Ensure OIDC discovery works behind internal/private networking by
automatically adding the discovery host to Discourse's
allowed_internal_hosts during bootstrap and clearing the cached
OIDC discovery document. Also enable optional verbose OIDC logging
when MODE_DEBUG is active.
https://chatgpt.com/share/6980af14-9218-800f-a597-9851b3c47421
- Pin Discourse repository to configurable version instead of implicit HEAD
- Add TLS/self-signed CA env + volume injection to container config
- Make force_https depend on resolved TLS state
- Replace fragile printf-based admin creation with safe heredoc
- Ensure admin user creation works with arbitrary password characters
- Expose DISCOURSE_VERSION via role vars for reproducible deploys
https://chatgpt.com/share/6980a49e-3000-800f-b6a4-cb6a3e15a3d8
- Discourse:
- Allow explicit http font-src to diagnose mixed-content font loading
- Fix OIDC RP-initiated logout redirect to use resolved base URL
- WordPress:
- Make core install idempotent by seeding wp core if volume is empty
- Refactor install task to use explicit role variables
- Normalize docker service variable paths
- pgAdmin:
- Remove implicit defaults in get_app_conf lookups for clarity
- General:
- Align variable naming and formatting across roles
https://chatgpt.com/share/6980820e-6670-800f-9812-9b87debf1dee
- Add MAILU_OIDC_HOST derived from Keycloak domain
- Inject extra_hosts mapping to host-gateway for OIDC when DOCKER_IN_CONTAINER is enabled
- Keep DNS resolver configuration unchanged
- Normalize newline handling in OIDC defaults
https://chatgpt.com/share/697ff9c9-3428-800f-9771-54409bd98b3e
- Remove deprecated get_docker_image filter plugin and its unit tests
- Restructure Funkwhale docker config to use docker.services.<name>.image/version
- Introduce explicit FUNKWHALE_*_IMAGE and *_VERSION vars for clarity
- Update docker-compose template to use explicit image:version variables
- Align Funkwhale role with unified service-based Docker config model
- Replace hardcoded 127.0.0.1:8080 API endpoint with front service URL
- Ensure Mailu API access works from within admin container
- Prevent connection failures caused by invalid loopback assumptions
https://chatgpt.com/share/697f946f-17e8-800f-be03-dc6c38f2bbb3
- Mount includes.php read-only instead of docker cp
- Ensure include loader starts with proper PHP header
- Add overwriteprotocol, overwritehost, and trusted_proxies via system config
- Simplify env handling for protocol and trusted proxies
- Remove redundant permission and copy tasks
https://chatgpt.com/share/697f7aff-859c-800f-bfaa-0d4c2378fd85
Prevent host-side Docker Compose interpolation from turning `$VAR` into an empty string by replacing `$` with `$$` in injected command argv, avoiding `exec ""` crashes; add unit tests for escaping behavior.
https://chatgpt.com/share/697f5e84-dea8-800f-b09e-58b3496250f3
Introduce explicit AppArmor teardown before docker-up and restore after docker-down.
Replace complain-mode helper with full profile unload/reload scripts to ensure
deterministic local dev behavior while keeping CI unaffected.
https://chatgpt.com/share/697f4782-8304-800f-8b07-cb6484a4148f
- Add simpleicons → web-svc-simpleicons to service resolver
- Ensure simpleicons is transitively included via docker.services flags
- Fix missing TLS SAN generation for icons.infinito.example
- Clean up unused service resolution modules
https://chatgpt.com/share/697eaf81-5500-800f-aec9-8902601a0124
- Add integration test ensuring docker-compose.yml.j2 services that include build.yml.j2
also define an image tag or YAML merge (<<:) at the same level
- Fix false positives by allowing image inheritance via anchors
- Add explicit custom image variables for littlejs and roulette-wheel services
- Minor formatting cleanup
https://chatgpt.com/share/697e8c69-0298-800f-ab25-2f650d6e7df9
- Replace timer masking with stop+disable to keep unit files intact
- Deploy timer units in disabled state to prevent execution during deploy
- Avoid systemd mask conflicts with units in /etc/systemd/system
- Timers are re-enabled later during unlock phase
https://chatgpt.com/share/697e7d4c-4268-800f-a9b0-febaa12586bf
- Rename sys-service-runner to sys-service-terminator
- Add deploy-wide timer lockdown using SOFTWARE_NAME-based unit matching
- Mask timers and stop services during deploy, unmask and re-enable timers at finalization
- Ensure deterministic end-of-deploy service execution with diagnostics
https://chatgpt.com/share/697e595b-f378-800f-9f2b-5c5f416c2981
Wait explicitly for the Docker entrypoint init phase to complete by
checking the log marker before running any SQL commands. Then verify
database readiness with a real SQL roundtrip instead of pg_isready.
This avoids a race condition where pg_isready reports success while
the temporary init server is already shutting down, which caused
intermittent failures during initial deployment (especially with
PostGIS enabled).
https://chatgpt.com/share/697e3a68-e56c-800f-8438-6edb2a956802
- Default --chdir to cwd when omitted
- Default --project to basename of chdir when omitted
- Resolve chdir path for stable behavior
- Add unit tests covering defaults, overrides, and passthrough "--" handling
- Rename test file to test_compose.py
https://chatgpt.com/share/697e35a5-14c8-800f-a00a-24c9d22a68a7
kevinveenbirkenbach