Reorders all documented and scripted `make` invocations from the
`VAR=value make target` shell-env prefix form to the make-native
`make target VAR=value` form. GNU Make auto-exports both command-line
and inherited shell-env variables to recipe shells, so the change is
purely about command-line shape: only the make-suffix form starts with
`make` and is therefore matched by the `Bash(make*)` permission entry
in .claude/settings.json, avoiding unnecessary approval prompts for
agent runs.
Adds an explicit CLAUDE.md rule with ✅/❌ examples and the underlying
reason (permission prefix match, not Makefile semantics).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(bash scripts/*)` and `Bash(source scripts/*)` to the Claude
Code allowlist so repository helper scripts (e.g. env exports in
scripts/meta/env) can run without approval prompts, while still keeping
arbitrary paths scoped to review.
Documents both permissions in docs/contributing/tools/agents/claude.md,
including the caveat that `source` bypasses the allowlist for nested
commands.
Extends CLAUDE.md with an explicit rule that agents MUST prefer `make`
targets over direct docker/ansible/python/script invocations whenever
an equivalent target exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Single source of truth at compose.services.oidc.flavor. Removes stray
root-level keys, deletes the _applications_nextcloud_oidc_flavor helper,
and switches all consumers (plugin toggles + PHP template) to direct
lookups. Also fixes inherited precedence bug on plugin.enabled filters
and corrects OICD/floavor typos.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces a requirements document that mandates deleting
group_vars/all/04_users.yml and group_vars/all/05_applications.yml,
building applications and users as facts in the constructor via two new
lookup plugins backed by roles/*/config/main.yml and roles/*/users/main.yml,
removing the deprecated make setup generators, rewriting every
applications / users reference to the new lookups, and caching the
aggregated defaults at module level for performance.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the shell built-in `wait` to the Claude Code allow-list so the agent
can block on background commands started via run_in_background without
prompting for operator approval. Documents the new entry in the Claude
Code settings reference.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the shell built-in `wait` to the Claude Code allow-list so the agent
can block on background commands started via run_in_background without
prompting for operator approval. Documents the new entry in the Claude
Code settings reference.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- plugins/lookup/config.py: honor default by setting skip_missing_app=not strict
so lookup('config', app, path, default) returns the default when the app is
missing from the applications dict, instead of raising during early constructor
phases. Fixes 5 test-development jobs.
- roles/web-app-nextcloud/files/playwright.spec.js: replace unsupported
.toSatisfy() with a boolean check inside expect.poll() + .toBe(true).
Fixes Deploy web-app-nextcloud.
- roles/sys-svc-container/files/container.py: when the target image has no
ENTRYPOINT, inject the internal CA as a volume plus NODE_EXTRA_CA_CERTS,
SSL_CERT_FILE, REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE instead of falling
back to a plain 'docker run' without CA trust. Fixes npm
UNABLE_TO_VERIFY_LEAF_SIGNATURE inside Microsoft Playwright images for
moodle, prometheus and onlyoffice deploys.
- tests/unit/roles/sys-svc-container/files/test_container.py: cover the new
no-ENTRYPOINT CA-injection path.
Note: web-app-mini-qr 'lookup ghcr.io: no such host' is not addressed here
and likely needs a separate investigation of CoreDNS forwarding on the CI
runner.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Extend .claude/settings.json with git mv, rm, cherry-pick, apply, gh run, gh api, bash -n
- Add make chmod-scripts target and document it in make.md
- Move docs/contributing/tools/agents.md to agents/common.md
- Add docs/contributing/tools/agents/README.md and claude.md with full permission reference in table format
- Fix relative links in common.md after directory move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Extend .claude/settings.json with git mv, rm, cherry-pick, apply, gh run, gh api, bash -n
- Add make chmod-scripts target and document it in make.md
- Move docs/contributing/tools/agents.md to agents/common.md
- Add docs/contributing/tools/agents/README.md and claude.md with full permission reference in table format
- Fix relative links in common.md after directory move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add missing Description, Overview, Credits sections
- Link software names to official websites on first use
- Replace full URLs with descriptive link text in Further Resources
- Add bold labels to feature bullet points
- Fix heading case (Further Resources -> Further resources)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- svc-ai-ollama: explicitly set application_id=svc-ai-ollama in include_tasks
so networks.local lookup resolves correctly when loaded as a shared service
- web-app-fider: rename database service key to postgres and drop redundant type field
- web-app-prometheus: remove unused database service entry
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds inventory consistency guard that fails fast when SERVICES_DISABLED
conflicts with an already-deployed inventory, and ensures the env var is
forwarded through the dedicated runner, development exec command, and
local test scripts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add decodeDotenvQuotedValue helper to playwright.spec.js
- Add dotenv_quote to all values in playwright.env.j2
- Use robust selectors (getByLabel + input[type=password])
- Handle cookie consent banner before login
- Fix user.email typo (was use.email) in setup tasks
- Only update password when user is new or password changed
- Use save! to fail loudly on invalid config
db3df8ec dropped ||= and role changed=true to fix CodeQL
useless-assignment alerts, but that broke the CHANGED/NOOP
output when only provider, language, or role changed.
