Render docker_compose via templar when available (fallback when _templar is missing) and coerce YAML/JSON strings to dicts in compose_f_args and compose_ca_inject_cmd.
Prevents AnsibleTaggedStr type errors at runtime and avoids NoneType templar crashes in unit tests.
https://chatgpt.com/share/6973d2de-92e0-800f-8279-3e5c9d804c67
Deploy /usr/local/bin/infinito-compose to auto-detect .env and compose override files.
Refactor sys-ctl-rpr-docker-{hard,soft} to use the wrapper consistently.
Update unit tests to match wrapper-based command building.
https://chatgpt.com/share/6973c64c-b560-800f-8915-cbb786c51714
Introduce docker-compose-ca role with CA wrapper and inject script, add CA-aware compose override handling, and refactor compose pull/run logic to support multi-file projects. Update handlers, lookups, paths, and unit tests to consistently resolve TLS-driven CA injection without implicit defaults.
https://chatgpt.com/share/6973c00c-139c-800f-8ddb-e7d0cf5043fc
- Extract shared TLS logic into module_utils/tls_common
- Introduce cert_plan lookup for certificate paths and SAN computation
- Simplify tls_resolve to strict protocol/port/domain resolution only
- Add global self-signed certificate scope covering all domains
- Mount self-signed cert base into OpenResty container
- Update Nginx templates to use cert_plan for ssl_certificate paths
- Add comprehensive unit tests for tls_common, tls_resolve, and cert_plan
https://chatgpt.com/share/6972c568-9e8c-800f-b89a-a0061966f9a8
- Remove legacy WEB_PROTOCOL dependency from docker_cards lookup
- Build application URLs using strict tls_resolve lookup
- Align desktop card URL generation with new TLS layer
- Update unit tests to stub tls_resolve and validate TLS-based behavior
- Drop WEB_PROTOCOL-related test cases
https://chatgpt.com/share/6972b832-8284-800f-8b86-f1a32061c09f
- Remove deprecated filter_plugins/tls.py and all dependent filters
- Introduce strict lookup plugin lookup_plugins/tls_resolve.py as single TLS authority
- Migrate all roles, templates, vars, and tasks to use tls_resolve (protocols, ports, URLs, cert paths)
- Enforce explicit TLS context (domains, applications, TLS_ENABLED, TLS_MODE)
- Support letsencrypt and self_signed with SAN handling and per-app overrides
- Update TLS provider roles to assert resolver state instead of setting facts
- Add comprehensive unit tests for tls_resolve lookup
https://chatgpt.com/share/6972b49b-b074-800f-a323-dd9fe69d02eb
with explicit per-application TLS resolution.
Key changes:
- Introduce sys-front-tls-layer as the single TLS abstraction
- Centralize certificate paths via TLS_CERT_FILE / TLS_KEY_FILE / TLS_CA_FILE
- Replace sys-svc-letsencrypt SSL templates with generic TLS layer includes
- Add tls_* Jinja filters (enabled, mode, protocol, port, websocket)
- Resolve TLS mode per application (letsencrypt | self_signed | off)
- Remove implicit defaults and WEB_* globals to fail fast on misconfiguration
- Support self-signed certificates with SAN awareness
- Make TLS behavior explicit and consistent across all roles
This decouples application logic from certificate providers and
allows switching TLS flavor without touching app roles.
https://chatgpt.com/share/69727c61-8e68-800f-a267-473a7e627978
- Prebuild etherpad image in dev runtime to avoid local startup errors
- Override freeswitch entrypoint in dev to ensure missing iptables REJECT chain
does not crash the container (Docker-in-Docker compatibility)
https://chatgpt.com/share/6972262f-4318-800f-8bf8-f4166900f3a5
- Force PYTHON=python3 for test-local-init to avoid missing venv python
- Rename test-local-inventory-init-all target to test-local-init
- Fix JSON quoting for --vars in local deploy scripts
- Add RUNTIME default to group_vars
- Improve debug output for initial host vars
- Update user hint in local run script
https://chatgpt.com/share/697222e1-5edc-800f-b9ab-511d8afc3142
- Skip Python attribute matches that are used as method calls (e.g. applications.setdefault(...))
- Add line and column information to assertion errors
- Print the exact source line for faster debugging of invalid application references
https://chatgpt.com/share/697215ce-df3c-800f-b81f-641c75939e7f
- Prevent accidental import of installed "cli" package from site-packages
- Make `python3 cli/__main__.py ...` behave identical to `python -m cli ...`
- Add env.development to .dockerignore to match .gitignore
https://chatgpt.com/share/69720fd6-a1c8-800f-b1e2-6909aa63643a
- introduce env.development marker for local dev runtime
- add cli.meta.runtime module with library API and CLI entrypoint
- detect runtime via ACT/GitHub/marker with explicit RUNTIME override
- use env.development as docker-compose env override
- pass RUNTIME=dev into development inventory generation
- add make setup-development helper
https://chatgpt.com/share/69720fd6-a1c8-800f-b1e2-6909aa63643a
Add a scheduled (06:00 UTC), manual and reusable workflow to mirror Docker Hub
images to GHCR using skopeo. The job runs best-effort and never fails the pipeline,
with optional Docker Hub authentication and configurable namespace/prefix.
https://chatgpt.com/share/6971e6cf-be18-800f-9419-589fd3e22c3d
- ensure OpenProject runs in production mode only
- wait for web container before applying settings
- run pending migrations automatically before rails runner
- apply settings via rails runner stdin (robust quoting & booleans)
- introduce thread/db pool cap to prevent OOM (OPENPROJECT_DB_POOL / RAILS_MAX_THREADS)
- fix admin creation runner env handling
- wire application_id correctly into docker roles
- disable unnecessary git pull for openldap docker role
- remove obsolete Development.md
This prevents OpenProject boot crashes caused by excessive thread/db pools
derived from dynamic Postgres sizing and makes role execution deterministic.
https://chatgpt.com/share/697135bd-7630-800f-8e1b-573305df86f6
- Capture and print deploy stdout/stderr on failure (development/deploy.py)
- Forward INVENTORY_DIR into init and deploy handlers (development/run.py)
- Add missing when_down flag for up handler
- Print full traceback on orchestrator failure for CI visibility
https://chatgpt.com/share/6970fcf5-5860-800f-89ae-0d601405489b
- Move Corefile rendering logic into CoreDNSCorefileRenderer
- Add atomic rendering via envsubst with validation and preview
- Enforce strict error handling for missing files, invalid paths and permissions
- Integrate renderer into development compose workflow
- Rename DNS make targets for consistency (dns-setup / dns-remove)
- Rename test-act target to test-act-all
https://chatgpt.com/share/6970e503-e818-800f-8724-d791a3abfb33
- Use docker-up + ci-discover-output for local discover job (same as CI)
- Add strict input resolver (scripts/meta/resolve/input.sh) with enforced env contract
- Ensure ONLY_APP is always defined (may be empty, but never unset)
- Expose resolved inputs as workflow outputs for linear matrix deploy
- Enforce linear matrix execution via max-parallel: 1
- Align act helper scripts with linear matrix semantics
https://chatgpt.com/share/6970ba64-8c2c-800f-bb90-7edbe9168582
The CI distros runner now only passes arguments supported by
cli.deploy.development run. This avoids argparse errors caused by
forwarding build-only flags that the orchestrator does not accept.
https://chatgpt.com/share/697030c4-f60c-800f-94b6-9128f87da57e
kevinveenbirkenbach