Ensure /var/www/html/config is created and owned by www-data before running occ
and appending dynamic configuration. This prevents install failures caused by
root-owned Docker volumes.
Also:
- fail fast if occ status does not report a successful installation
- align nginx root with NEXTCLOUD_DOCKER_WORK_DIRECTORY
Fixes: "Cannot write into config directory" and missing config.php on fresh volumes
https://chatgpt.com/share/6968e0a3-05c8-800f-aa3e-8c0d3c155552
Ensure LDAP configuration is only applied after the Snipe-IT settings table
exists and has been seeded with at least one row. This prevents null Setting
model errors during early migrations and makes the LDAP bootstrap reliable
in CI and fresh installs.
https://chatgpt.com/share/6968dcbc-158c-800f-b263-df74632d5e4a
- Trigger docker compose up after rendering LocalSettings/oidc/debug configs
- Flush handlers and wait for MediaWiki container to exist before running docker exec/cp
- Prevent fatal errors during provisioning by loading OIDC extensions only if extension.json files exist
https://chatgpt.com/share/6968d779-263c-800f-b40b-7ee8e525268d
- Hard-disable logout, desktop and matomo services in CI inventory to keep containers slim
- Stop truncating docker json logs during docker-compose cleanup
- Extend docker container health check to:
- Print last 200 log lines for unhealthy containers
- Print last 200 log lines for exited containers with non-zero exit codes
- Emit a final summary of all unhealthy/failed containers
- Use severity-based exit codes (1 = unhealthy, 2 = exited)
- Fix missing newline in sys-ctl-hlth-docker-container task file
https://chatgpt.com/share/6968d0d3-23c0-800f-93be-564338d1d867
- Bind APP_FORCE_TLS to TLS_ENABLED instead of forcing it unconditionally
- Align Snipe-IT TLS behavior with reverse proxy and global TLS configuration
- Fix missing newline at end of vars file
https://chatgpt.com/share/696890d1-0954-800f-8ad7-887562c620d3
- Add DB readiness guard to ensure `settings` table exists before LDAP configuration
- Move OAuth2 and LDAP feature flags into vars for consistent gating
- Use boolean flags for clearer task conditions
- Prevent race condition during initial Snipe-IT installation
https://chatgpt.com/share/696890d1-0954-800f-8ad7-887562c620d3
- Remove early flush/notify logic from install step
- Stop triggering mediawiki update via handlers during extension setup
- Move mediawiki update logic from handler to tasks/03_update.yml
- Run update only when config/extensions/composer actually changed
- Rename admin task to keep ordered task flow (04_admin.yml)
https://chatgpt.com/share/69688a99-e940-800f-a961-96474fff8160
- Switch BigBlueButton Docker source to upstream bigbluebutton/docker (main)
- Migrate coturn/collabora from internal to shared service model
- Make TURN protocol configurable (turn vs turns) via TLS_ENABLED
- Add BBB_TURN_PROTOCOL variable and use it in TURN_SERVER
- Only inject coturn TLS cert/key when TLS is enabled
- Normalize IPv6 flag handling with explicit boolean check
- Fix YAML formatting, trailing whitespace, and missing newlines
- Fix web-svc-legal dependency list formatting
- Add TODO entry for inventory dependency resolution
https://chatgpt.com/share/69687cb2-1550-800f-a5a4-394de22b21ec
Add an explicit guard to avoid loading the current application as a backend
service. This prevents accidental self-includes in utils/load_app.yml when
docker.services.<service>.enabled/shared is true and no run_once flag exists.
This ensures backend services are only loaded if:
- the service is enabled and shared
- it has not been loaded before (run_once_*)
- it is not the current application itself
https://chatgpt.com/share/69686928-00e8-800f-8a53-a4eb7a53116a
- Replace generic loop item with semantic loop_var `service`
- Simplify service descriptors to `id` and `name`
- Improve readability and log output via explicit loop labeling
- Keep include interface unchanged via vars mapping
https://chatgpt.com/share/69686823-08bc-800f-8008-01a69d5721fe
- Add docker.services.ldap config with enabled/shared flags
- Fix Jinja conditionals by casting OPENWEBUI_OIDC_ENABLED and OPENWEBUI_LDAP_ENABLED to bool
- Align variable formatting in vars/main.yml
https://chatgpt.com/share/696864da-bd44-800f-8e2e-990eee8130e7
Add dedicated database_reach_host variable to sys-svc-rdbms and use it for
direct database access in application roles.
