extend_inventory adds the nfs-server host without host_vars, so the
extras file is its only var source; without the cluster domain it fell
back to the group_vars default and rendered unresolvable
*.infinito.localhost endpoints.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Per-host rendered applications flip dynamic shared flags with
group_names, so hosts computed divergent ordered lists and Ansible's
result-arrival include registration could deploy consumers before
their engines. The ordered mode now reads the static roles dir; the
per-host when gate in load_service.yml keeps deciding what loads.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Penpot dedupes assets by content digest, so re-running the seaweedfs
spec against a persistent bucket wrote no new object and the bucket
check failed. The marker is appended to the PNG bytes after IEND.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The no-ldap variant still rendered auth_method: ldap with empty LDAP
bind values, so ejabberd rejected every login. The ldap block is now
gated on services.ldap.enabled with an internal-auth fallback.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The ansible flavor deploys matrix as node-local compose even inside a
swarm cluster, but compose_only stripped container_name and friends
because DEPLOYMENT_MODE said swarm, so follow-up exec tasks could not
find the containers. compose_mode_force pins the rendering to compose;
the lookup honors it ahead of the cluster mode.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Jinja's indent filter leaves the first line untouched, so the filter
indent(4) wrapper rendered healthcheck: at column 0 and produced
invalid compose YAML. The template now ships pre-indented like its
sibling healthcheck templates; taiga drops the wrapper.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
container cp needs its source on the node running the docker CLI, so
role_path sources break on swarm workers. The joomla plugin dir now
ships as a controller-side tarball through container exec -i. A new
repository lint forbids docker/container cp in tracked .yml and .sh
files; the six legitimate same-node uses carry justified nochecks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
container cp needed the role checkout on the node running the docker
CLI, which does not exist on swarm workers; the mu-plugins now stream
through container exec -i tee with the file read controller-side. The
daggerhart WP-CLI eval line was indented deeper than its folded scalar
block, so YAML kept the newline and bash -lc received no script
argument; realigning the indent folds it back into one command.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Role-local library/ and module_utils/ resolve only inside the owning
role's task scope, so kcadm update tasks invoked from other contexts
in the swarm flow could not find keycloak_kcadm_update. ansible.cfg
already declares ./library and ./utils as the global paths; the filter
plugin and unit tests follow the move. Helper narrows its parse guard
to ValueError.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Active Storage signs URLs against AWS_ENDPOINT, so it must be the
browser-reachable public endpoint instead of the internal service url.
Compose reaches the canonical s3 api domain via extra_hosts and the
host gateway; swarm resolves it through a new proxy_aliases beacon
field that puts only the canonical domain on the front proxy, keeping
the ambiguous seaweedfs entity alias off shared overlays.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Moodle's login page re-renders the form during theme JS init, so the
first fill could land in a discarded DOM node and submit an empty
password. Both specs now retry fill until the field holds the value.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
First-boot phases (jenkins plugin install, odoo module init, pixelfed
key generation and migrations) exceed the default converge window on
CI runners, so healthy stacks were reported as converge timeouts.
600 retries matches the budget already used by kix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
coturn's only web surface is the plaintext gateway health page; there
is never HTML to track or style, so the entries and their variant
overrides were dead configuration. Consumers default to disabled when
the service key is absent, which also supersedes the track: false
opt-out for this role.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
These roles serve no injectable HTML (werkzeug 404 without head/body
anchors, plaintext health page), so the playwright tracking check can
never pass; track: false skips the injection expectation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The health wait inspected containers on the deploy host, but swarm can
schedule mastodon services on workers, so the wait always timed out.
Each service now resolves its node and container id via
resolve_host_cid and delegates the inspect loop there; compose passes
the local container id through unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The floating latest tag pulled a broken upstream release mid-run and
made deploys unreproducible; both CI modes failed on the drifted image.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
docker stack deploy does not interpolate $$ back to $, so the swarm
backend received a literal "$$@" and gunicorn never started. Passing
the full command inside the bash -c script removes the interpolation
dependency; compose renders the identical argv as before.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
resource_filter now falls back service_name -> entity_name -> hard
default, so entity-level limits keep applying to per-service compose
entries. Compose service names drop the entity prefix (kix, jitsi,
zammad, bluesky); the docker container_name keeps it via compose_only.
A new lint forbids '<entity>-'-prefixed service names.
Service names and internal ports are declared once: vars/main.yml
holds <ROLE>_<SERVICE>_SERVICE constants (container names derived via
entity_name), meta/services.yml declares ports.internal consumed
through config lookups. sso-proxy upstreams stack-qualify the origin
host in swarm because short aliases are ambiguous on shared overlays.
