- Move INFINITO_IMAGE and INFINITO_PULL_POLICY handling into Makefile
- Auto-configure CI vs act via IS_ACT switch
- Remove duplicated env exports from test-deploy workflows
- Ensure compose uses pulled CI images in GitHub Actions
- Keep local act builds using locally built images
This makes CI behavior deterministic while keeping local test runs fast and simple.
https://chatgpt.com/share/69665ae7-37f4-800f-b287-e095714e80a4
Let the Makefile auto-detect act vs GitHub Actions and set INFINITO_PULL_POLICY
accordingly (never for act, always for CI).
This removes redundant INFINITO_PULL_POLICY exports from test-deploy workflows
and centralizes the logic in the Makefile.
Result:
- GitHub Actions always pulls CI images
- act/local runs use locally built images
- no workflow duplication
https://chatgpt.com/share/69665ae7-37f4-800f-b287-e095714e80a4
- Add reusable build-ci-images workflow to build and push ci-<sha> images for all distros
- Make all deploy test workflows use prebuilt CI images (no local rebuilds)
- Replace ci-version workflow with release workflow
- Retag ci images to <version> and latest on tag push (no rebuild)
- Move stable git tag only if all analyses/tests succeed and version is highest
- Make compose image/pull policy configurable via env
https://chatgpt.com/share/69662869-ee1c-800f-9e6c-bbbf47284fad
Replace inline tail logic in deploy workflows with a shared
scripts/ci/log-tail.sh helper that prints the last N lines of all
log files on failure.
This improves debuggability, avoids code duplication, and ensures
consistent log output across server, universal and workstation
pipelines.
https://chatgpt.com/share/69661d0e-81a8-800f-8b98-6c964672d027
Refactor server, universal-rest, and workstation deploy workflows to:
- add a dedicated discover job that outputs the app list
- run one matrix job per app (one runner per app)
- remove bash loop over apps
- upload logs per app artifact
This enables parallel per-app deployments and clearer failure isolation.
https://chatgpt.com/share/6965ccdc-ed44-800f-b1e8-f0071db6dd07
Migrate `svc-db-openldap` from `bitnamilegacy/openldap` to a locally built `infinito/openldap:local` image (Debian bookworm-slim) with a bootstrap `entrypoint.sh` that initializes `slapd.d` and an MDB backend from `LDAP_SUFFIX/LDAP_ROOT_DN/LDAP_ROOT_PW`.
* Add Dockerfile + entrypoint + healthcheck scripts
* Persist config + data in separate volumes (`/etc/ldap/slapd.d`, `/var/lib/ldap`)
* Switch cn=config operations to `ldapi:///` with SASL EXTERNAL (`-Q -Y EXTERNAL`)
* Simplify env template to only `LDAP_SUFFIX`, `LDAP_ROOT_DN`, `LDAP_ROOT_PW`
* Refactor docker init into `02_docker.yml` and update compose template (build context)
* Update LDAP tasks/handlers to use `OPENLDAP_BIND_DN/OPENLDAP_BIND_PW`
* Remove outdated Bitnami-specific docs and credential reset logic
https://chatgpt.com/share/6965c921-3304-800f-9e8f-d2f10d273f1b
Exclude the .github directory from template/YAML scanning to avoid
false positives from GitHub Actions expressions. Directory exclusion
is now centralized via EXCLUDE_DIRS and respects EXCLUDE_TESTS.
https://chatgpt.com/share/6965b7a8-8084-800f-a8b5-446f265d5bf2
- Rename _deploy-matrix.yml -> _deploy-per-app.yml and drop unused inputs
(tested_lifecycles, only_distro, final_exclude_re).
- Keep one runner per app (matrix.app) and run all distros inside that job.
- Makefile: run deploy tests through act workflow_dispatch (no serial script).
- Add scripts/ci/discover.sh and scripts/ci/deploy-one-app.sh as small SRP helpers.
- Update reusable workflow callers to use the renamed file.
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
- Add reusable _deploy-matrix workflow with discovery + per-app deploy across distros
- Enforce serial execution via strategy.max-parallel=1 and act --concurrent-jobs 1
- Support filters: mode (server|workstation|rest), only_app, only_distro, include/exclude regex
- Refactor test runner: remove discovery, require --app, deploy single app with deps only
- Generalize discover script to discover-apps.sh with INCLUDE_RE/EXCLUDE_RE + lifecycle gating
- Update Makefile targets to drive workflow_dispatch inputs for local act runs
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
Disable the Mailu webmail healthcheck when MODE_TEST is enabled to avoid
local AppArmor and startup timing issues on Manjaro during act-based CI
runs. This keeps production and GitHub CI behavior unchanged while
allowing reliable local testing.
Also introduce MODE_TEST flag in inventory and modes configuration.
https://chatgpt.com/share/6965806a-daa0-800f-ad9a-28ddf1c8eabc
Remove async execution from systemd daemon reload/reexec handlers to avoid race
conditions when starting freshly deployed units.
Also add support for ExecStartPost in sys-ctl-alm-compose service templates to
allow post-start success hooks.
This prevents timing issues where template services were started before systemd
had fully reloaded unit definitions.
https://chatgpt.com/share/6965754a-ac94-800f-b25c-7a07c8d33d1a
Bitnami OpenLDAP images do not allow write access to cn=config via
SASL/EXTERNAL (peercred), even when executed as root. This caused
"Insufficient access (50)" errors during module, overlay and password
configuration.
Switch all cn=config modifications (modules, overlays, olcRootPW) to
simple bind authentication using the configuration admin DN and password.
