- Remove deprecated filter_plugins/tls.py and all dependent filters
- Introduce strict lookup plugin lookup_plugins/tls_resolve.py as single TLS authority
- Migrate all roles, templates, vars, and tasks to use tls_resolve (protocols, ports, URLs, cert paths)
- Enforce explicit TLS context (domains, applications, TLS_ENABLED, TLS_MODE)
- Support letsencrypt and self_signed with SAN handling and per-app overrides
- Update TLS provider roles to assert resolver state instead of setting facts
- Add comprehensive unit tests for tls_resolve lookup
https://chatgpt.com/share/6972b49b-b074-800f-a323-dd9fe69d02eb
- add --inventory-dir to container CLI test invocations
- assert inventory_dir is forwarded to run_in_container()
- add tests for required INVENTORY_DIR when env is missing
- add test for INVENTORY_DIR env fallback
https://chatgpt.com/share/69700d69-b270-800f-ad50-d9ff486378b9
- Replace static argparse-based CLI in cli.deploy.development with dynamic
module dispatcher compatible with nested command discovery.
- Ensure cli.deploy.development is executable via python -m and root dispatcher.
- Fix unit test path resolution to work locally and in CI.
- Make docker-* Makefile targets depend on install.
- Simplify test runner script and keep Nix flake config compatibility.
This aligns the CLI architecture with integration test discovery
(cli/**/__main__.py) and removes the need for manual subcommand registration.
https://chatgpt.com/share/696fdbbc-b6d8-800f-a8b5-067aa7e38706
- Add optional HTTP-only mode for Mastodon deployments
- Inject override initializer to hard-disable force_ssl and ActionDispatch::SSL
- Mount override into Mastodon and Sidekiq containers
- Prevent automatic compose flush before migrations
- Apply overrides before setup phase
Also:
- Remove unconditional HSTS header from ws_generic proxy vhost
- Make OIDC optional for CI (docker-in-docker)
- Fix env.j2 quoting and formatting
- Gate HSTS in Nextcloud behind TLS_ENABLED
https://chatgpt.com/share/696e914c-c758-800f-b16e-6341873c0e0e
- add role_config_path support and services edges in combined resolver/tree
- add services resolver mapping with desktop enabled rule (non-shared)
- add unittest coverage for repo_paths, yaml parsing, services mapping/BFS, and combined tree cycles
- update tests to reflect new stable path expectations and tree output
https://chatgpt.com/share/696cb80f-e8f4-800f-b062-e47985b4b074
Replace legacy volumes*.yml.j2 includes with the new compose_volumes filter across roles.
Add YAML-safe serialization for Ansible/Jinja proxy types to avoid PyYAML representer errors.
Remove obsolete volumes templates and extend unit tests to enforce required database_volume behavior.
https://chatgpt.com/share/696c2722-fd30-800f-bf01-dfcd3cb7ba72
- Add compose_volumes filter to generate docker-compose volumes section dynamically
- Preserve exact logic from roles/docker-compose/templates/volumes.yml.j2
- database volume only when database service enabled and not shared
- redis volume when redis service enabled or oauth2 enabled
- no fallback names, database_volume is required when database is needed
- Support manual volume injection via extra_volumes (YAML merge equivalent)
- Add strict input validation for applications and application_id
- Add full unit test coverage for all conditions and edge cases
https://chatgpt.com/share/696c1710-04c4-800f-a73f-de3d5ebd2902
- Support space-separated, comma-separated and mixed --id values
- Normalize and deduplicate application IDs before validation
- Fix Makefile to pass APP without quoting
- Add unittest coverage for ID normalization
https://chatgpt.com/share/696be0c2-816c-800f-8b07-3c5cd0304ac5
- Always emit reserved flag in generated users (default: false)
- Do not override existing user definitions via --reserved-usernames
- Normalize description default to empty string
- Align unit tests with new reserved semantics
- Fix YAML quoting and trailing newline issues
- Clean up minor formatting and config inconsistencies
https://chatgpt.com/share/696bb761-0048-800f-9cf7-aebd3fda75be
- Render WEB_PROTOCOL and domain_url via templar in docker_cards lookup
- Add DummyTemplar with Ansible-like bool filter for stable unit testing
- Refactor tests to use templar injection via _run_lookup helper
- Add coverage for Jinja-based WEB_PROTOCOL and domain rendering
This ensures lookup behavior matches real Ansible runtime while keeping unit tests deterministic.
