- Add LDAP.RBAC.EMPTY_MEMBER_DN placeholder for empty role groups (schema-compliant groupOfNames)
- Ensure RBAC role entries always contain at least one member
- Align users OU attribute with DN (ou=users)
- Switch Keycloak LDAP group/role mappers to DN-based membership
- Fix missing newline in Keycloak schema file
https://chatgpt.com/share/696b7226-7c18-800f-a0b0-59068bb69d9f
- Use SYSTEM_EMAIL_HOST as single canonical Mailu hostname
- Remove MAILU_HOSTNAMES list handling and related assertion
- Simplify Mailu env HOSTNAMES to single hostname
- Align Mailu server domain config with primary mail domain
- Ensure consistent hostname resolution across email + web services
https://chatgpt.com/share/696ac991-db50-800f-9d3c-ca41bdb7058a
- Render WEB_PROTOCOL and domain_url via templar in docker_cards lookup
- Add DummyTemplar with Ansible-like bool filter for stable unit testing
- Refactor tests to use templar injection via _run_lookup helper
- Add coverage for Jinja-based WEB_PROTOCOL and domain rendering
This ensures lookup behavior matches real Ansible runtime while keeping unit tests deterministic.
https://chatgpt.com/share/696ac8bf-8c0c-800f-a3e7-db4bfb2a8f3f
- Add host-level AAAA DNS sanity test against CoreDNS
- Fail hard on SERVFAIL (breaks Node/getaddrinfo with EAI_AGAIN)
- Allow empty AAAA responses (IPv4-only setup is valid)
- Keep A-record validation unchanged
This prevents silent IPv6 resolver regressions that break CSP checks.
https://chatgpt.com/share/696abc27-19dc-800f-9ead-6598c2f3c302
- Replace NXDOMAIN for AAAA with fallthrough to avoid SERVFAIL and Node EAI_AGAIN
- Add robust Docker-in-Docker DNS health check (A + no SERVFAIL)
- Add Node/getaddrinfo DNS validation (matches CSP checker behavior)
- Add make target to stop CI compose stack without removing volumes
This prevents DNS resolver failures inside DinD and makes CSP health checks reliable.
https://chatgpt.com/share/696aba87-e5d4-800f-871c-aac049201fb7
Add retry logic with 30 attempts and 2s delay to Matomo site check to
handle transient DNS and startup timing issues in Docker-in-Docker and CI
environments.
This prevents false negatives caused by temporary name resolution failures
while CoreDNS and the Matomo service are still initializing.
https://chatgpt.com/share/696aab20-6e28-800f-a860-4a6a1fcd7446
- Introduce SYSTEM_EMAIL_ENVIRONMENT abstraction (external/localhost + container)
- Route SMTP via localhost in Docker-in-Docker environments
- Prevent invalid FQDN mail host usage inside DiD
- Disable SMTP auth for localhost-based delivery
- Improve reliability of health checks in containerized setups
This avoids broken mail delivery paths like Docker -> DiD -> DiD and
ensures predictable behavior in CI and nested container environments.
- Enforce explicit WEB_PROTOCOL variable for URL generation
- Fail fast with AnsibleError when WEB_PROTOCOL is missing
- Add unit tests for http/https protocol handling
- Refactor test fixtures using shared base variables
This makes URL generation deterministic and proxy-agnostic and avoids
implicit defaults in desktop card rendering.
https://chatgpt.com/share/696a958b-eeec-800f-867b-842e0621b4bb
- Replace Arch-only inetutils installation with distro-agnostic package mapping
- Use inetutils on Arch and hostname package on all other distros
- Ensure hostname command is available consistently across environments
https://chatgpt.com/share/696a5b7d-6854-800f-b890-3fd72f37d547
- Rename code-analyses workflow to ci-orchestrator
- Add lint, test and install collector gates
- Enforce code-quality-gate before building CI images
- Stage deploy pipeline via DNS → server → universal → workstation
- Gate installation tests behind quality checks
- Simplify final done collector to depend on deploy + install gates
This establishes a strict CI flow: quality → build → dns → deploy → install.
https://chatgpt.com/share/696a4c71-191c-800f-a601-aab6ff1762df
sys-svc-docker role as a post-restart validation handler.
