Move installation.md and rename administration.md to deploy.md under
docs/administration/, delete docs/guides/, and add a scope-only
README.md per the docs-README rules. Update README.md, SUPPORT.md,
and scripts/tests/environment/README.md cross-links.
Refresh roles/web-app-decidim/README.md to match the current OIDC
patch set (decidim-core omniauth.rb + omniauth_helper.rb only, no
secrets.yml on Rails 7.2, ENV-prefixed credential names).
Per-app domain overrides belong in `applications.<app>.server.domains` and flow through the regular applications-merge pipeline. Removes the parallel `variables['domains']` recursive-combine path from the constructor stage, the domain/domains lookup plugins, and get_merged_domains(). The svc-prx-openresty canonical entry is already registered in canonical_domains_map, so the inline combine in 01_constructor.yml is redundant.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The CSP header template still referenced the removed `domains` global
fact (former set_fact in tasks/stages/01_constructor.yml), causing
`'domains' is undefined` when sys-stk-front-proxy rendered the proxy
config for web-svc-cdn. The merged-domains map is now exposed via the
domains lookup; switch the template to `lookup('domains')` so
build_csp_header still receives the cross-app URL map it needs to emit
CDN/Matomo/Simpleicons/Dashboard/Logout/Keycloak entries.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Roles outside the web-*/svc-db-* auto-default families (notably
svc-prx-openresty) declare an explicit `server.domains.canonical` and
must register in the global domains map so `lookup('tls', ...)` can
resolve them. Previously the prefix filter silently dropped them,
causing `application_id 'svc-prx-openresty' not found in domains
mapping` once the legacy `domains` set_fact / `CURRENT_PLAY_DOMAINS`
injection was removed.
Auto-default domain generation (entity_name.DOMAIN_PRIMARY) still
applies only to web-*/svc-db-*. Defensive type checks keep malformed
non-auto-default configs from raising, matching prior behavior.
Tests updated to cover the svc-prx-openresty case and renamed to
reflect the new auto-default-prefix semantics.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replaces narrow `Bash(PYTHONPATH=* python *)` with `Bash(*=* python* *)`
so test invocations carrying multiple env-var assignments
(e.g. `PYTHON=python3 PYTHONPATH=. python3 -m unittest ...`) and
`python3` binaries no longer trip the auto-allow heuristic. Sandbox
remains the primary containment layer, so widening the allow shape
adds no new blast radius.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
find_provider_roles now uses build_service_registry_from_roles_dir, the
same resolver the SERVICES_DISABLED pre-check uses. Previously it matched
only roles with a literal compose.services.<svc>.image entry, so services
exposed via compose.services.<entity>.provides (e.g. mailu → email) were
invisible to the init phase. The pre-check then flagged the unresolved
provider role as a conflict and aborted every fresh-purged deploy that
disabled "email".
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Commit 9b5de4e47 removed the `domains` set_fact in 01_constructor.yml
and migrated only the `domain` lookup to get_merged_domains, leaving
`tls`, `cert`, `compose_file_args`, and the dashboard `docker_cards`
lookup still requiring variables['domains']. That caused
`tls_common: required variable 'domains' is missing` during the OIDC
merge task (first lookup('tls', ...) call at defaults_oidc render).
Also updates sys-svc-compose tasks/handlers so the CA-trust when-clauses
use `lookup('domains') | has_domain(application_id)` instead of the
removed top-level variable. Unit tests for the four lookups now patch
get_merged_domains to read from variables['domains'] so they stay
hermetic without touching the real roles/ tree.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Role-local lookup_plugins/ only autoloads when the role executes, but
oidc_flavor is called at config-merge time from
roles/web-app-nextcloud/config/main.yml during the 01_constructor stage.
Ansible could not resolve the lookup and failed the merge.
