- add make target `trust-ca` as thin wrapper
- introduce scripts/administration/trust_ca.sh
- extract Infinito root CA from running container
- install CA into host trust store via with-ca-trust.sh
- keep Makefile free of logic, delegate to script
https://chatgpt.com/share/697e31e7-e548-800f-9edd-9b030ee12c5b
- Simplify certificate deployment logic by removing nginx reload handling
- Always restart containers that contain nginx to apply updated certificates
- Drop reload success/failure state tracking (restart is deterministic)
- Minor cleanup: remove trailing newlines and unused vars
https://chatgpt.com/share/697df820-8fc0-800f-a675-91ec019f7b3d
- add module_utils/domain_mapper to map domains (canonical/aliases) -> application_id
supporting str/list/dict and nested structures
- extend tls_common.resolve_term to optionally resolve alias domains via applications
while keeping legacy lookup via global domains mapping intact
- pass applications into tls_resolve and cert_plan
- add unit tests for domain_mapper
https://chatgpt.com/share/697d500f-b884-800f-ba5b-088a2340f9d6
- Do not auto-generate default alias (<entity>.<primary>) when AUTO_BUILD_ALIASES is false
- Only use explicitly defined aliases unless auto-build is enabled
- Treat empty server.domains as opt-out when auto-build is disabled
- Update unit tests to reflect strict alias semantics
- Clarify behavior with inline documentation and comments
https://chatgpt.com/share/697d4994-7690-800f-8987-296ce7215559
The compose_ca_inject_cmd lookup previously appended --env-file
whenever docker_compose.files.env was set, even if the file did not
exist. This caused compose_ca_inject.py to fail hard.
Changes:
- Add existence check for env file using pathlib.Path.is_file()
- Resolve relative env paths against the compose instance directory
- Mirror existing handler behavior for --env-file handling
- Extend unit tests to cover both present and missing env-file cases
- Keep existing test coverage intact while adapting expectations
This aligns CA injection behavior with all other docker-compose handlers.
https://chatgpt.com/share/697d22a2-53c4-800f-9663-19a04f0587f6
The fixed sleep caused unnecessary delays during certificate deployment.
Readiness is handled implicitly via nginx config testing and reload logic,
making the global wait redundant and slow.
This change significantly reduces deployment time while keeping behavior safe.
https://chatgpt.com/share/697d20d3-6d04-800f-926a-a7e3be03d7e1
Detect container context and automatically use 127.0.0.1 as SMTP host
when running inside Docker, while preserving the external mail host
for non-containerized setups. Add tls_host_override to keep correct
TLS/SNI behavior when connecting locally.
This aligns mail routing with CI/container networking constraints
without
https://chatgpt.com/share/697d20b2-11c0-800f-aacc-57977c798162
Move AppArmor handling out of docker-compose files and into a
dedicated dev-only administration script. The new `disarmapp`
Make target acts as a thin wrapper to set relevant AppArmor
profiles (php-fpm, dovecot) to complain mode on the development host,
keeping compose templates clean and prod-like.
https://chatgpt.com/share/697cfbdf-e2a8-800f-bf06-b75e8c9d926e
- Rename infinito-compose wrapper to compose-base across roles and tests
- Introduce DOCKER_CMD_BASE as global base command configuration
- Update sys-ctl-mtn-cert-deploy to use compose_cmd consistently
- Fix compose wrapper argument parsing by enforcing "--" passthrough
- Harden project name resolution for trailing-slash instance paths
- Align docker restart helper scripts with compose-base naming
- Update unit tests to reflect renamed wrapper and new paths
https://chatgpt.com/share/697cf057-bd04-800f-9117-c007088f7fb8
Provide SSL_CERT_FILE / REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE as a fallback
when OS-level CA installation is not possible (e.g. non-root containers).
OS trust store installation is now best-effort and no longer hard-fails,
making with-ca-trust usable across mixed privilege Docker images.
https://chatgpt.com/share/697ceee0-4e48-800f-b4ed-d240fcb0968a
AppArmor is explicitly set to `unconfined` for CI-related containers to
prevent host-level AppArmor profiles (e.g. php-fpm, dovecot, nginx) from
interfering with certificate and TLS path handling during CI runs.