This change moves the inner-container DNS validation out of the CI test
suite and into the Docker service lifecycle itself, ensuring that DNS is
verified exactly where it matters: inside the Docker-in-Docker daemon.
Key changes:
- Add roles/sys-svc-docker/files/test-dns.sh:
- Runs inside the DinD container
- Waits for dockerd readiness
- Executes a BusyBox test container with explicit --dns
- Verifies DOMAIN and subdomain resolve to the expected IP
- Fails hard if DNS is broken
- Register DNS self-test as a docker restart handler:
- Runs once per deployment
- Only executed when DOCKER_IN_CONTAINER and MODE_DEBUG are enabled
- Uses ansible.builtin.script with role_path for correct resolution
- Remove inner Docker DNS test from scripts/tests/dns.sh:
- CI test suite now only validates host → CoreDNS → outer container chain
- DinD DNS validation is now part of the Docker service health lifecycle
This ensures that:
- DNS is validated after every Docker restart
- DinD networking failures are detected immediately
- CI and production share the same DNS validation logic
- Docker-in-Docker DNS becomes a first-class health invariant
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Quote dig server argument to avoid word splitting (SC2086)
- Replace &&/|| pseudo-if with proper if/else blocks (SC2015)
- Validate INFINITO_CONTAINER early via required env guard
- Keep DNS test logic unchanged, only harden correctness and linting
This makes scripts/tests/dns.sh fully shellcheck -x compliant and more robust.
https://chatgpt.com/share/696a4053-93f8-800f-959b-f99e2d7d12e2
- Introduce env.ci as single source of truth for CI networking
- Make docker-compose, CoreDNS and Docker daemon fully env-driven
- Render CoreDNS Corefile from template via envsubst
- Replace hardcoded IPs/domains with environment variables
- Integrate env-based networking into Ansible defaults
- Remove static Corefile and daemon.json
This makes DNS and networking deterministic and reproducible across
host, CoreDNS, infinito runner and Docker-in-Docker.
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
Set ndots:0 in Docker daemon DNS options so single-label service names
(e.g. "matomo", "mariadb") are resolved via Docker embedded DNS first
before applying the infinito.example search domain.
This prevents collisions between internal compose service discovery and
the infinito ingress DNS zone.
https://chatgpt.com/share/69698561-9a8c-800f-8bdf-0b8814e6cc9e
- Map infinito.example and *.infinito.example to infinito runner (172.30.0.10) via CoreDNS
- Assign static IP to infinito container in CI compose network
- Add dns_search infinito.example to CI defaults
- Configure inner Docker daemon to use CoreDNS (172.30.0.53) with search domain
- Replace fuse-overlayfs-only setup with full docker-in-docker daemon configuration
This ensures all inner containers can resolve infinito.example consistently in CI.
https://chatgpt.com/share/69696e22-ca7c-800f-bee1-e454f22cb1e5
- Change --log flag to require explicit log directory (--log <LOG_DIR>)
- Automatically create log directory with parents=True
- Harden permissions best-effort (0700)
- Update CLI help text accordingly
- Adjust Makefile test targets to pass explicit log directory
- Ignore logs/ via .gitignore and .dockerignore
- Refactor flag parsing to correctly detect deploy with --log
- Add dedicated logging unit tests
- Update existing tests for new log semantics
- Remove deprecated -i alias for --id in deploy command
https://chatgpt.com/share/6969680a-dbf8-800f-aafb-3d32d6212ba0
Add a combined help output that includes:
- Wrapper CLI help
- Full `ansible-playbook --help`
- Explanation and examples for native Ansible flag passthrough
This makes it clear how to use --tags, --check, -e, --forks, and other
ansible-playbook options directly via the infinito deploy wrapper.