This separates control-plane database access from generic Docker reach logic
and improves portability and CI stability.
Updated:
- sys-svc-rdbms vars: add database_reach_host
- web-app-openproject: use database_reach_host for LDAP DB queries
- web-app-peertube: use database_reach_host for OIDC DB updates
https://chatgpt.com/share/696863e8-4370-800f-bea0-ad48b98ba0f6
The applications parameter is guaranteed to always be a dict in the runtime
environment. The defensive test for non-mapping input was therefore removed
to avoid unrealistic failure scenarios and false negatives.
This keeps the unit tests aligned with the actual inventory and schema model.
https://chatgpt.com/share/6968551e-7b74-800f-8a5e-a2380c950d06
Decouple MediaWiki config deployment from the update handler execution.
When host-side PHP config files change:
- Flush all previously notified non-update handlers first (e.g. docker-compose restarts)
- Then trigger the MediaWiki update handler in a controlled second phase
This guarantees that the container and services are fully restarted and ready
before maintenance/update.php is executed.
https://chatgpt.com/share/69684c66-fa20-800f-a4a1-6bdfb46c6672
Print selected INFINITO_* and GITHUB_SHA variables before starting the CI
compose stack and only indicate whether NIX_CONFIG is set, avoiding secret
exposure while making the effective image/tag visible in logs.
https://chatgpt.com/share/69684776-86c0-800f-b089-7e549a83e87f
Remove the CI-specific Ollama image override from inventory.sample.yml and
move the logic into the svc-ai-ollama role configuration.
The role now automatically selects:
- alpine/ollama when running inside Docker-in-Docker (GitHub Actions)
- ollama/ollama for normal production deployments
This keeps the inventory environment-agnostic and ensures consistent,
self-contained role behavior across CI and production.
https://chatgpt.com/share/69684373-1d48-800f-bff6-ca436accfdcf
The Makefile defined INFINITO_IMAGE with trailing tabs/spaces, which caused
Docker to fail with "invalid reference format" during CI pulls/builds.
This change removes the trailing whitespace so the image reference is valid.
https://chatgpt.com/share/69683f7d-faa0-800f-bb55-c40a4e9b7737
- Wrap extension installer execution in block/rescue/always
- Fail hard when Groovy installer reports ERROR:: or INSTALLED_MISSING::
- Automatically collect debug info on failure:
- repository DNS/HTTP reachability from container
- mounted xwiki.properties and extension.repositories
- XWiki container logs
- Always clean up temporary InstallExtensions page
- Prevent false "changed" state on installer execution
https://chatgpt.com/share/69683700-5ed8-800f-9870-479b7ff081ac
- Build CI images with immutable ci-<sha> tags instead of latest
- Pass CI image tag into deploy workflows via INFINITO_IMAGE_TAG
- Derive CI_TAG from checked-out release tag commit
- Retag CI images to <version> and latest on release (no rebuild)
- Make release scripts independent from GITHUB_SHA coupling
- Improve robustness and reproducibility of release pipeline
https://chatgpt.com/share/696832f6-35e4-800f-a574-178013d4426e
- Migrate svc-ai-ollama override from `services.*` to `docker.services.*`
to match role defaults and validator expectations
- Replace unsupported `server.status_codes.web` override for Jira
with `server.status_codes.default`
This fixes inventory validation failures in CI.
https://chatgpt.com/share/69682d39-1a88-800f-a392-b6ddaa728f23
MariaDB CLI does not support the '\`' escape sequence. This caused
"Unknown command '\`'" errors when creating databases inside the
container. Backticks are now passed unescaped, which is valid SQL
syntax and works correctly with docker_container_exec.
https://chatgpt.com/share/69682604-8040-800f-ad83-0a1b7f6fc7ee
OpenResty failed to start with:
no "ssl_certificate" is defined for the "listen ... ssl" directive
Cause:
The Matrix OpenResty vhost was still generating `listen ... ssl` directives
even when TLS was disabled, while no ssl_certificate was configured.