Stale proxy.service_key entries fixed for erpnext/shopware/nextcloud.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
get() signalled a missing key in non-strict mode by returning False, so
every genuinely-False leaf was coerced to the caller's default and
lookup('config', ..., true) could never return False. Moodle's LDAP gate
therefore fired in the ldap-disabled variant round and crashed templating
against never-generated openldap provider credentials. Use a unique
_MISSING sentinel for traversal, keep the default semantics for genuinely
absent keys, and make the moodle gate strict since services.ldap.enabled
is always defined.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A host-dependent when on the include loop made Ansible register the
included blocks in result-arrival order: workers answering before the
manager pulled their subset (the app's own service, ldap) ahead of the
manager-only engine providers, so consumer stacks deployed before the
engines they converge-wait on (gitea before redis). The condition now
lives inside load_service.yml, every host reports an identical include
set and execution follows the registry order. Hosts that load nothing
also leave the loop with service_loader_preloading reset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
derive_includes applies the same shared:true flip as force_shared_db, so
variant rounds that pin a consumer's DB to shared:false keep the central
provider (and its generated credentials) in the include set the deploy
will actually load. extend_inventory derives its manager-placed groups
from the same variant-aware closure instead of a base-config walk, which
re-added pruned provider groups without credentials. matrix.py passes the
round's variant map to the extend step.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Declare the LDAP and SSO auth plugins as proper meta/addons entries
(mechanism/source/version, github-releases update monitoring, url/tag/
md5/guid under config:) and resolve the install parameters in vars from
the addon config instead of hardcoding them.
Move biber's login journeys into the mandated per-addon Playwright specs:
ldap-authentication tests the LDAP manual login, sso-authentication the
OIDC round-trip. Because a Jellyfin user binds to exactly one auth
provider, the LDAP spec skips while SSO is active — the ldap-only matrix
variant owns that path — so a single test user suffices and the specs
stay parallel-safe. playwright.spec.js keeps guest + native admin;
biber's generic persona is opted out via PERSONA_BIBER_BLOCKED.
Also fill the optional meta/info.yml fields (homepage, video, display).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Before every redeploy that follows a failed deploy, require one explicit
line: either verified-in-container or a named post-deploy-state-exception.
Forbid treating the redeploy itself as the verification, and reject
state-reset friction, logical inference from a prior deploy, and
"looks correct" as reasons to skip. Playwright-spec failures must reset
any polluted state and be green via make compose-playwright first.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bring the full matrix (full-auth / no-auth / ldap-only) green:
- healthcheck: use curl (the image ships no wget)
- install the LDAP plugin from its GitHub release (repo.jellyfin.org is
unreachable from the deploy network); version/url/md5 live in
meta/addons/ldap-authentication.yml and reach the script via env
- configure the SSO/OIDC provider through the plugin config API as JSON
(order-agnostic) instead of hand-written XML, which silently produced
an empty provider map; set DisablePushedAuthorization + https
SchemeOverride so Keycloak accepts the redirect_uri
- inject the SSO login button via the branding login-disclaimer + CustomCss
- seed the break-glass admin unconditionally and retry the first-run
wizard until the admin token resolves (fixes the no-auth variant race)
- Playwright: role-based authenticated-chrome selector for JF 10.11,
localStorage-clearing logout, and LDAP-before-OIDC ordering (a Jellyfin
user binds to exactly one auth provider)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Implements requirement 030: web-app-jellyfin deploying jellyfin/jellyfin
10.11.11 behind sys-svc-proxy. No external DB (internal SQLite); /config,
/cache, /media named volumes; CPU transcoding. Jellyfin has no native SSO, so
auth is plugin-based (operator chose BOTH): jellyfin-plugin-ldapauth (central
OpenLDAP, all clients incl. native apps) + 9p4/jellyfin-plugin-sso (Keycloak
OIDC, web one-click). files/configure-auth.sh completes the first-run /Startup
wizard (seeds break-glass admin), installs both plugins via Jellyfin's own
/Packages installer, writes the plugin configs, and restarts.
Schemas source-verified against the pinned upstream: Jellyfin v10.11.11, LDAP
plugin v23 (GUID 958aad66-..., flat XmlSerializer config), SSO plugin v4.0.0.3
(OidConfig fields). Honest caveats: the SSO OidConfigs is a SerializableDictionary
(XML shape best-effort), plus plugin ABI compat + the SPA Playwright selectors
are live-deploy-validation items (env-blocked). Each config file is XML-well-
formedness checked before reload.
Validation: make autoformat clean; make test green (lint, test-lint, test-unit,
test-integration 190, test-external).
Refs: docs/requirements/030-web-app-jellyfin.md
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The OIDC/LDAP provisioning writes ir.config_parameter rows (web.base.url,
its freeze flag, signup scope) via direct SQL, which the four running
workers never observe: get_param() is ormcached per worker, so a worker
that auto-detected its base url keeps building OAuth redirect_uris that
Keycloak rejects ("Invalid parameter: redirect_uri") while other workers
serve correct links — the partial addon-spec failures in CI. Restart the
container once after provisioning so every worker boots with the frozen
values, and give the web client the same 120s first-render budget that
openModule already documents for cold asset compilation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The image copied only package.json, so npm install floated transitive
dev dependencies; a new @types/node broke the TypeScript 4.5 build
(ffi.d.ts parse errors) and docker compose build failed the deploy.
Copy package-lock.json and use npm ci for a reproducible graph.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Upstream Discourse now loads scripts via data: URIs; without the scheme
in script-src-elem every page load raises securitypolicyviolation events
and the central CSP assertion fails the landing and both OIDC personas
(also failing the coupled nextcloud and wordpress matrix jobs).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