https://chatgpt.com/share/696ac8bf-8c0c-800f-a3e7-db4bfb2a8f3f
- Enforce explicit WEB_PROTOCOL variable for URL generation
- Fail fast with AnsibleError when WEB_PROTOCOL is missing
- Add unit tests for http/https protocol handling
- Refactor test fixtures using shared base variables
This makes URL generation deterministic and proxy-agnostic and avoids
implicit defaults in desktop card rendering.
https://chatgpt.com/share/696a958b-eeec-800f-867b-842e0621b4bb
- Change --log flag to require explicit log directory (--log <LOG_DIR>)
- Automatically create log directory with parents=True
- Harden permissions best-effort (0700)
- Update CLI help text accordingly
- Adjust Makefile test targets to pass explicit log directory
- Ignore logs/ via .gitignore and .dockerignore
- Refactor flag parsing to correctly detect deploy with --log
- Add dedicated logging unit tests
- Update existing tests for new log semantics
- Remove deprecated -i alias for --id in deploy command
https://chatgpt.com/share/6969680a-dbf8-800f-aafb-3d32d6212ba0
- Remove unused cli_root and logs handling from dedicated deploy wrapper
- Add parse_known_args() to forward native ansible-playbook flags
- Append passthrough args at the end for proper override behavior
- Clean up MODE_LOGS usage
- Update runner signature and cleanup phase logic
- Adapt unit tests to new wrapper contract
- Add unit test for ansible flag passthrough in command.main()
https://chatgpt.com/share/69694ad5-453c-800f-8047-cf210f60460f
The applications parameter is guaranteed to always be a dict in the runtime
environment. The defensive test for non-mapping input was therefore removed
to avoid unrealistic failure scenarios and false negatives.
This keeps the unit tests aligned with the actual inventory and schema model.
https://chatgpt.com/share/6968551e-7b74-800f-8a5e-a2380c950d06
* Switch feature flag paths from docker.service.<name>.enabled to docker.services.<name>.enabled
* Update CSP builder and smart-default toggles and unit tests
* Update desktop cards iframe flag and desktop domain validation
* Update logout domain filter and tests
* Update recaptcha enable flags in Keycloak and EspoCRM
* Fix sys-ctl-cln-docker meta description formatting
* Follow-up: reorder imports in web_health_expectations so module_utils path injection runs before importing get_app_conf
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Update CSP smart-default toggles to use docker.service.<feature>.enabled
(matomo, simpleicons, recaptcha, hcaptcha, logout, desktop)
- Refactor inj_enabled filter to resolve docker.service.<feature>.enabled only
- Migrate inj_enabled unit tests to the new flag layout
- Normalize and reformat CSP test fixtures for readability and consistency
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Switch CSP smart-default toggles to docker.service.<name>.enabled flags
(matomo, simpleicons, recaptcha, hcaptcha, logout, desktop)
- Update CSP header logic docs/comments to match new flag layout
- Split large CSP filter unit test into focused test modules for clarity
- Add coverage for service toggle behavior, determinism, union rules, and hash guards
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Allow credentials generator to run for roles without schema/main.yml so
transitive config-based generation still works.
- Make InventoryManager resilient to missing YAML by defaulting to {} and
only loading schema when schema/main.yml exists.
- Add recursive shared-provider include resolution based on docker.services
config and apply provider schemas/special rules transitively.
- Require database_password injection only when database.enabled=true and shared=true.
