Apply TESTED_LIFECYCLES filtering directly in the deploy test runner so roles
with unsupported lifecycles (e.g. pre-alpha) are excluded consistently for
both workstation and server workflows.
This prevents roles like desk-copyq (lifecycle: pre-alpha) from being deployed
in CI unless explicitly enabled via TESTED_LIFECYCLES.
https://chatgpt.com/share/6963e316-0a50-800f-a895-8828269a0ca3
- Add global_install flag to sys-pip-install role (default: false)
- Allow optional system-wide installs via pip3 with --break-system-packages
- Install python-ldap via pip in Ansible interpreter for OpenLDAP role
- Refactor svc-db-openldap tasks into 01_core.yml with run-once gating
- Fix environment handling for conditional global pip installs
- Enable global pip installs for CLI tools (gitcon, ldapsm, backup tools, cleanup tools)
https://chatgpt.com/share/6963dd5d-cae0-800f-b8d7-82a3808be634
Use a short, stable container hostname derived from the entity name and move the
public FQDN to a dedicated domain variable. This prevents DNS suffix expansion
(e.g. postgres.<domain>) inside the container and avoids accidental resolution
to localhost.
- Introduce entity_name and domain variables
- Set container hostname to entity name instead of FQDN
- Use CHESS_DOMAIN for APP_DOMAIN instead of container hostname
https://chatgpt.com/share/6963c02c-8754-800f-8b7b-b7be99319009
Retry systemd service start/restart up to 10 times with a 60s delay before
entering the rescue diagnostics block. This improves robustness for services
with delayed dependencies (e.g. compose-managed containers with health checks).
- Add default status codes (403, 200) for web-svc-html to reflect missing index.html on init
- Normalize YAML formatting and ensure trailing newlines
- Fix integration test formatting for config generation
- Align vars indentation with project style
https://chatgpt.com/share/6963a552-9580-800f-b6f2-2547959d9dc8
- Allow credentials generator to run for roles without schema/main.yml so
transitive config-based generation still works.
- Make InventoryManager resilient to missing YAML by defaulting to {} and
only loading schema when schema/main.yml exists.
- Add recursive shared-provider include resolution based on docker.services
config and apply provider schemas/special rules transitively.
- Require database_password injection only when database.enabled=true and shared=true.
- Update unit/integration tests to create required files for .exists() checks and
validate transitive provider role credential generation.
https://chatgpt.com/share/69639d93-4c10-800f-bc6c-8e5b9fb75088
The test suite intentionally modifies PYTHONPATH to import the role-local script
module. Suppress ruff E402 for this specific import to keep linting strict
everywhere else while documenting the exception.
https://chatgpt.com/share/69637f6e-5370-800f-806f-d5d0820c005f
Update unit tests to:
- Add role files directory to PYTHONPATH for importing script.py
- Assert SystemExit and exit codes instead of mocking sys.exit
- Ensure run_checker is not called when no domains or config dir is missing
- Keep existing behavior and expectations intact
This makes the tests robust and prevents false positives caused by mocked sys.exit continuing execution.
https://chatgpt.com/share/69637cc6-c1d0-800f-a196-df86ccbaee14
Add disk usage diagnostics and aggressive Docker cleanup between
sequential distro deploy runs to prevent runner disk exhaustion.
- Log disk and Docker usage before and after each deploy
- Preserve stack on failure for debugging
- Prune images, volumes and build cache only on success
https://chatgpt.com/share/69637278-7aa0-800f-a492-7be95f5e8605
Run the CSP checker container with --network host by default so localhost and
internal vhosts are reachable when executed inside Docker-in-Docker setups.
Adds:
- Optional --no-host-network flag to disable host networking
- Extended docker command builder with host network support
- Unit tests for domain extraction, docker command generation, and CLI behavior
This ensures CSP health checks work reliably for services bound to the
parent container's network namespace.
https://chatgpt.com/share/69630726-4514-800f-b350-61ae7a4010b1
Replace distro-specific python-psycopg2 package with psycopg2-binary installed
via ansible.builtin.pip to ensure the PostgreSQL modules work with the active
Ansible Python interpreter (e.g. Infinito venv) across all distros.
https://chatgpt.com/share/6962ff13-afa0-800f-93a1-9b0d306d98e2
Stop cleanup script from busy-looping when disk usage is above threshold but no
backup versions exist by breaking early when average_version_directories == 0.
