Keep Simple Icons standalone by disabling dashboard and css shared
services, and rename canonical domain from 'icons.' to 'icon.' prefix.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Keycloak's checkLoginIframe causes errors in newer Chromium builds and breaks
cross-origin OIDC flows (e.g. sub-sub-domains). Disable it in favour of explicit
token refresh. Add nginx config to serve login-status-iframe.html and 3p-cookies/
without Lua/Matomo/oauth2_proxy injection, which would corrupt the iframe's
cookie-probe purpose and emit spurious CSP errors.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Switch from wildcard (*.) to dot-prefix (.) notation for setCookieDomain and
setDomains. The dot-prefix follows RFC 6265 and covers all subdomain levels
including sub-sub-domains, while the wildcard only matched one level deep and
caused console errors in Chromium on OIDC/logout flows.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Arch Linux uses nftables by default. Docker's default iptables backend
conflicts with nftables rules, causing broken container networking and
port forwarding. Explicitly configuring nftables ensures both coexist correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- switch icon.source from remote URLs to local static paths
- add local Simple Icons directory creation on host
- mount local static directory into dashboard container
- introduce DASHBOARD_SIMPLEICONS_* variables for paths and sync base URL
- download required SVGs into local static directory during refresh
- update Playwright test to validate cached image paths and dimensions
- enhance add_simpleicon_source filter:
- return local static SVG paths instead of remote URLs
- validate non-empty local_static_dir
- update unit tests for new behavior and error handling
- remove dependency on TLS lookup for Simple Icons base URL
- New playwright.spec.js: two scenarios — SSO login via GitLab OAuth2
endpoint (bypasses missing EnableSignInWithGitLab client config key in
v11.5.1), channel view verification, API logout (bypasses nginx /logout
intercept); and biber→administrator direct message flow using isolated
browser contexts
- New playwright.env.j2: injects OIDC, Mattermost URL and user credentials
- tasks/01_setup.yml: create/add/convert administrator and biber users to
team and gitlab SSO auth via LDAP uidNumber
- env.j2: add MM_EXPERIMENTALSETTINGS_DISABLELANDINGPAGE=true to prevent
/landing SPA redirect in fresh browser contexts
- README.md: fix H1 so dashboard card renders "Explore Mattermost" link
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Unbound failed on laptop deployments because DOCKER_IN_CONTAINER was never
materialized as an Ansible fact, and root-hints/forward-zone were gated on it.
Remove the DinD-specific forward-zone block and make root-hints unconditional
so DNSSEC iterative resolution works on bare-metal hosts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace stale unit test README with a pointer to the canonical unit.md guide.
Add index README to tests/ and per-directory READMEs for e2e, integration,
lint, and regression — each linking to the matching docs/contributing page.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Unbound failed on laptop deployments because DOCKER_IN_CONTAINER was never
materialized as an Ansible fact, and root-hints/forward-zone were gated on it.
Remove the DinD-specific forward-zone block and make root-hints unconditional
so DNSSEC iterative resolution works on bare-metal hosts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a Repository Security Policies section to SECURITY.md pointing to
the new branch protection and repository settings docs, fixes Matrix and
phone contacts to proper hyperlinks, and cross-links the security policy
files from pull-request.md, branch.md, and workflow.md. Applies
documentation.md rules to all touched files (RFC 2119 usage, emoji
placement, link text).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extracts the shared frontend service loader from sys-front-inj-all into
tasks/utils/load_services.yml and tasks/utils/_load_frontend_service.yml,
called once from tasks/stages/02_server.yml before web-svc and web-app
roles. This decouples service loading from per-app injection and makes
load order explicit via SERVICE_REGISTRY entry order. Updates docs,
comments, and adds an integration test enforcing the new SPOT.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