This makes LDAP provisioning reliable across all distros and CI runners.
https://chatgpt.com/share/696574b0-ebac-800f-aee6-dfd9b27d74cd
Split LDAP configuration into separate enabled and shared flags and compute a
dedicated load condition (enabled && shared) at runtime.
This ensures the OpenLDAP provider stack is only loaded when explicitly enabled
for the application and marked as shared, preventing unintended global LDAP
initialization.
Also fixes incorrect use of docker.services.ldap.shared for the enabled flag.
https://chatgpt.com/share/69657460-7768-800f-9768-f886acfb3eb5
Add conditional debug output in constructor stage to display all Ansible
group memberships of the current host when MODE_DEBUG is set. This helps
with inventory, persona, and stack debugging.
https://chatgpt.com/share/696567d5-9808-800f-b3fc-75080cb7d422
Add support for ignoring individual run_once_* when-conditions if the same
line contains the marker comment:
# pass test_run_once_suffix_matches_role
This allows intentional cross-role run_once usage (e.g. shared provider
roles) without weakening the global schema enforcement.
Also document the exception behavior directly in the test.
https://chatgpt.com/share/69653e36-c058-800f-921d-b4af9014df04
fix(openldap): make memberof/refint provisioning idempotent and robust
Refactor OpenLDAP cn=config provisioning:
- load memberof and refint modules via ldapmodify
- add overlays via ldapadd with proper error handling
- make handlers idempotent (ignore duplicate/value-exists errors)
- dynamically resolve module DN and data backend DN (mdb/hdb)
- clean up legacy LDIF definitions
This fixes rc=80 handler failures and allows safe re-runs.
https://chatgpt.com/share/69653e42-e020-800f-a6c3-9c37ec5e8028
Move the OpenLDAP include_role into a block so the when-condition is evaluated
before application_id is overridden for the svc-db-openldap role.
This prevents the stack-level LDAP enable flag from being affected by the
role-local application_id override.
https://chatgpt.com/share/696534f6-b314-800f-8e41-75165712b0f9
- Extract wireguard setup, firewall rules and service logic into 01_core.yml
- Introduce run-once guard via utils/once/flag.yml
- Disable execution when running inside Docker-in-Docker CI containers
https://chatgpt.com/share/69652efc-3a20-800f-a724-f4a712904ea6
Install distro-specific OpenLDAP, SASL, SSL, libffi and build toolchain packages
(Arch, Debian/Ubuntu, Fedora/CentOS) before installing python-ldap to ensure the
module can be built and imported in the Ansible runtime.
https://chatgpt.com/share/6964335a-29cc-800f-ae65-6a35c7cd2559
Use ansible_python_interpreter-derived virtualenv for pip installs by default and
only use system pip3 with --break-system-packages when global_install=true. This
ensures Ansible module dependencies (e.g. python-ldap) are available in the
runtime interpreter.
https://chatgpt.com/share/6964335a-29cc-800f-ae65-6a35c7cd2559
* Replace legacy task chain with unified 01_core pipeline guarded by run_once
* Remove load_dependencies flag and always provision full stateful stack
* Drop meta/dependency helper tasks in favor of sys-stk-full-stateful
* Rename login task for consistent ordering
* Introduce LDAP shared gating (enabled + shared)
* Simplify main task entrypoint to core loader
https://chatgpt.com/share/69642f37-15d4-800f-a227-819bd0f4963d
* Move top-level features flags to docker.services.<feature>.enabled
* Replace features.local_ai with docker.services.ollama.shared for central AI networking
* Switch central LDAP network gating from docker.services.ldap.enabled to docker.services.ldap.shared
* Add per-app service feature entries like css, javascript, hcaptcha, recaptcha under docker.services
* Update Gitea to use derived GITEA_LDAP_ENABLED and adjust IAM conditions
https://chatgpt.com/share/69641f2f-5d6c-800f-8927-fdb3580e7964
* Switch feature flag paths from docker.service.<name>.enabled to docker.services.<name>.enabled
* Update CSP builder and smart-default toggles and unit tests
* Update desktop cards iframe flag and desktop domain validation
* Update logout domain filter and tests
* Update recaptcha enable flags in Keycloak and EspoCRM
* Fix sys-ctl-cln-docker meta description formatting
* Follow-up: reorder imports in web_health_expectations so module_utils path injection runs before importing get_app_conf
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
- Update CSP smart-default toggles to use docker.service.<feature>.enabled
(matomo, simpleicons, recaptcha, hcaptcha, logout, desktop)
- Refactor inj_enabled filter to resolve docker.service.<feature>.enabled only
- Migrate inj_enabled unit tests to the new flag layout
- Normalize and reformat CSP test fixtures for readability and consistency
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
Introduce uid and gid fields for manually created users in inventory.sample.yml.
Document the recommended ID range (10000+) for manual users while reserving lower
ranges for auto-created Infinito.Nexus users. Also add placeholders for roles,
tokens, and authorized_keys.
https://chatgpt.com/share/6963f635-8644-800f-a6fc-e5713ddcd2a3
- Switch CSP smart-default toggles to docker.service.<name>.enabled flags
(matomo, simpleicons, recaptcha, hcaptcha, logout, desktop)
- Update CSP header logic docs/comments to match new flag layout
- Split large CSP filter unit test into focused test modules for clarity
- Add coverage for service toggle behavior, determinism, union rules, and hash guards
https://chatgpt.com/share/6963f484-4cb4-800f-a9f4-8d70a66e4d32
kevinveenbirkenbach