https://chatgpt.com/share/69694e02-de58-800f-a9ea-2fb788ff5077
- Remove unused cli_root and logs handling from dedicated deploy wrapper
- Add parse_known_args() to forward native ansible-playbook flags
- Append passthrough args at the end for proper override behavior
- Clean up MODE_LOGS usage
- Update runner signature and cleanup phase logic
- Adapt unit tests to new wrapper contract
- Add unit test for ansible flag passthrough in command.main()
https://chatgpt.com/share/69694ad5-453c-800f-8047-cf210f60460f
- Rename act-based targets for clarity:
- test-deploy -> test-act
- test-deploy-app -> test-act-app
- Rename rapid local deploy target:
- test-deploy-rapid -> test-local-rapid
- Add test-local-full target to run a full local deploy against a generated
inventory containing all apps of the selected TEST_DEPLOY_TYPE
- Add scripts/tests/deploy-local-full.sh:
- Discover apps on host via make ci-deploy-discover
- Bootstrap container via scripts/docker/entry.sh
- Generate dedicated inventory with --include list
- Deploy against that inventory
https://chatgpt.com/share/69692ef1-095c-800f-83cb-924fadfaa554
- Add test-deploy-rapid Makefile target for fast local single-app deploys
- Execute scripts/docker/entry.sh before running infinito deploy
- Run deploy inside existing infinito container (no rebuild, no update)
- Skip update and backup for faster inner-loop testing
https://chatgpt.com/share/69692ef1-095c-800f-83cb-924fadfaa554
Configure build-ci-images and code-analyses to use per-ref concurrency groups
to avoid global serialization while still preventing duplicate runs per ref.
Also remove redundant tag ignore rules from the push workflow.
https://chatgpt.com/share/69691ebf-a380-800f-80fc-bd44d59e90dd
Promote-stable now validates version tags against the real quality gate
(code-analyses.yml) instead of the nightly scheduler wrapper.
This ensures the stable tag only points to versions that passed the full
CI matrix (lint, security, build, deploy, install, tests).
https://chatgpt.com/share/69691ebf-a380-800f-80fc-bd44d59e90dd
- Add daily stable promotion workflow with CI-gated highest-version selection
- Ensure GHCR images exist before moving stable tag
- Retag version images to :stable without rebuild
- Unify release workflows under infinito-release concurrency group
- Remove legacy highest-version/stable-move scripts and inline logic
https://chatgpt.com/share/696909c1-781c-800f-b52d-d9f967e9698c
- Set default distros for workflow_call in code-analyses
- Remove redundant distro overrides from PR and nightly entries
- Require distros input in build-ci-images and rely on orchestrator default
https://chatgpt.com/share/696909c1-781c-800f-b52d-d9f967e9698c
- Move nightly release trigger into its own concurrency group
- Serialize release-version workflow via dedicated infinito-release group
- Decouple release maintenance from main CI pipeline
https://chatgpt.com/share/696909c1-781c-800f-b52d-d9f967e9698c
- Add `distros` input to code-analyses orchestrator and forward it to build and deploy workflows
- Enforce distros via required workflow_call inputs in test-deploy-* workflows
- Restrict push and pull-request entries to arch only
- Run nightly workflows on full distro matrix
- Align nightly release cron to 00:00 UTC
Reduce superadmin authentication debug section to a single condensed shell task
while keeping full diagnostics (HTTP status, headers, content preview and
password hash comparison). This simplifies the task flow and keeps CI logs
compact and readable.
https://chatgpt.com/share/696901b7-de98-800f-8039-b1a986db6195
- allow non-200 status codes for superadmin REST check (401/403/5xx)
- capture response body and headers for forensic debugging
- add password hash comparison (container vs ansible) to detect drift
- improve failure message with detailed diagnostics
https://chatgpt.com/share/6968eec3-b1ec-800f-b3c1-2bac3081e89e
kevinveenbirkenbach