- add coturn enabled+shared → web-svc-coturn service resolution
- refactor BigBlueButton coturn logic to distinguish local vs shared coturn
- introduce BBB_COTURN_LOCAL_ENABLED flag
- split TURN secrets into local and shared variants
- update dependencies, env and compose templates accordingly
- enable shared coturn in BigBlueButton and Nextcloud configs
https://chatgpt.com/share/696d54a1-9dbc-800f-8507-088bad56bc48
Introduce reusable test-e2e-cypress role that:
- auto-discovers application roles providing tests/cypress/env.j2
- stages per-role Cypress projects into /tmp
- renders .env from env.j2 with application context
- optionally waits for application readiness (HTTP 200/302)
- runs Cypress in a pinned Docker image with stable browser settings
- collects failures and fails the play at the end
- stores per-role reports and artifacts
Designed as a test-agnostic execution framework.
Each application role owns its Cypress project and specs.
https://chatgpt.com/share/696d4ad5-740c-800f-904d-84c6fff83e3c
- Make cookie_secure conditional via TLS_ENABLED to support HTTP setups
- Use managed oauth2_proxy_cookie_secret without implicit generation
- Keep domain and whitelist configuration unchanged
https://chatgpt.com/share/696d22ca-7b68-800f-ba8d-ee9ddaa4cf86
Add a defensive assertion in svc-db-postgres init to ensure application_id scope
is not polluted by upstream loaders.
Also normalize load_app debug output formatting and add a no-op hardening step
to make variable intent explicit for future scope-guarding refactors.
https://chatgpt.com/share/696ce9ee-68ac-800f-9ea0-d73c285af9a8
- Add best-effort helpers for Postgres and MariaDB database drops
- Avoid connecting to the target DB when dropping Postgres (use template1 for 'postgres')
- Ignore DB drop errors and continue with purge (compose down + rm -rf)
- Protect MariaDB system databases from being dropped
- Update script header to reflect best-effort behavior
Add configurable LDAP sync periods to the Keycloak role and wire them into
the LDAP UserStorageProvider component.
This enables automatic changed-user sync every 15 minutes and a full sync
once per day via:
docker.services.ldap.sync.period.changes
docker.services.ldap.sync.period.full
Defaults can now be centrally managed via application config.
https://chatgpt.com/share/696d02b4-1418-800f-8fe5-864f4e7494e8
Ensure the ldap-roles group mapper always uses the correct parent group id
by injecting groups.path.group based on the actual Keycloak group.
Trigger LDAP → Keycloak group synchronization via a handler whenever the
mapper configuration changes, ensuring deterministic and reproducible
group imports under /roles.
https://chatgpt.com/share/696d02b4-1418-800f-8fe5-864f4e7494e8
- Support purging multiple stacks in one run
- Best-effort detect postgres/mariadb from .env and drop DB if found
- Always run compose down and delete /opt/docker/<stack>/volumes + stack dir
- Skip DB drop with warning when no backend is detected
https://chatgpt.com/share/696cfcd5-2b84-800f-a386-b7d1d38d68b7
Expose Postgres via DOCKER_BIND_HOST instead of POSTGRES_LOCAL_HOST to ensure
the port is reachable from the infinito container when running Docker-in-Docker
in CI/CD environments.
This avoids binding the published port to the container loopback interface
(127.0.0.1), which is not reachable from sibling containers.
https://chatgpt.com/share/696ce9ee-68ac-800f-9ea0-d73c285af9a8
- add optional debug output for application context
- extract database and oauth2 enable checks into role vars
- use normalized flags in task conditions
- fix typo in load_app task log message
https://chatgpt.com/share/696cbc91-cef8-800f-acfd-9cef34e28b0b
- add role_config_path support and services edges in combined resolver/tree
- add services resolver mapping with desktop enabled rule (non-shared)
- add unittest coverage for repo_paths, yaml parsing, services mapping/BFS, and combined tree cycles
- update tests to reflect new stable path expectations and tree output
https://chatgpt.com/share/696cb80f-e8f4-800f-b062-e47985b4b074
Replace legacy volumes*.yml.j2 includes with the new compose_volumes filter across roles.
