Exclude the .github directory from template/YAML scanning to avoid
false positives from GitHub Actions expressions. Directory exclusion
is now centralized via EXCLUDE_DIRS and respects EXCLUDE_TESTS.
https://chatgpt.com/share/6965b7a8-8084-800f-a8b5-446f265d5bf2
Add support for ignoring individual run_once_* when-conditions if the same
line contains the marker comment:
# pass test_run_once_suffix_matches_role
This allows intentional cross-role run_once usage (e.g. shared provider
roles) without weakening the global schema enforcement.
Also document the exception behavior directly in the test.
https://chatgpt.com/share/69653e36-c058-800f-921d-b4af9014df04
fix(openldap): make memberof/refint provisioning idempotent and robust
Refactor OpenLDAP cn=config provisioning:
- load memberof and refint modules via ldapmodify
- add overlays via ldapadd with proper error handling
- make handlers idempotent (ignore duplicate/value-exists errors)
- dynamically resolve module DN and data backend DN (mdb/hdb)
- clean up legacy LDIF definitions
This fixes rc=80 handler failures and allows safe re-runs.
https://chatgpt.com/share/69653e42-e020-800f-a6c3-9c37ec5e8028
* Switch feature flag paths from docker.service.<name>.enabled to docker.services.<name>.enabled
* Update CSP builder and smart-default toggles and unit tests
* Update desktop cards iframe flag and desktop domain validation
* Update logout domain filter and tests
* Update recaptcha enable flags in Keycloak and EspoCRM
* Fix sys-ctl-cln-docker meta description formatting
* Follow-up: reorder imports in web_health_expectations so module_utils path injection runs before importing get_app_conf
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Update CSP smart-default toggles to use docker.service.<feature>.enabled
(matomo, simpleicons, recaptcha, hcaptcha, logout, desktop)
- Refactor inj_enabled filter to resolve docker.service.<feature>.enabled only
- Migrate inj_enabled unit tests to the new flag layout
- Normalize and reformat CSP test fixtures for readability and consistency
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Switch CSP smart-default toggles to docker.service.<name>.enabled flags
(matomo, simpleicons, recaptcha, hcaptcha, logout, desktop)
- Update CSP header logic docs/comments to match new flag layout
- Split large CSP filter unit test into focused test modules for clarity
- Add coverage for service toggle behavior, determinism, union rules, and hash guards
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Add default status codes (403, 200) for web-svc-html to reflect missing index.html on init
- Normalize YAML formatting and ensure trailing newlines
- Fix integration test formatting for config generation
- Align vars indentation with project style
https://chatgpt.com/share/6963a552-9580-800f-b6f2-2547959d9dc8
- Allow credentials generator to run for roles without schema/main.yml so
transitive config-based generation still works.
- Make InventoryManager resilient to missing YAML by defaulting to {} and
only loading schema when schema/main.yml exists.
- Add recursive shared-provider include resolution based on docker.services
config and apply provider schemas/special rules transitively.
- Require database_password injection only when database.enabled=true and shared=true.
- Update unit/integration tests to create required files for .exists() checks and
validate transitive provider role credential generation.
https://chatgpt.com/share/69639d93-4c10-800f-bc6c-8e5b9fb75088
The test suite intentionally modifies PYTHONPATH to import the role-local script
module. Suppress ruff E402 for this specific import to keep linting strict
everywhere else while documenting the exception.
https://chatgpt.com/share/69637f6e-5370-800f-806f-d5d0820c005f
Update unit tests to:
- Add role files directory to PYTHONPATH for importing script.py
- Assert SystemExit and exit codes instead of mocking sys.exit
- Ensure run_checker is not called when no domains or config dir is missing
- Keep existing behavior and expectations intact
This makes the tests robust and prevents false positives caused by mocked sys.exit continuing execution.
https://chatgpt.com/share/69637cc6-c1d0-800f-a196-df86ccbaee14
Run the CSP checker container with --network host by default so localhost and
internal vhosts are reachable when executed inside Docker-in-Docker setups.
Adds:
- Optional --no-host-network flag to disable host networking
- Extended docker command builder with host network support
- Unit tests for domain extraction, docker command generation, and CLI behavior
This ensures CSP health checks work reliably for services bound to the
parent container's network namespace.
https://chatgpt.com/share/69630726-4514-800f-b350-61ae7a4010b1
Stop cleanup script from busy-looping when disk usage is above threshold but no
backup versions exist by breaking early when average_version_directories == 0.
