Split collection requirements into Galaxy and Git sources and
introduce retry logic with Git fallback to harden CI against
transient Ansible Galaxy API failures.
- Run ShellCheck using koalaman/shellcheck container instead of apt
- Align CI linting behavior with local ShellCheck versions
- Suppress SC1091 for sourcing /etc/os-release in docker install script
https://chatgpt.com/share/69756a53-53c8-800f-9056-37baac0ab931
Switch CSP health crawler to URL-only mode by deriving http/https from each
nginx .conf (listen 80/443/ssl) and passing full URLs to csp-checker.
Update unit tests accordingly.
BREAKING CHANGE: sys-ctl-hlth-csp now passes full URLs instead of domains.
https://chatgpt.com/share/69756136-e658-800f-9e52-7d9c4a79d026
- add optional idempotent bootstrap of Django superuser via script module
- execute admin bootstrap through docker compose exec with env injection
- avoid shell/quoting issues by passing credentials via environment
- introduce BASEROW_SECRET_KEY and wire it into container env
- ensure container recreation when DB credentials change
- document admin bootstrap and SECRET_KEY requirements in README
https://chatgpt.com/share/6975538c-a6d0-800f-b2ea-fbab963ef142
Add a Python helper script to ensure the postgres superuser password inside
the Docker container without shell/SQL quoting issues.
The script:
- checks whether the password already works
- updates it only if necessary
- signals change state via exit codes (0 = unchanged, 2 = changed)
The role now calls the script via ansible.builtin.script and maps rc to
changed/failed correctly.
https://chatgpt.com/share/697528b6-79f4-800f-96c9-da993feff9b9
- add sed_escape Jinja filter for sed replacement safety
- escapes \, &, and the active sed delimiter
- designed explicitly for sed s/// replacement context
- patch all sed-based config updates across roles
- espocrm, friendica, gitea, matomo, moodle, wordpress
- ensure every Jinja value in sed replacements uses sed_escape
- use correct delimiter-specific escaping (/, |, #)
- add robust integration test to enforce sed_escape usage
- scans all roles/*/tasks/**/*.yml
- detects sed substitutions with Jinja in replacement part
- ignores delimiters inside {{ ... }} blocks
- fails CI if sed_escape is missing
- harden repository against sed injection, delimiter breakage,
and credential corruption in config patching tasks
https://chatgpt.com/share/6974fb45-1ee8-800f-80bd-c71122e4ac02
Extend password-quoting integration test to:
- fail when password variables in shell tasks miss the `| quote` filter
- fail when `| quote` is used but the Jinja expression is wrapped in quotes
(double-quoting)
This ensures shell-safe password handling and prevents quoted secrets
from being passed literally to CLI tools.
https://chatgpt.com/share/6974dd33-9470-800f-b469-d31fabcd59e1
Ensure all password usages in shell commands are safely quoted using the
`| quote` filter to prevent shell injection issues and test failures.
Affected roles:
- svc-db-postgres
- web-app-gitea
- web-app-mediawiki
- web-app-moodle
- web-app-shopware
- web-app-xwiki
https://chatgpt.com/share/6974dd33-9470-800f-b469-d31fabcd59e1
- add integration test to ensure password variable definitions never use '| quote'
- add integration test to ensure password usage in shell tasks always uses '| quote'
- scope checks to roles/**.yml using regex-based best-effort parsing
https://chatgpt.com/share/6974da97-e6dc-800f-8acc-43aa45e6cf8f
- rename mailu_password to mailu_user_password for clarity
- switch to shell execution to support proper argument quoting
- define correct changed_when/failed_when based on Mailu CLI behavior
- tolerate duplicate-user errors without failing the run
https://chatgpt.com/share/6974adda-1808-800f-8204-40d94a908bd0
Introduces role-local `kcadm_json` filter + `module_utils/kcadm_json.py` to reliably parse kcadm output with JVM noise, and reuses it in `keycloak_kcadm_update` and LDAP/RBAC/recaptcha tasks to eliminate jq/`--query`. Also refactors LDAP groups.path handling via `include_tasks` to avoid repeated `when` conditions and adds unit tests for filter/module utils/library behavior.
https://chatgpt.com/share/69743d89-b1c0-800f-b571-90f64605dfe4
Handle JVM/cgroup warnings mixed into stdout by scanning and validating JSON segments,
replace fragile query-based lookups with list+filter resolution, and fix create-path
control flow to exit deterministically after successful creation.
https://chatgpt.com/share/69742b27-7980-800f-a142-4ffcf379386c
Make has_domain filter self-contained (no module_utils/sys.path hacks) and let compose_f_args detect domains internally to avoid missing-filter failures. Adjust unit tests accordingly and increase Mailu user creation retry delay.
https://chatgpt.com/share/6973e02e-f22c-800f-aae3-1f57637a746c