Relocate the plugin to plugins/lookup/ (the path declared in
ansible.cfg) so it is discovered before role execution, and move the
unit tests alongside it.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds a warn-only lint that scans each role's primary compose service and
emits one GitHub Actions `::warning` annotation per missing key in
(min_storage, cpus, mem_reservation, mem_limit, pids_limit). The test
fails once no annotations remain, signalling that the rule should be
flipped from warn-only to strict mode.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Loosens the Open Project URL matcher to any `https://open.project.infinito.nexus/…`
and applies the same linked-item suppression to inline TODO markers that
already applied to TODO.md list items.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Moves gitea `title`/`configuration` and web-svc-asset `source_directory`/`url`
under their compose.services.<svc> block so config layout mirrors the service
they belong to. Updates the five call sites that dereferenced the old
top-level paths.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Removes the placeholder interpreter (utils/dict_renderer.py) in favor of
standard {{ lookup('config', ...) }} / {{ lookup('domain', ...) }} calls
inside role configs, and eliminates the `domains` set_fact stage in
tasks/stages/01_constructor.yml by introducing a cached get_merged_domains
helper plus a new `domains` lookup plugin (full map + by-app subtree).
The `domain` lookup no longer depends on a pre-computed `domains` variable;
it delegates to get_merged_domains, which respects inventory-level overrides
from both `applications:` (authoritative canonical source) and `domains:`
(direct override map). Caching mirrors the applications pipeline — keyed on
(roles_dir, variables signature, override fingerprint) with a re-entry guard.
Replaced `{{ domains[app_id] }}` / `{{ domains }}` usages across web-app-matrix,
-bluesky, -mastodon, -peertube, -keycloak, test-e2e-playwright, and
group_vars. Added two performance tests for lookup('domains') mirroring the
applications cache assertions (≥50x warm-to-hot ratio, 120s cold budget).
Fold test_include_import_exist.py (include_role / import_role target
existence) and test_tasks_existence.py (include_tasks / import_tasks
file existence) into a single test_existence.py. The two tests
previously shared setUp, YAML scan, and recursive collector shape
almost verbatim; the merged file keeps one filesystem walk and one
recursive collector parameterised over the directive keys and the
value field (name vs. file), then exposes two test methods so role
and task existence still fail independently.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Under tests/integration/roles/ introduce four sub-clusters (meta/,
dependencies/, applications/, run_once/) plus nested dependencies/run_after/
and applications/id/. Fold tests/integration/application_id/ into
roles/applications/id/ and tests/integration/run_once/ into roles/run_once/.
Pull four application-related tests out of tests/integration/ into
roles/applications/, and test_run_after_references.py into the run_after/
sub-cluster.
Consolidate tests/integration/linting/ into tests/lint/{ansible,filesystem,
repository}/, so repository-wide lint checks now run under make test-lint
rather than make test-integration.
Each new cluster ships a README.md and __init__.py; cross-referencing
READMEs (categories, ports, services, roles, applications) are updated to
point at the new paths. Path depths inside moved tests and one hardcoded
ignore path in test_domain.py are adjusted accordingly. No behavior change;
all 32 lint tests and every moved cluster pass locally.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Move the existing networks test into a dedicated tests/integration/networks/
cluster (with __init__.py and README.md) and add a new integration test that
enforces: every role which defines an application_id in vars/main.yml and
ships a templates/compose.yml.j2 MUST have a dedicated subnet entry under
defaults_networks.local in group_vars/all/08_networks.yml. Close the coverage
gap by registering /28 subnets for web-app-dashboard, web-app-fider,
web-app-jenkins, web-app-mattermost, web-app-mediawiki, web-app-odoo, and
svc-prx-openresty.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Move flat tests/integration/test_*.py files into thematic subfolders
(action_plugins, application_id, categories, compose, domains, filters,
handlers, jinja, linting, oauth2_oidc, passwords, ports, roles, run_once,
services, workflows), strip redundant prefixes from filenames, and
adjust path-depth references by +1 level. Add __init__.py and a scope-
focused README.md per cluster so the directory purpose is discoverable
without duplicating the integration.md SPOT. Update design/services.md
to point at the new test locations.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Resolve merge conflict in web-app-peertube/vars/main.yml; migrate
remaining `applications |` and `users.*` references to
`lookup('applications')` / `lookup('users', ...)` in web-app-odoo and
web-app-decidim (compose, env, playwright, setup tasks).
- web-app-peertube: split OIDC tasks into oidc/{enable,disable}.yml,
add install_mem_limit filter + PEERTUBE_MEM_LIMIT /
PEERTUBE_OIDC_PLUGIN_INSTALL_MEM_LIMIT vars to raise the cgroup ceiling
during the one-off `npm run plugin:install` exec (prevents OOM-SIGKILL
that was surfacing as "Container is restarting"); add
upsert-oidc-plugin.sql.j2 and diagnostics.sh.
