly.
https://chatgpt.com/share/6947ce9f-3228-800f-8365-2253b5ed9451
