Ensures the run_once guard is set before any other task executes,
preventing infinite recursion when load_app.yml re-evaluates service
roles mid-run. Also introduces new 01_core.yml + main.yml for
web-svc-asset and web-svc-libretranslate following the standard schema,
and adds a lint test enforcing this structure across all SERVICE_REGISTRY
roles.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move the email entry above oidc in SERVICE_REGISTRY so that Mailu is
deployed before Keycloak, which depends on it for SMTP notifications.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add 'email' key (role: web-app-mailu, type: frontend) to SERVICE_REGISTRY
- Declare compose.services.email with enabled: true and shared: true in all
33 app roles that reference web-app-mailu or use SYSTEM_EMAIL_* variables
- Add integration test test_mailu_service_dependency.py that enforces this
constraint for any future role additions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add note that multiple apps can be passed space-separated to APPS to speed up debugging. Replace all <role> placeholders with <roles> for consistency.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Refactor login/logout test to use reusable expectLoggedOutHeaderAuthState
and expectLoggedInHeaderAuthState helpers
- Make dropdown detection and logout item discovery more resilient across
Keycloak versions and timing variations
- Sync Keycloak auth state via onReady/onAuthSuccess/onAuthLogout hooks
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add Code of Conduct section to README.md with link to CODE_OF_CONDUCT.md
- Add Invest section to README.md linking to Investor Relations in SUPPORT.md
- Add Investor Relations section to SUPPORT.md with contact details and meeting link
- Add emojis to all headings in SUPPORT.md and docs/contributing/documentation.md
- Add Headlines section to documentation.md defining emoji placement convention
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
curl returns 000 (no HTTP response) instead of 404 when the TLS handshake
fails because the target subdomain is not listed as a SAN in the deployed
certificate. Updated both assertions and added explanatory comments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add shared: true to logout, oauth2, and greenlight services wherever
enabled: true was set without a shared declaration
- Add # noqa: shared comment before role-local internal containers
(redis, worker, web, opensearch, search) that are intentionally
not shared
- Add missing enabled: false to ollama in svc-ai-ollama (shared was
declared without enabled, violating the new consistency rule)
- Add integration test test_service_shared_consistency to enforce:
Rule 1: enabled=true requires shared=true or a # noqa: shared comment
Rule 2: shared key requires enabled key to be present
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds 'asset' service key in 20_services.yml pointing to web-svc-asset so
it is loaded via 01_services.yml when needed. Sets asset: enabled: false,
shared: true in web-svc-asset/config to avoid self-injection. Enables
asset: enabled+shared in dashboard, discourse, and listmonk — the three
roles that consume the asset server for logo/image URLs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Consolidates into one target. FULL_CYCLE defaults to false (deploy only);
set FULL_CYCLE=true for deploy + update pass. Extracts run_pass function
in fresh-purged-app.sh to eliminate duplicated init+deploy logic. Updates
makefile.md, playwright.md, iteration.md, and environment.sh with correct
FULL_CYCLE usage.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CDN is the provider of CSS and JS assets, not a consumer. Setting
enabled: false prevents sys-front-inj-css/javascript from running against
the CDN vhost and trying to load non-existent style/javascript files.
shared: true is kept so the needed flag resolves correctly from other apps.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Updates services.md to cover shared-role entries (cdn/css/javascript),
the canonical field rules, bidirectional lookup behaviour, and links to
the new integration/lint tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds canonical: cdn to css/javascript entries in 20_services.yml so that
role-based reverse lookup (web-svc-cdn → cdn) is deterministic. Updates
_build_role_to_key to use the canonical field. Adds an integration test
verifying bidirectional resolution and a lint test enforcing canonical
consistency rules (exactly one primary, no chaining, matching roles).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Ensures web-svc-cdn is loaded whenever any app has css or javascript
injection enabled, by registering css and javascript as service keys in
20_services.yml (both mapping to web-svc-cdn). Adds shared: true to all
css/javascript compose service entries across app and svc role configs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Eliminates scope-dependent CDN variable bugs by introducing a `cdn` lookup
plugin that resolves paths and URLs at call-time using an explicit application_id
argument. Deletes the old cdn_paths.py and cdn_urls.py filter plugins and their
tests; adds a new unit test for the lookup plugin's _cdn_paths and _to_url_tree
helpers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
