- ensure host-mounted infinito config directory ownership and permissions (recursive)
- ensure includes.php ownership on host before container start
- inject /tmp/includes.php loader into config.php idempotently using printf (no heredoc)
- prepare config directory with correct permissions in Dockerfile to avoid root-owned bootstrap
- add read_only.config.php template (default disabled for installer phase)
This fixes broken config.php injection, prevents root-owned config dir on fresh volumes,
and stabilizes Nextcloud auto-installer and OCC plugin routines.
https://chatgpt.com/share/696ed102-9e74-800f-ad52-f09ad0a9da80
OIDC providers (e.g. Keycloak) require a valid https issuer URL, which cannot
be provided in the Docker-in-Docker CI/CD pipeline. Therefore OIDC must only
be enabled when TLS is active.
This change switches OIDC enablement from DOCKER_IN_CONTAINER detection to
TLS_ENABLED for both Mastodon and Matrix services, preventing Synapse startup
failures caused by invalid http issuers.
https://chatgpt.com/share/696e99a6-0e78-800f-8962-0a66127501df
Run `bin/rails db:seed` after `db:migrate` to ensure default data such as
user roles (e.g. Owner/Admin) is present. This fixes tootctl failures when
creating the administrator account due to missing roles.
The seed step is idempotent and does not mark the play as changed.
https://chatgpt.com/share/696e94f4-ad2c-800f-aa2a-f4861a1098a5
- Add optional HTTP-only mode for Mastodon deployments
- Inject override initializer to hard-disable force_ssl and ActionDispatch::SSL
- Mount override into Mastodon and Sidekiq containers
- Prevent automatic compose flush before migrations
- Apply overrides before setup phase
Also:
- Remove unconditional HSTS header from ws_generic proxy vhost
- Make OIDC optional for CI (docker-in-docker)
- Fix env.j2 quoting and formatting
- Gate HSTS in Nextcloud behind TLS_ENABLED
https://chatgpt.com/share/696e914c-c758-800f-b16e-6341873c0e0e
Move repo root detection into scripts/ci/discover.sh so it can be executed
from any working directory. Simplify ci-discover-output to just call the
script and rely on its internal path resolution.
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
Change ci-discover-output to resolve the repository root via git and execute
scripts/ci/discover.sh from there so that relative paths (e.g. roles/* and
scripts/tests/*) resolve correctly.
This fixes empty discovery results and "Role directory not found" warnings
caused by running discovery from the wrong working directory.
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
Restore discover.sh execution on the host to avoid running Docker Compose
from inside the container, and execute only the storage validation logic
inside the infinito CI container.
This fixes "--profile" errors caused by compose-in-compose and keeps the
Python dependency stack isolated inside the container.
- Run scripts/ci/discover.sh directly on host
- Execute sufficient_storage filter via docker compose exec
- Keep CI output and ONLY_APP override unchanged
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
Ensure ci-discover-output changes into the Infinito repository root (resolved
inside the container via `pkgmgr path infinito`) before executing
scripts/ci/discover.sh so that all relative paths (e.g. scripts/tests/discover-apps.sh)
resolve correctly.
This makes discovery robust against different working directories and future
layout changes.
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
Run the upstream EspoCRM docker-entrypoint.sh first to preserve the original
installation and webroot initialization logic. Afterwards apply custom
seed/patch logic with a strict bootstrap.php guard to fail fast on invalid
volume mounts.
Also harden daemon healthcheck to avoid fatal bootstrap crashes.
https://chatgpt.com/share/696e4abd-0478-800f-ba18-7e149502d5c5
Update ci-discover-output Make target to dynamically resolve the Infinito
repository path inside the CI container using `pkgmgr path infinito` instead
of relying on a fixed working directory.
This makes app discovery robust against future repo layout changes and
ensures discover.sh is always executed from the correct location.
- Resolve repo root via pkgmgr inside container
- Execute scripts/ci/discover.sh from resolved path
- Keep ONLY_APP override and GITHUB_OUTPUT handling intact
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
Move the full app discovery step into a dedicated Make target (ci-discover-output)
and execute discover.sh inside the infinito CI container to ensure a consistent
runtime environment.
This removes inline discovery logic from GitHub Actions workflows and prevents
host-side dependency issues (e.g. missing Python modules or jq mismatches).
- Add ci-discover-output Make target
- Run scripts/ci/discover.sh inside infinito container
- Simplify all test-deploy workflows to use the new wrapper
- Keep ONLY_APP override and GITHUB_OUTPUT handling intact
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
- Add test-local-cleanup target that derives entity name from APP using entity_name_utils
- Automatically purge matching /opt/docker/<entity> stack before rapid deploy
- Skip purge gracefully if entity cannot be resolved or stack directory is missing
- Add test-local-rapid-fresh target to run cleanup before rapid deploy
https://chatgpt.com/share/696e37cb-17b4-800f-b6f3-2becd2f61814
Enable Rails development environment in CI by conditionally adding the `listen`
gem and ensuring Bundler does not exclude development groups during image build.
This prevents crashes caused by the missing evented file watcher.
The production image remains unchanged.
https://chatgpt.com/share/696e0ea2-7a70-800f-9a15-1dafb453ab37
Avoid conflict with ManageSieve (4190) and other well-known services by
moving internal oauth2-proxy callback/listener ports from 418x to the
reserved 16480-16499 range and documenting the block.
https://chatgpt.com/share/696d8034-2b80-800f-99d1-8939bd1236eb
Ensure kcadm is always authenticated before triggering LDAP group sync.
Refactor login logic into reusable KEYCLOAK_COMMAND_PERMANENT_ADMIN_LOGIN
and reuse it in login tasks and sync handler.
https://chatgpt.com/share/696d76ba-50f0-800f-8ec3-2ca9e27adcc8
- introduce installation procedure (container wait, login check, migrate, seed)
- move LDAP configuration into dedicated post-install step
- make service name configurable via SNIPE_IT_SERVICE
- unify artisan execution via service variable
- adjust oauth2 origin host to snipe-it service
- remove obsolete Administration.md
https://chatgpt.com/share/696d6d57-8c3c-800f-9ac9-9578ff2e2491
- add storage detection utility for CI (DockerRootDir free space check)
- automatically set STORAGE_CONSTRAINED in cli.deploy.test when disk < 100 GiB
- forward STORAGE_CONSTRAINED into generated CI inventory via --vars
- introduce global STORAGE_CONSTRAINED default in group_vars
- run aggressive docker prune handler only in storage constrained mode
- mark CI inventory environment as development
https://chatgpt.com/share/696d6a11-2d90-800f-83e8-a30f6229e2e0
The ldap group sync handler relies on rc-based retries with `until`.
Using async/poll breaks this logic because async results do not expose `rc`
unless fully polled.
This change removes async execution to ensure reliable retry and error
handling during ldap group synchronization.
https://chatgpt.com/share/696d63e9-0e3c-800f-8107-adf747e4ffe5
- add strong_password generator with special characters
- introduce opensearch_initial_admin_password credential
- wire OpenSearch admin password via env template
- decouple OpenSearch admin password from Shopware admin user
- minor formatting cleanup in service resolver
- pass application_id to sys-stk-full for proper app context
- remove recursive chown on /var/www/html/config (breaks with read-only infinito mount)
- set correct ownership and permissions for host config and include files
- normalize file modes for generated Nextcloud config snippets
https://chatgpt.com/share/696d5a7c-f248-800f-b228-b26afd8c24bf
kevinveenbirkenbach