Reverts the logic introduced by bad AI consulting.
Refs #260#261
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add 07_admin_identities.yml: resolves LDAP-backed admin identities
for OCC calls that require the actual NC username, not the LDAP DN
- vars: add NEXTCLOUD_HPB_TURN/STUN_ACTIVE_CONFIG selecting standalone
or onboard TURN based on enabled flags; add TALK_ADMIN_URL
- config: talk container gated on spreed plugin flag
- env.j2 + playwright.env.j2: expose active TURN/STUN config and
Talk admin URL for container env and E2E tests
- playwright.spec.js: extend with Talk TURN/STUN E2E assertions
- schema: add spreed.enabled validation
- coturn compose: move relay port range before TLS block so ports are
always set regardless of TLS mode
- docs/requirements: document TURN relay requirement
- test_resolver: cover new resolution paths
- Use vars.CI_CANCEL_IN_PROGRESS in entry-push-latest.yml so cancellation
can be disabled per-repo without changing workflow code
- Move docs/contributing/tools/github/branch.md into branch/ subdirectory
as security.md; add configuration.md for CI repository variables and
README.md as directory index
- Fix all cross-references in SECURITY.md, pipeline.md, branch.md,
pull-request.md, workflow.md, and repository.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use getByLabel(/email/i) with waitFor for email field
- Use input[type='password'] for password field
- Use getByRole button for login button
- Handle cookie consent banner before login
- All selectors now localization and multi-form safe
Resolve conflicts:
- docs/agents/action/iteration.md: keep both new bullets (SERVICES_DISABLED
proposal + make test requirement)
- docs/contributing/design/services.md: deleted (renamed to
docs/contributing/code/services.md in this branch)
- group_vars/all/20_services.yml: keep deletion from this branch (req-001)
- tests/lint/ansible/roles/test_service_core_first_task_run_once.py:
use build_service_registry_from_roles_dir (req-001) with repo_root()
from main for robust path resolution
Fix broken relative links caused by rename and deletion of files:
- docs/contributing/design/architecture.md: services.md → ../code/services.md
- docs/contributing/design/exceptions.md: load_frontend_service.yml →
load_service.yml
- docs/requirements/001-service-registry-refactoring.md: fix paths for
unit.md, integration.md, principles.md, documentation.md, AGENTS.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Delete group_vars/all/20_services.yml; all service metadata now lives
in each role's config/main.yml under compose.services.<name>
- Rename generic 'database' service key to explicit 'mariadb'/'postgres'
across all app roles; remove legacy type: field
- Add utils/service_registry.py and plugins/lookup/service_registry.py
as the single source of truth for service discovery
- Add utils/database_service.py to centralize DB service resolution
- Delete service_load_enabled filter and service_should_load lookup;
replaced by service lookup plugin
- Update sys-utils-service-loader to run in constructor stage and use
generic load_service.yml; remove load_frontend_service.yml
- Add _service_loader_preloading guard to sys-svc-compose,
sys-svc-webserver-core and sys-ctl-alm-compose to prevent
health-checks/alarms from firing during preload phase
- Replace manual load_app.yml calls for shared DB/Mailu with assert-
based preload validation in sys-svc-rdbms and sys-svc-mail
- Update networks.yml.j2 templates to resolve LDAP/AI networks via
service_registry instead of hardcoded role names
- Migrate all tests to new service discovery API; delete obsolete tests
- Update docs/contributing/code/services.md to reflect role-local model
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace legacy filter with the canonical lookup plugin across
nextcloud config, group_vars, dashboard template, and vars
template. Switches Talk TURN from onboard to standalone coturn
by default; gates talk container on spreed plugin flag.
Adds lint test to catch remaining get_app_conf usages.
large-packages, docker-images and swap-storage can remove build
deps, cached layers and swap needed by memory-intensive services
(e.g. Keycloak 503 under memory pressure). Only android/dotnet/
haskell are guaranteed unused on deploy runners.
Rationale linked from each step comment and documented in
docs/contributing/artefact/files/github/workflow.md.
- Add image_version filter plugin to extract bare semver from image tag
- Derive TEST_E2E_PLAYWRIGHT_VERSION via image_version filter
- Convert files/package.json to templates/package.json.j2 using the
derived version so image tag and devDependency stay in sync
- Use lookup('image', 'playwright', 'ref') in run_one.yml instead of
building the image ref manually from package.json
- Add unit tests for image_version filter
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