- CI: test-deploy-{local,server,universal,workstation}.yml tweaks plus
scripts/github/{dump_runner_state,enlarge_swap}.sh for constrained
runners.
- cli/meta/applications/ressources: new CLI entry with unit tests.
- Misc config/docs updates across dashboard, mailu, mattermost, asset,
cdn, file roles and contributing docs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replaces legacy `users.KEY.field` and `users['KEY'].field` references with
the runtime `lookup('users', 'KEY').field` pattern across vars, templates,
and tasks so the role aligns with the new users lookup plugin.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Resolve conflicts by migrating lookup plugins to utils.applications.config
(get_app_conf -> get) while preserving branch's runtime applications/users
lookups. Notable changes:
- plugins/lookup/{config,nginx,service}.py, roles/web-app-dashboard/
lookup_plugins/docker_cards.py: switch to utils.applications.config.get,
keep utils.runtime_lookup_data.get_merged_applications/_users.
- roles/web-app-matrix/docs/Installation.md: use lookup('config', ...)
syntax with markdown link formatting.
- scripts/tests/e2e/rerun-spec.sh: take main's single-source image tag
derivation from roles/test-e2e-playwright/defaults/main.yml.
- tests/integration/test_get_app_conf_paths.py -> test_config_lookup_paths.py:
migrate scan pattern to lookup('config', ...) and skip docs/ directory.
- tests/unit/plugins/lookup/test_config_lookup.py: union of new imports.
- tests/unit/plugins/lookup/test_cert.py: reset runtime caches in
setUp/tearDown to avoid id()-based fingerprint cross-test pollution.
- Add __init__.py in 7 test directories left behind after prior cleanup.
- Delete dead duplicate group_vars/all/{04_users,05_applications}.yml
(untracked on disk; content long migrated to roles/*/{config,users}/main.yml).
Switch SYS_SVC_DOCKER_DNS_TEST_BUSYBOX_IMAGE / _NODE_IMAGE to the
role-local `images:` pattern. Consumers now resolve through
`lookup('image', <service>, 'ref')`, which picks up mirrored GHCR
paths from `images_overrides` automatically. Drops the hardcoded
rate-limit workaround from inventories/dev.yml.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Reintroduce the conditional OIDC-plugin selection that was lost when commit
77a0e16ea removed the _applications_nextcloud_oidc_flavor helper. Ship a
role-local lookup plugin at roles/web-app-nextcloud/lookup_plugins/oidc_flavor.py
with resolution order: explicit compose.services.oidc.flavor > oidc_login if
LDAP enabled > sociallogin. Wire all consumers (plugin toggles + oidc.config.php)
through lookup('oidc_flavor') and default compose.services.oidc.flavor to "" so
the LDAP-aware default takes effect (None would trip the non-empty-config
integration guard). Add 12 unit tests covering override, LDAP on/off,
whitespace, non-string, missing-app, and input-validation paths; evict
stubbed utils.applications.config leaked by the keycloak redirect_uris test
before loading the plugin so discovery-order no longer matters. Seed missing
__init__.py in tests/unit/roles/web-app-peertube and
tests/unit/cli/meta/applications/ressources so the repo-wide init-file guard
passes again.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Plugin install via `container exec` shares the cgroup with the long-running
peertube node process. Combined RSS was tripping the 8g mem_limit and
SIGKILLing peertube, which surfaced as "Container is restarting" on
subsequent exec attempts.
- Temp raise mem_limit + unlimited swap for the install window, restore
the compose-defined value on the happy path only
- Derive the bumped ceiling from PEERTUBE_MEM_LIMIT + install heap cap
via a new role-local `install_mem_limit` filter (overhead=4 covers
native RSS and spawned npm/node-gyp workers)
- Extract the SQL upsert into templates/upsert-oidc-plugin.sql.j2
- Move enable/disable OIDC tasks under tasks/oidc/ and rename the
diagnostics script
- Document the extract-code convention in docs/contributing/tools/ansible.md
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Wraps the auth-openid-connect plugin install in block/rescue so that when
the container exec trips (e.g. "Container is restarting", cgroup OOM kill),
a dedicated script dumps container state, health, resource limits, stats,
last 250 log lines, host memory+swap, and dmesg OOM-killer evidence before
the task fails explicitly. Makes the actual cause visible in CI without
another round-trip.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