- Update unit/integration tests to create required files for .exists() checks and
validate transitive provider role credential generation.
https://chatgpt.com/share/69639d93-4c10-800f-bc6c-8e5b9fb75088
The test suite intentionally modifies PYTHONPATH to import the role-local script
module. Suppress ruff E402 for this specific import to keep linting strict
everywhere else while documenting the exception.
https://chatgpt.com/share/69637f6e-5370-800f-806f-d5d0820c005f
Update unit tests to:
- Add role files directory to PYTHONPATH for importing script.py
- Assert SystemExit and exit codes instead of mocking sys.exit
- Ensure run_checker is not called when no domains or config dir is missing
- Keep existing behavior and expectations intact
This makes the tests robust and prevents false positives caused by mocked sys.exit continuing execution.
https://chatgpt.com/share/69637cc6-c1d0-800f-a196-df86ccbaee14
Run the CSP checker container with --network host by default so localhost and
internal vhosts are reachable when executed inside Docker-in-Docker setups.
Adds:
- Optional --no-host-network flag to disable host networking
- Extended docker command builder with host network support
- Unit tests for domain extraction, docker command generation, and CLI behavior
This ensures CSP health checks work reliably for services bound to the
parent container's network namespace.
https://chatgpt.com/share/69630726-4514-800f-b350-61ae7a4010b1
Stop cleanup script from busy-looping when disk usage is above threshold but no
backup versions exist by breaking early when average_version_directories == 0.
Add unit tests to verify:
- script exits immediately when disk usage is below threshold
- script breaks safely when disk usage is high but no backups are present
This prevents CI hangs and excessive CPU usage caused by infinite iterations.
https://chatgpt.com/share/6962de45-3750-800f-bc8d-5ba205beeaaf
- Move generate_value/generate_secure_alphanumeric out of InventoryManager into new ValueGenerator
- Wire InventoryManager to use self.value_generator for all secret generation
- Tighten schema include logic for shared databases: require enabled=true and shared=true
- Update unit tests to patch ValueGenerator.generate_value instead of InventoryManager.generate_value
- Add end-to-end integration test for InventoryManager using real files and a fake VaultHandler
- Remove redundant legacy unit test file and add dedicated ValueGenerator unit tests
https://chatgpt.com/share/6962d2e6-7fdc-800f-ba83-9e150b19a5f0
Replace legacy feature flags (features.central_database, features.oauth2) with
docker service based configuration:
- docker.services.database.shared
- docker.services.oauth2.enabled
Update InventoryManager logic accordingly and adapt all unit tests to mock
the new config structure.
This ensures inventory generation now follows the canonical docker service
configuration model.
https://chatgpt.com/share/69628906-5efc-800f-999b-2ae3ece1907f
Introduce retry logic with exponential backoff for git operations to reduce flaky
CI/Docker failures (e.g., "Connection reset by peer"). Replace run(check=True)
with run_checked() and add transient error detection. Update unit tests to match
new execution and error-handling behavior.
