cert_plan now requires CURRENT_PLAY_DOMAINS_ALL to be a non-empty list of strings when TLS_SELFSIGNED_SCOPE=global and uses it directly for SAN generation. Update unit tests to cover the strict contract and validation errors.
https://chatgpt.com/share/697bc866-0558-800f-8f2c-08ec84190a68
compose_ca_inject now discovers profiles from compose files, merges services from default + each profile config, and ensures missing images are built/pulled before inspecting entrypoint/cmd. Tests were updated to cover entrypoint normalization and the new profile-scan behavior.
Adds an integration test that fails when a service defines `build:` without an `image:` on the same indentation level. This enforces stable image names for tooling like CA-injection and makes compose behavior more predictable.
https://chatgpt.com/share/697bb4af-0d58-800f-8edd-aaef4c224319
Remove project kwarg from compose_ca_inject_cmd, derive entity name internally,
and reuse compose_f_args with include_ca=false for bootstrap consistency.
Add include_ca flag to compose_f_args and update unit tests accordingly.
https://chatgpt.com/share/697b9d97-0cf0-800f-805d-7e8308b6f832
Introduce module_utils/jinja_strict.py to render nested Jinja-in-vars with hard-fail semantics. Refactor cert_plan, compose_f_args, and compose_ca_inject_cmd to use render_strict so no "{{ ... }}" leaks into generated paths/commands, and add unit tests.
https://chatgpt.com/share/697b8e1b-54fc-800f-b895-7161f00ebd51
Move TLS/ACME/CA vars out of 00_general into group_vars/all/02_tls.yml and renumber subsequent group_vars files. Add sys-ca-selfsigned to generate /etc/<software>/ca/root-ca.crt and make docker-compose-ca depend on it. Update setup script, templates, and tests to use the new applications/users file numbering.
https://chatgpt.com/share/697b8150-22ac-800f-98b1-e063a659b684
cert_plan now strictly renders Jinja-containing path variables (e.g. TLS_SELFSIGNED_BASE_PATH / LETSENCRYPT_LIVE_PATH) using hostvars context and fails fast if markers remain. Add unit tests covering successful expansion, hostvars precedence, and hard-fail behavior when variables are missing or Jinja leaks through. Include SOFTWARE_NAME in constructor debug output for easier runtime inspection.
https://chatgpt.com/share/697b73c6-f5f8-800f-96cc-e360a137e7a7
Ensure dotenv_quote escapes `$` as `$$` so secrets are not
expanded by docker compose when rendered into .env files.
Add unit tests covering $, quotes, backslashes, unicode and
edge cases to prevent regressions.
https://chatgpt.com/share/6977825f-d8f8-800f-bafb-aae3b3704945
Switch CSP health crawler to URL-only mode by deriving http/https from each
nginx .conf (listen 80/443/ssl) and passing full URLs to csp-checker.
Update unit tests accordingly.
BREAKING CHANGE: sys-ctl-hlth-csp now passes full URLs instead of domains.
https://chatgpt.com/share/69756136-e658-800f-9e52-7d9c4a79d026
- add sed_escape Jinja filter for sed replacement safety
- escapes \, &, and the active sed delimiter
- designed explicitly for sed s/// replacement context
- patch all sed-based config updates across roles
- espocrm, friendica, gitea, matomo, moodle, wordpress
- ensure every Jinja value in sed replacements uses sed_escape
- use correct delimiter-specific escaping (/, |, #)
- add robust integration test to enforce sed_escape usage
- scans all roles/*/tasks/**/*.yml
- detects sed substitutions with Jinja in replacement part
- ignores delimiters inside {{ ... }} blocks
- fails CI if sed_escape is missing
- harden repository against sed injection, delimiter breakage,
and credential corruption in config patching tasks
https://chatgpt.com/share/6974fb45-1ee8-800f-80bd-c71122e4ac02
Extend password-quoting integration test to:
- fail when password variables in shell tasks miss the `| quote` filter
- fail when `| quote` is used but the Jinja expression is wrapped in quotes
(double-quoting)
This ensures shell-safe password handling and prevents quoted secrets
from being passed literally to CLI tools.