Fix:
- Make Matrix federation listen directives fully TLS-aware
- Ensure no `ssl` flags are rendered when TLS is disabled (CI / Docker-in-Docker)
- Keep federation port usable in HTTP-only test environments
This fixes OpenResty validation errors in CI and Docker-in-Docker setups.
https://chatgpt.com/share/69682033-acf4-800f-ae83-b33c97f86c9a
- Drop deprecated docker_compose_file_creation_enabled flag (defaults + all consumers)
- Always run docker-compose file routines and bring stack up (caller can disable auto-flush via docker_compose_flush_handlers)
- Treat docker-compose.yml.j2 as optional via first_found (skip if missing)
- Clean up role template vars (remove removed flag, fix alignment)
- Record new E2E CI failures for Akaunting (502) and Baserow (timeout)
Fixes BigBlueButton CI failure caused by missing .env in repository:
Previously file routines could be skipped, so /opt/docker/bigbluebutton/services/repository/.env
was never created/linked and scripts/generate-compose failed with:
"cat: .env: No such file or directory" and "EXTERNAL_IPv4 is not set in .env".
With file management always enabled, the env file is copied/linked before compose generation.
https://chatgpt.com/share/69681be9-f944-800f-9b67-8afdc3a256fc
The XWiki role expected docker.services.ldap.enabled for auth backend validation,
but the ldap service block was missing from the application config.
This caused get_app_conf to fail during the auth backend assertion
("Only one auth backend (OIDC or LDAP) may be enabled").
Add docker.services.ldap section with sane defaults:
- enabled: false
- shared: false
- trylocal: true
This restores schema consistency and prevents validation errors.
https://chatgpt.com/share/69680fef-507c-800f-9492-e0edd2880e92
The official ollama/ollama image is too large for GitHub Actions runners and
causes frequent "no space left on device" errors during layer extraction.
Switch the CI inventory to use the lightweight alpine/ollama image instead:
- CPU-only, minimal footprint (~70MB)
- Sufficient for CI smoke tests and API checks
- Prevents Docker storage exhaustion on hosted runners
Production setups can still override the image and use the official ollama image.
https://chatgpt.com/share/696805ab-357c-800f-9923-55380347d71b
Ensure Nextcloud is fully installed before appending generated config:
- wait for successful `occ status` with `installed: true`
- add retry loop with timeout
- prevent premature access to config.php during initial setup
This avoids race conditions where config.php does not yet exist.
https://chatgpt.com/share/69680205-d6e0-800f-b47a-f03da156868f
Replace docker system prune with targeted prune commands to prevent
accidental removal of external or freshly created networks while still
cleaning up unused containers, images, volumes and build cache.
This prevents CI images from exceeding GitHub Actions disk limits (~14 GB)
without breaking docker-compose networking.
https://chatgpt.com/share/69680011-fce0-800f-9af7-7989ad7771ed
Ensure LocalSettings.php exists as a file before docker compose up runs.
Otherwise Docker creates the bind mount path as a directory which breaks
MediaWiki bootstrap and causes run.php update to fail.
This guarantees a correct file bind-mount for /var/www/html/LocalSettings.php
and prevents template rendering into a wrongly created directory.
https://chatgpt.com/share/6967fdae-fc90-800f-88e8-23d54fa7f21d
- Add minimal nginx sidecar returning OK on root path for health checks
- Bind nginx explicitly to port 80 inside container
- Register web-svc-coturn localhost port (8064)
- Migrate stack usage from sys-stk-semi-stateless to sys-stk-full-stateless
- Normalize variable formatting and fix missing newlines
This enables a lightweight HTTP health endpoint alongside the Coturn service
for monitoring, probes and front-layer integration.
https://chatgpt.com/share/6967fa88-ee04-800f-a52a-47306a945528
kevinveenbirkenbach
dependabot[bot]