Add unit tests to verify:
- script exits immediately when disk usage is below threshold
- script breaks safely when disk usage is high but no backups are present
This prevents CI hangs and excessive CPU usage caused by infinite iterations.
https://chatgpt.com/share/6962de45-3750-800f-bc8d-5ba205beeaaf
- Move generate_value/generate_secure_alphanumeric out of InventoryManager into new ValueGenerator
- Wire InventoryManager to use self.value_generator for all secret generation
- Tighten schema include logic for shared databases: require enabled=true and shared=true
- Update unit tests to patch ValueGenerator.generate_value instead of InventoryManager.generate_value
- Add end-to-end integration test for InventoryManager using real files and a fake VaultHandler
- Remove redundant legacy unit test file and add dedicated ValueGenerator unit tests
https://chatgpt.com/share/6962d2e6-7fdc-800f-ba83-9e150b19a5f0
Replace legacy feature flags (features.central_database, features.oauth2) with
docker service based configuration:
- docker.services.database.shared
- docker.services.oauth2.enabled
Update InventoryManager logic accordingly and adapt all unit tests to mock
the new config structure.
This ensures inventory generation now follows the canonical docker service
configuration model.
https://chatgpt.com/share/69628906-5efc-800f-999b-2ae3ece1907f
Introduce retry logic with exponential backoff for git operations to reduce flaky
CI/Docker failures (e.g., "Connection reset by peer"). Replace run(check=True)
with run_checked() and add transient error detection. Update unit tests to match
new execution and error-handling behavior.
https://chatgpt.com/share/6960d28d-3e2c-800f-943b-a80630a6a395
- Add custom Ansible module file_has_content to validate databases.csv on target host
- Fail hard if databases.csv is missing or not a regular file
- Compute backup force-flush flag based on MODE_BACKUP and actual file content
- Prevent instant backup flush when no database secrets are present
- Add full unittest coverage for file_has_content module
- Make sys-service flush behavior data-driven and deterministic
https://chatgpt.com/share/6960cdb6-dd28-800f-8427-2e375de4e61b
- Restore lifecycle-based role exclusion via cli.meta.roles.lifecycle_filter
- Make tested lifecycles configurable through TESTED_LIFECYCLES env
- Apply lifecycle gating consistently for workstation and server tests
- Fix minor bug in invokable parsing (avoid shadowing built-in list)
- Improve logging with lifecycle exclusion details
https://chatgpt.com/share/695fbcf4-2148-800f-8685-56ee73a9bae0
- Always derive roles/ path from repository root instead of accepting a parameter
- Fail fast if roles directory is missing or mislocated
- Add explicit typing and Path-based path handling
- Update unit tests to rely on real repo roles instead of temporary fixtures
- Ensure tests cover correct role discovery and inventory validation
https://chatgpt.com/share/695fb926-1f5c-800f-9012-e2922bb1df3f
- Introduce CLI tool to resolve galaxy_info.run_after dependencies transitively
- Detect and report circular run_after dependencies explicitly
- Validate role existence and run_after schema strictly
- Provide whitespace-separated output for easy shell usage
- Add comprehensive unittest coverage including CLI behavior and error cases
https://chatgpt.com/share/695f8e09-54f4-800f-9f5f-ed9c2fdd664b
- Make pull-specific-host.py fail on any command error (and rsync after retries), emit clear stderr, and exit 0/1 via main()
- Keep remote `find ... -execdir basename {} ;` unchanged to stay compatible with existing ssh-wrapper.sh
- Update wrapper script to continue across hosts but return exit 1 if any host failed
- Adjust unit tests to expect exceptions instead of SystemExit
https://chatgpt.com/share/695e9615-6014-800f-a77d-5809cf45559d
- Introduce meta roles lifecycle_filter CLI to select roles by lifecycle
- Support whitelist/blacklist modes, selection filtering, and auto-detected roles dir
- Fix blacklist handling for roles with missing lifecycle
- Forward --help correctly to subcommand argparse
- Add unit tests for lifecycle filtering logic
https://chatgpt.com/share/695d09d2-c864-800f-9e23-b9db0c6f3537
- Migrate Mailu credentials from legacy mailu_token to tokens['web-app-mailu']
- Update all affected application templates to use the new token structure
- Adjust inventory validation to no longer special-case mailu_token
- Minor typing and formatting cleanups in inventory creation and tests
https://chatgpt.com/share/69554915-87c8-800f-afd5-12118dbb1107
**Body**
* add sys-token-store filter plugin to hydrate users.*.tokens from persisted store (users win if non-empty)
* load token store during sys-token-store core run and inject hydrated tokens into users fact
* remove legacy lookup task and simplify docs + store path naming
* switch Matomo frontend injection to use hydrated users.administrator.tokens[web-app-matomo] directly
* ensure Mailu token handling uses sys-token-store write task and checks token presence via users.*.tokens
* add unittest for token hydration filter plugin with path-based module loading
* Move SSH key handling to users.<name>.authorized_keys (list-only) and write keys via shared user role
* Enforce at least one SSH key for administrator user
* Wrap backup user keys with restricted command wrapper before writing authorized_keys
* Remove legacy inventory file copy and CLI flag/function for administrator authorized_keys