https://chatgpt.com/share/6960d28d-3e2c-800f-943b-a80630a6a395
- Add custom Ansible module file_has_content to validate databases.csv on target host
- Fail hard if databases.csv is missing or not a regular file
- Compute backup force-flush flag based on MODE_BACKUP and actual file content
- Prevent instant backup flush when no database secrets are present
- Add full unittest coverage for file_has_content module
- Make sys-service flush behavior data-driven and deterministic
https://chatgpt.com/share/6960cdb6-dd28-800f-8427-2e375de4e61b
- Restore lifecycle-based role exclusion via cli.meta.roles.lifecycle_filter
- Make tested lifecycles configurable through TESTED_LIFECYCLES env
- Apply lifecycle gating consistently for workstation and server tests
- Fix minor bug in invokable parsing (avoid shadowing built-in list)
- Improve logging with lifecycle exclusion details
https://chatgpt.com/share/695fbcf4-2148-800f-8685-56ee73a9bae0
- Always derive roles/ path from repository root instead of accepting a parameter
- Fail fast if roles directory is missing or mislocated
- Add explicit typing and Path-based path handling
- Update unit tests to rely on real repo roles instead of temporary fixtures
- Ensure tests cover correct role discovery and inventory validation
https://chatgpt.com/share/695fb926-1f5c-800f-9012-e2922bb1df3f
- Introduce CLI tool to resolve galaxy_info.run_after dependencies transitively
- Detect and report circular run_after dependencies explicitly
- Validate role existence and run_after schema strictly
- Provide whitespace-separated output for easy shell usage
- Add comprehensive unittest coverage including CLI behavior and error cases
https://chatgpt.com/share/695f8e09-54f4-800f-9f5f-ed9c2fdd664b
- Make pull-specific-host.py fail on any command error (and rsync after retries), emit clear stderr, and exit 0/1 via main()
- Keep remote `find ... -execdir basename {} ;` unchanged to stay compatible with existing ssh-wrapper.sh
- Update wrapper script to continue across hosts but return exit 1 if any host failed
- Adjust unit tests to expect exceptions instead of SystemExit
https://chatgpt.com/share/695e9615-6014-800f-a77d-5809cf45559d
- Introduce meta roles lifecycle_filter CLI to select roles by lifecycle
- Support whitelist/blacklist modes, selection filtering, and auto-detected roles dir
- Fix blacklist handling for roles with missing lifecycle
- Forward --help correctly to subcommand argparse
- Add unit tests for lifecycle filtering logic
https://chatgpt.com/share/695d09d2-c864-800f-9e23-b9db0c6f3537
- Migrate Mailu credentials from legacy mailu_token to tokens['web-app-mailu']
- Update all affected application templates to use the new token structure
- Adjust inventory validation to no longer special-case mailu_token
- Minor typing and formatting cleanups in inventory creation and tests
https://chatgpt.com/share/69554915-87c8-800f-afd5-12118dbb1107
**Body**
* add sys-token-store filter plugin to hydrate users.*.tokens from persisted store (users win if non-empty)
* load token store during sys-token-store core run and inject hydrated tokens into users fact
* remove legacy lookup task and simplify docs + store path naming
* switch Matomo frontend injection to use hydrated users.administrator.tokens[web-app-matomo] directly
* ensure Mailu token handling uses sys-token-store write task and checks token presence via users.*.tokens
* add unittest for token hydration filter plugin with path-based module loading
* Move SSH key handling to users.<name>.authorized_keys (list-only) and write keys via shared user role
* Enforce at least one SSH key for administrator user
* Wrap backup user keys with restricted command wrapper before writing authorized_keys
* Remove legacy inventory file copy and CLI flag/function for administrator authorized_keys
* Extend user setup generator to include authorized_keys field
* Rename administrator scripts path to root scripts path and update dependent variables
* Update inventory sample and docs to reflect new SSH key workflow
https://chatgpt.com/share/695510b8-23f4-800f-b5db-877b07a1469b
* Replace global `SSL_ENABLED` flag with `TLS_ENABLED`
* Update web protocol/ports (http/https, ws/wss) to use `TLS_ENABLED`
* Switch cert-related roles and nginx TLS header gating to `TLS_ENABLED`
* Update app env templates (BookWyrm, Confluence, Jira, Magento, OpenProject, WordPress, etc.) to use `TLS_ENABLED`
* Adjust inventory generator to write `TLS_ENABLED` and update CLI help text accordingly
* Update unit tests for inventory vars overrides to expect `TLS_ENABLED`
https://chatgpt.com/share/695306ef-a798-800f-b118-e07b525e1811
- add --vars-file CLI option to load host_vars overrides from YAML
- merge vars-file overrides before JSON --vars (JSON takes precedence)
- implement deep-merge logic for YAML vars files
- update CI deploy script to use vars file instead of inline JSON
- add unit test for apply_vars_overrides_from_file
- remove obsolete MASK_CREDENTIALS_IN_LOGS TODO entry
https://chatgpt.com/share/6952e51d-6c50-800f-8764-31dc8c609cdb
kevinveenbirkenbach