This change is limited to CI use cases and does not alter production
security defaults.
https://chatgpt.com/share/697ce139-ca9c-800f-a240-a920b9ce31a8
- Remove cert_folder_find module (no longer needed)
- Update deploy script to accept a cert source directory (not LETSENCRYPT_LIVE_PATH)
- Derive cert source dir via cert_plan in systemd unit
- Keep Mailu key.pem/cert.pem mapping with LE/selfsigned fallback
- Minor shell hardening (set -eu) and wording fixes
https://chatgpt.com/share/697cb143-e68c-800f-9823-c78a8d833d4e
- Do not fail if no CA trust mechanism is available
- Log INFO instead of exiting with error in minimal environments
- Always exec wrapped command when provided
- Exit successfully in standalone (host install) mode
- Simplify trust detection logs and Arch/p11-kit handling
https://chatgpt.com/share/697ca66a-8310-800f-94fd-c0130e05e704
Extract self-signed leaf certificate generation into a separate task file and
replace block-level when with a guarded include_tasks call.
This avoids parsing heavy tasks when the condition is false and fixes the
integration test enforcing a maximum number of tasks in blocks with block-level
conditions.
https://chatgpt.com/share/697ca16e-6df8-800f-9cf2-424545679d83
Move `with-ca-trust.sh` to `sys-ca-selfsigned` as the single source of truth, add `CA_TRUST_NAME`/`trust_name`, and pass it through `compose_ca_inject.py` + `compose_ca_inject_cmd`. Introduce `module_utils/templating.py` for strict multi-pass rendering with fallback env lookup, update TLS self-signed regen logic, purge script, and extend unit tests accordingly.
https://chatgpt.com/share/697c876d-7140-800f-9981-762dfeeafdfe
cert_plan now requires CURRENT_PLAY_DOMAINS_ALL to be a non-empty list of strings when TLS_SELFSIGNED_SCOPE=global and uses it directly for SAN generation. Update unit tests to cover the strict contract and validation errors.
https://chatgpt.com/share/697bc866-0558-800f-8f2c-08ec84190a68
compose_ca_inject now discovers profiles from compose files, merges services from default + each profile config, and ensures missing images are built/pulled before inspecting entrypoint/cmd. Tests were updated to cover entrypoint normalization and the new profile-scan behavior.
Adds an integration test that fails when a service defines `build:` without an `image:` on the same indentation level. This enforces stable image names for tooling like CA-injection and makes compose behavior more predictable.
https://chatgpt.com/share/697bb4af-0d58-800f-8edd-aaef4c224319
Remove project kwarg from compose_ca_inject_cmd, derive entity name internally,
and reuse compose_f_args with include_ca=false for bootstrap consistency.
Add include_ca flag to compose_f_args and update unit tests accordingly.
https://chatgpt.com/share/697b9d97-0cf0-800f-805d-7e8308b6f832
Introduce module_utils/jinja_strict.py to render nested Jinja-in-vars with hard-fail semantics. Refactor cert_plan, compose_f_args, and compose_ca_inject_cmd to use render_strict so no "{{ ... }}" leaks into generated paths/commands, and add unit tests.
https://chatgpt.com/share/697b8e1b-54fc-800f-b895-7161f00ebd51
Move TLS/ACME/CA vars out of 00_general into group_vars/all/02_tls.yml and renumber subsequent group_vars files. Add sys-ca-selfsigned to generate /etc/<software>/ca/root-ca.crt and make docker-compose-ca depend on it. Update setup script, templates, and tests to use the new applications/users file numbering.
https://chatgpt.com/share/697b8150-22ac-800f-98b1-e063a659b684
cert_plan now strictly renders Jinja-containing path variables (e.g. TLS_SELFSIGNED_BASE_PATH / LETSENCRYPT_LIVE_PATH) using hostvars context and fails fast if markers remain. Add unit tests covering successful expansion, hostvars precedence, and hard-fail behavior when variables are missing or Jinja leaks through. Include SOFTWARE_NAME in constructor debug output for easier runtime inspection.
https://chatgpt.com/share/697b73c6-f5f8-800f-96cc-e360a137e7a7
Switch OpenSSL invocation to `command.argv` so templated paths are passed atomically.
Prevents unrendered Jinja tokens from being split into extra OpenSSL options during cert generation.
https://chatgpt.com/share/697b5598-b0cc-800f-bdf7-f2e58820608d
kevinveenbirkenbach