Add YAML-safe serialization for Ansible/Jinja proxy types to avoid PyYAML representer errors.
Remove obsolete volumes templates and extend unit tests to enforce required database_volume behavior.
https://chatgpt.com/share/696c2722-fd30-800f-bf01-dfcd3cb7ba72
- Add compose_volumes filter to generate docker-compose volumes section dynamically
- Preserve exact logic from roles/docker-compose/templates/volumes.yml.j2
- database volume only when database service enabled and not shared
- redis volume when redis service enabled or oauth2 enabled
- no fallback names, database_volume is required when database is needed
- Support manual volume injection via extra_volumes (YAML merge equivalent)
- Add strict input validation for applications and application_id
- Add full unit test coverage for all conditions and edge cases
https://chatgpt.com/share/696c1710-04c4-800f-a73f-de3d5ebd2902
- move sys-token-store initialization to constructor stage
- remove duplicate token store includes from frontend and app roles
- allow Mailu reachability check to accept configurable status codes (200, 301)
- make Mailu health check consistent with web-app-mailu config
- increase test-local-rapid verbosity for better diagnostics
https://chatgpt.com/share/696c0f49-7888-800f-8175-fb21893c0d67
Load `memberof` and `refint` in `slapd.conf` before generating `cn=config` via `slaptest`, so the `memberOf` attribute is known and user entry updates no longer fail with “entry update failed”.
https://chatgpt.com/share/696be95b-68cc-800f-a883-fe2755a0a6cc
- Support space-separated, comma-separated and mixed --id values
- Normalize and deduplicate application IDs before validation
- Fix Makefile to pass APP without quoting
- Add unittest coverage for ID normalization
https://chatgpt.com/share/696be0c2-816c-800f-8b07-3c5cd0304ac5
- Replace database_application_id with database_consumer_id
- Use explicit consumer context for database resolution
- Fix recursive Jinja variable loop in sys-svc-rdbms
- Decouple discourse database network from global database_type
https://chatgpt.com/share/696bd40d-ebfc-800f-9ba8-1e6be919a629
- Set X-Forwarded-Ssl dynamically based on TLS_ENABLED
- Enable KC_PROXY_HEADERS=xforwarded for proper reverse proxy support
- Ensure correct protocol handling for HTTP and HTTPS environments
https://chatgpt.com/share/696bbbed-5514-800f-8281-b8485d77cac7
Replaced all usages of `make up` with `make docker-up` in GitHub Actions workflows.
Renamed Makefile targets:
- up -> docker-up
- down -> docker-down
- stop -> docker-stop
- added docker-restart
This makes the Docker-specific intent explicit and avoids ambiguity with other potential `up` targets.
https://chatgpt.com/share/696bb966-ee90-800f-a5d2-e419cc423cc4
- Always emit reserved flag in generated users (default: false)
- Do not override existing user definitions via --reserved-usernames
- Normalize description default to empty string
- Align unit tests with new reserved semantics
- Fix YAML quoting and trailing newline issues
- Clean up minor formatting and config inconsistencies
https://chatgpt.com/share/696bb761-0048-800f-9cf7-aebd3fda75be
- Set SYS_SERVICE_DEFAULT_STATE=started for local rapid tests
- Remove deprecated SYS_SERVICE_SUPPRESS_FLUSH mechanism
- Simplify service flush/suppress logic
- Normalize formatting and ensure newline in database vars
- Adjust LAM CSP flags (disable unsafe-inline for script-src-elem)
into the container environment and CSP connect-src configuration.
This clarifies the semantic difference between host-only LOGOUT_DOMAINS
and fully qualified logout targets used by the universal logout service.
https://chatgpt.com/share/696b82a2-e89c-800f-bbd2-ff7e347c9a85
kevinveenbirkenbach