https://chatgpt.com/share/6974dd33-9470-800f-b469-d31fabcd59e1
- add integration test to ensure password variable definitions never use '| quote'
- add integration test to ensure password usage in shell tasks always uses '| quote'
- scope checks to roles/**.yml using regex-based best-effort parsing
https://chatgpt.com/share/6974da97-e6dc-800f-8acc-43aa45e6cf8f
Introduces role-local `kcadm_json` filter + `module_utils/kcadm_json.py` to reliably parse kcadm output with JVM noise, and reuses it in `keycloak_kcadm_update` and LDAP/RBAC/recaptcha tasks to eliminate jq/`--query`. Also refactors LDAP groups.path handling via `include_tasks` to avoid repeated `when` conditions and adds unit tests for filter/module utils/library behavior.
https://chatgpt.com/share/69743d89-b1c0-800f-b571-90f64605dfe4
Make has_domain filter self-contained (no module_utils/sys.path hacks) and let compose_f_args detect domains internally to avoid missing-filter failures. Adjust unit tests accordingly and increase Mailu user creation retry delay.
https://chatgpt.com/share/6973e02e-f22c-800f-aae3-1f57637a746c
Deploy /usr/local/bin/infinito-compose to auto-detect .env and compose override files.
Refactor sys-ctl-rpr-docker-{hard,soft} to use the wrapper consistently.
Update unit tests to match wrapper-based command building.
https://chatgpt.com/share/6973c64c-b560-800f-8915-cbb786c51714
Introduce docker-compose-ca role with CA wrapper and inject script, add CA-aware compose override handling, and refactor compose pull/run logic to support multi-file projects. Update handlers, lookups, paths, and unit tests to consistently resolve TLS-driven CA injection without implicit defaults.
https://chatgpt.com/share/6973c00c-139c-800f-8ddb-e7d0cf5043fc
- Extract shared TLS logic into module_utils/tls_common
- Introduce cert_plan lookup for certificate paths and SAN computation
- Simplify tls_resolve to strict protocol/port/domain resolution only
- Add global self-signed certificate scope covering all domains
- Mount self-signed cert base into OpenResty container
- Update Nginx templates to use cert_plan for ssl_certificate paths
- Add comprehensive unit tests for tls_common, tls_resolve, and cert_plan
https://chatgpt.com/share/6972c568-9e8c-800f-b89a-a0061966f9a8
- Remove legacy WEB_PROTOCOL dependency from docker_cards lookup
- Build application URLs using strict tls_resolve lookup
- Align desktop card URL generation with new TLS layer
- Update unit tests to stub tls_resolve and validate TLS-based behavior
- Drop WEB_PROTOCOL-related test cases
https://chatgpt.com/share/6972b832-8284-800f-8b86-f1a32061c09f
- Remove deprecated filter_plugins/tls.py and all dependent filters
- Introduce strict lookup plugin lookup_plugins/tls_resolve.py as single TLS authority
- Migrate all roles, templates, vars, and tasks to use tls_resolve (protocols, ports, URLs, cert paths)
- Enforce explicit TLS context (domains, applications, TLS_ENABLED, TLS_MODE)
- Support letsencrypt and self_signed with SAN handling and per-app overrides
- Update TLS provider roles to assert resolver state instead of setting facts
- Add comprehensive unit tests for tls_resolve lookup
https://chatgpt.com/share/6972b49b-b074-800f-a323-dd9fe69d02eb
- Skip Python attribute matches that are used as method calls (e.g. applications.setdefault(...))
- Add line and column information to assertion errors
- Print the exact source line for faster debugging of invalid application references
https://chatgpt.com/share/697215ce-df3c-800f-b81f-641c75939e7f
- add --inventory-dir to container CLI test invocations
- assert inventory_dir is forwarded to run_in_container()
- add tests for required INVENTORY_DIR when env is missing
- add test for INVENTORY_DIR env fallback
https://chatgpt.com/share/69700d69-b270-800f-ad50-d9ff486378b9
- Replace static argparse-based CLI in cli.deploy.development with dynamic
module dispatcher compatible with nested command discovery.
- Ensure cli.deploy.development is executable via python -m and root dispatcher.
- Fix unit test path resolution to work locally and in CI.
- Make docker-* Makefile targets depend on install.
- Simplify test runner script and keep Nix flake config compatibility.