* Extend user setup generator to include authorized_keys field
* Rename administrator scripts path to root scripts path and update dependent variables
* Update inventory sample and docs to reflect new SSH key workflow
https://chatgpt.com/share/695510b8-23f4-800f-b5db-877b07a1469b
* Replace global `SSL_ENABLED` flag with `TLS_ENABLED`
* Update web protocol/ports (http/https, ws/wss) to use `TLS_ENABLED`
* Switch cert-related roles and nginx TLS header gating to `TLS_ENABLED`
* Update app env templates (BookWyrm, Confluence, Jira, Magento, OpenProject, WordPress, etc.) to use `TLS_ENABLED`
* Adjust inventory generator to write `TLS_ENABLED` and update CLI help text accordingly
* Update unit tests for inventory vars overrides to expect `TLS_ENABLED`
https://chatgpt.com/share/695306ef-a798-800f-b118-e07b525e1811
- add --vars-file CLI option to load host_vars overrides from YAML
- merge vars-file overrides before JSON --vars (JSON takes precedence)
- implement deep-merge logic for YAML vars files
- update CI deploy script to use vars file instead of inline JSON
- add unit test for apply_vars_overrides_from_file
- remove obsolete MASK_CREDENTIALS_IN_LOGS TODO entry
https://chatgpt.com/share/6952e51d-6c50-800f-8764-31dc8c609cdb
- switch compose volumes from /Backups to /var/lib/infinito
- add PATH_INFINITO_BACKUP_DIR and drop BACKUPS_FOLDER_PATH
- update backup provider permissions + cleanup service to use new path
- make pull-specific-host accept --folder and raise if no remote backups
- adjust unit tests accordingly
https://chatgpt.com/share/69515eed-001c-800f-b1da-aee8d8683e63
The run_once integration test only detected short-form `set_fact`
and failed to recognize fully qualified module usage
(`ansible.builtin.set_fact`).
This caused false negatives for roles correctly using FQCN-compliant
Ansible syntax.
Fix:
- Accept both `set_fact` and `ansible.builtin.set_fact` when collecting
global run_once_<suffix> definitions
- Accept both forms when detecting per-role run_once definitions
- Remove redundant prefilter token, as structural detection is sufficient
No production logic is affected.
https://chatgpt.com/share/6950fe2c-4b24-800f-9f40-85b2fed3bfba
- Move databases.csv permission task from seed phase to core tasks
- Ensure root-only permissions are enforced early and unconditionally
- Remove custom run-once logic and related state tracking
- Simplify role logic and improve determinism
- Update run-once integration test documentation and expectations
- Add TODO to verify Docker-in-Docker behavior
- introduce CoreDNS service behind CI profile
- route CI containers via fixed DNS (172.30.0.53)
- add CoreDNS Corefile for docker.test and external forwarding
- make infinito image distro-selectable via INFINITO_DISTRO
- align volumes, env, and networking for CI runner
https://chatgpt.com/share/694d1f08-9794-800f-b1ff-548e9e6c500f
Only handlers defined in handlers/main.yml/main.yaml are considered.
Task files included via include_tasks/import_tasks under handlers/ are
regular tasks and must not be treated as standalone handlers.
This prevents false positives where internal handler sub-steps were
incorrectly reported as missing notify targets.
https://chatgpt.com/share/6949290a-a694-800f-bb29-60cd96321f62
* Remove legacy **main** re-export wrappers to avoid `runpy` "already in sys.modules" warnings
* Introduce `cli.deploy.container.command` as the stable implementation module
* Reduce `cli.deploy.container.__main__` to a minimal entrypoint delegating to `command.main`
* Re-export container helpers from package `__init__` without importing `__main__`
* Update unit tests to import/patch the new command module and keep CLI dispatch stable
https://chatgpt.com/share/69484a22-60dc-800f-a23d-068d7c45fe37
- Add new role sys-util-git-pull as a generic system utility
- Implement robust shallow clone/update logic in Python helper
- Support detached-safe branch updates and optional tag pinning
- Handle annotated vs lightweight tags and heal local tag conflicts
- Provide deterministic Ansible change detection via machine-readable output
- Add verbose logging to stderr for debuggability
- Integrate sys-util-git-pull into pkgmgr role to replace inline git logic
- Add comprehensive unit tests (option A: file-based import) for helper script
- Add role README and meta information with platform-agnostic support
- Ensure role conforms to existing test expectations (meta/main.yml present)
https://chatgpt.com/share/69481902-a98c-800f-9b3f-9ee13e8e50b7
Stop importing __main__ from package __init__.py to prevent runpy RuntimeWarning when using `python -m`.
- Move CLI logic into command.py modules
- Keep __main__.py as thin wrappers
- Update unit tests to import command modules directly
https://chatgpt.com/share/6947fb8e-550c-800f-8323-e36f92cb5bba
Migrate most roles from community.general.pacman to the generic package module for better portability. Keep pacman where it is required (system upgrades and Arch-specific tasks). Split VirtualBox setup into an Arch-only task file and add a warning when skipped on non-Arch systems. Update integration test examples accordingly.
https://chatgpt.com/share/6947ce9f-3228-800f-8365-2253b5ed9451
- Remove direct imports of unittest.mock alias
- Use unittest.mock.patch via unittest for all test decorators
- Keep behavior identical while simplifying imports
kevinveenbirkenbach