Add unit tests to verify:
- script exits immediately when disk usage is below threshold
- script breaks safely when disk usage is high but no backups are present
This prevents CI hangs and excessive CPU usage caused by infinite iterations.
https://chatgpt.com/share/6962de45-3750-800f-bc8d-5ba205beeaaf
- Move generate_value/generate_secure_alphanumeric out of InventoryManager into new ValueGenerator
- Wire InventoryManager to use self.value_generator for all secret generation
- Tighten schema include logic for shared databases: require enabled=true and shared=true
- Update unit tests to patch ValueGenerator.generate_value instead of InventoryManager.generate_value
- Add end-to-end integration test for InventoryManager using real files and a fake VaultHandler
- Remove redundant legacy unit test file and add dedicated ValueGenerator unit tests
https://chatgpt.com/share/6962d2e6-7fdc-800f-ba83-9e150b19a5f0
Add TimeoutStartSec and RuntimeMaxSec to the sys-ctl-cln-bkps systemd unit when
running in Docker-in-Docker debug mode to avoid hanging GitHub Actions runners
and get deterministic failure behavior.
Also make the ExecStartPre timeout configurable via SYS_TIMEOUT_BACKUP_SERVICES.
https://chatgpt.com/share/6962de45-3750-800f-bc8d-5ba205beeaaf
Extend credentials generator to include schemas for shared provider roles
(OpenLDAP, Keycloak, Matomo, and svc-db-<type>) based on docker.services.*.shared
flags in role config. Credentials are now emitted/added for all involved
applications while preserving existing inventory formatting, and CLI overrides
can target specific apps via applications.<app>.credentials.<key>.
- Replace direct docker compose up with python-based orchestrator (Compose.up)
- Centralize stack startup, systemd readiness wait, and init logic in Compose.up
- Run container init via scripts/docker/entry.sh instead of make target
- Remove duplicate systemd wait in deploy test runner
- Add cli.deploy.test.up entrypoint for make up integration
https://chatgpt.com/share/6962a2c8-0f50-800f-8bfb-2efd16adaf40
Replace legacy feature flags (features.central_database, features.oauth2) with
docker service based configuration:
- docker.services.database.shared
- docker.services.oauth2.enabled
Update InventoryManager logic accordingly and adapt all unit tests to mock
the new config structure.
This ensures inventory generation now follows the canonical docker service
configuration model.
https://chatgpt.com/share/69628906-5efc-800f-999b-2ae3ece1907f
Use system-wide pip3 for package installation to avoid installing CLI tools
into the Ansible virtualenv. This ensures binaries (e.g. dockreap) are placed
in a global PATH and are usable by systemd services.
https://chatgpt.com/share/69628897-4d98-800f-b4cf-b9a8f5fdaa6b
Ensure that localhost inventories always define ansible_python_interpreter when using
ansible_connection=local. This prevents Ansible from falling back to interpreter
auto-discovery (interpreter_python=auto_silent), which could select unexpected Python
binaries inside containers (e.g. /usr/sbin/python3.13) and break module execution.
The interpreter is now pinned to $PYTHON if set, otherwise to sys.executable.
https://chatgpt.com/share/69628603-3e18-800f-a6f9-2b367728a9ff
Ensure stdout is captured when calling run_after_resolution inside the infinito
container so declared galaxy_info.run_after deps (e.g. matomo, mailu) are
correctly detected and added to deploy_ids.
https://chatgpt.com/share/69617fbb-5af4-800f-848d-edeb2c1125a8
Install Ansible collections from requirements.yml into ~/.ansible/collections
so they are available for all Infinito.Nexus environments of the user and
independent of the active Python virtualenv.
https://chatgpt.com/share/69615ab0-2cfc-800f-9466-cf9a9a57b3da
Replace removed community.general.yaml callback with ansible.builtin.default
and enable YAML output via callback_result_format to stay compatible with
ansible-core >= 2.13 and community.general >= 12.
https://chatgpt.com/share/69615ae5-bb70-800f-8227-a4ad389dfd32
Install Ansible collections via ansible-galaxy into the default user scope
(~/.ansible/collections) instead of a repo-local ./collections directory.
This avoids path/config issues with ANSIBLE_CONFIG and makes collections
available consistently for venv and non-venv executions.
https://chatgpt.com/share/69615ab0-2cfc-800f-9466-cf9a9a57b3da
Refactor Makefile deploy tests so that test-deploy orchestrates per-app runs
by delegating to the new test-deploy-app target.
- Add test-deploy-app target for running deploy tests for a single app
- Refactor test-deploy to discover apps and call test-deploy-app per app
- Avoid duplicated act invocation logic
- Keep serial, fail-fast execution semantics
Usage:
make test-deploy
make test-deploy-app APP=web-app-nextcloud
https://chatgpt.com/share/6961152f-5760-800f-86c8-3b98d3fedc34
kevinveenbirkenbach