This aligns the CLI architecture with integration test discovery
(cli/**/__main__.py) and removes the need for manual subcommand registration.
https://chatgpt.com/share/696fdbbc-b6d8-800f-a8b5-067aa7e38706
- Add optional HTTP-only mode for Mastodon deployments
- Inject override initializer to hard-disable force_ssl and ActionDispatch::SSL
- Mount override into Mastodon and Sidekiq containers
- Prevent automatic compose flush before migrations
- Apply overrides before setup phase
Also:
- Remove unconditional HSTS header from ws_generic proxy vhost
- Make OIDC optional for CI (docker-in-docker)
- Fix env.j2 quoting and formatting
- Gate HSTS in Nextcloud behind TLS_ENABLED
https://chatgpt.com/share/696e914c-c758-800f-b16e-6341873c0e0e
- add role_config_path support and services edges in combined resolver/tree
- add services resolver mapping with desktop enabled rule (non-shared)
- add unittest coverage for repo_paths, yaml parsing, services mapping/BFS, and combined tree cycles
- update tests to reflect new stable path expectations and tree output
https://chatgpt.com/share/696cb80f-e8f4-800f-b062-e47985b4b074
Replace legacy volumes*.yml.j2 includes with the new compose_volumes filter across roles.
Add YAML-safe serialization for Ansible/Jinja proxy types to avoid PyYAML representer errors.
Remove obsolete volumes templates and extend unit tests to enforce required database_volume behavior.
https://chatgpt.com/share/696c2722-fd30-800f-bf01-dfcd3cb7ba72
- Add compose_volumes filter to generate docker-compose volumes section dynamically
- Preserve exact logic from roles/docker-compose/templates/volumes.yml.j2
- database volume only when database service enabled and not shared
- redis volume when redis service enabled or oauth2 enabled
- no fallback names, database_volume is required when database is needed
- Support manual volume injection via extra_volumes (YAML merge equivalent)
- Add strict input validation for applications and application_id
- Add full unit test coverage for all conditions and edge cases
https://chatgpt.com/share/696c1710-04c4-800f-a73f-de3d5ebd2902
- Support space-separated, comma-separated and mixed --id values
- Normalize and deduplicate application IDs before validation
- Fix Makefile to pass APP without quoting
- Add unittest coverage for ID normalization
https://chatgpt.com/share/696be0c2-816c-800f-8b07-3c5cd0304ac5
- Always emit reserved flag in generated users (default: false)
- Do not override existing user definitions via --reserved-usernames
- Normalize description default to empty string
- Align unit tests with new reserved semantics
- Fix YAML quoting and trailing newline issues
- Clean up minor formatting and config inconsistencies
https://chatgpt.com/share/696bb761-0048-800f-9cf7-aebd3fda75be
- Render WEB_PROTOCOL and domain_url via templar in docker_cards lookup
- Add DummyTemplar with Ansible-like bool filter for stable unit testing
- Refactor tests to use templar injection via _run_lookup helper
- Add coverage for Jinja-based WEB_PROTOCOL and domain rendering
This ensures lookup behavior matches real Ansible runtime while keeping unit tests deterministic.
https://chatgpt.com/share/696ac8bf-8c0c-800f-a3e7-db4bfb2a8f3f
- Enforce explicit WEB_PROTOCOL variable for URL generation
- Fail fast with AnsibleError when WEB_PROTOCOL is missing
- Add unit tests for http/https protocol handling
- Refactor test fixtures using shared base variables
This makes URL generation deterministic and proxy-agnostic and avoids
implicit defaults in desktop card rendering.
https://chatgpt.com/share/696a958b-eeec-800f-867b-842e0621b4bb
- Change --log flag to require explicit log directory (--log <LOG_DIR>)
- Automatically create log directory with parents=True
- Harden permissions best-effort (0700)
- Update CLI help text accordingly
- Adjust Makefile test targets to pass explicit log directory
- Ignore logs/ via .gitignore and .dockerignore
- Refactor flag parsing to correctly detect deploy with --log
- Add dedicated logging unit tests
- Update existing tests for new log semantics
- Remove deprecated -i alias for --id in deploy command
https://chatgpt.com/share/6969680a-dbf8-800f-aafb-3d32d6212ba0
- Remove unused cli_root and logs handling from dedicated deploy wrapper
- Add parse_known_args() to forward native ansible-playbook flags
- Append passthrough args at the end for proper override behavior
- Clean up MODE_LOGS usage
- Update runner signature and cleanup phase logic
- Adapt unit tests to new wrapper contract
- Add unit test for ansible flag passthrough in command.main()
https://chatgpt.com/share/69694ad5-453c-800f-8047-cf210f60460f
The applications parameter is guaranteed to always be a dict in the runtime
environment. The defensive test for non-mapping input was therefore removed
to avoid unrealistic failure scenarios and false negatives.
This keeps the unit tests aligned with the actual inventory and schema model.
https://chatgpt.com/share/6968551e-7b74-800f-8a5e-a2380c950d06
