- Restrict pacman-based Nix install to Arch Linux x86_64 only
- Use official Nix installer as fallback on ARM and other platforms
- Prevent sudo usage on localhost when fetching installer checksum
- Align README with actual online, verified installer behavior
https://chatgpt.com/share/695e483c-1f68-800f-9f94-87d5295b871d
- introduce configurable mail timeout for msmtp and postfix
- switch health-check mails to local recipients instead of external addresses
- consolidate postfix setup into sys-svc-mail-smtp role
- add proper alias deployment and database generation (lmdb)
- fix relay access denied by enabling local delivery and aliases
- remove deprecated sys-postfix role to avoid configuration conflicts
https://chatgpt.com/share/695e2301-eaf0-800f-8e98-8c602c50d55c
- Replace clean-container with compose down for predictable teardown
- Add explicit up/down targets to Makefile
- Sync bind-mounted source into internal repo using rsync --chown=root:root
- Prevent git dubious ownership errors in CI containers running as root
https://chatgpt.com/share/695d7045-a1f8-800f-83d0-f5872d85cfcf
- Run failed-backup cleanup at 04:00 to avoid overlap with regular backup jobs
- Add explicit timeout and single-worker defaults for large/slow storage
- Align role defaults with cleanback 1.3.0 safety semantics
- Clarify force-keep behavior and failure handling in role README
https://chatgpt.com/share/695d39c5-3390-800f-81b1-10f0f04e1b42
* Introduce lifecycle gating to CI deploy tests
* Only allow roles with tested lifecycles (alpha, beta, rc, stable)
* Automatically exclude roles with untested or missing lifecycle metadata
* Simplify static BASE_EXCLUDE by relying on lifecycle filtering
https://chatgpt.com/share/695d16d9-e210-800f-92d7-a1a429644be2
- Introduce meta roles lifecycle_filter CLI to select roles by lifecycle
- Support whitelist/blacklist modes, selection filtering, and auto-detected roles dir
- Fix blacklist handling for roles with missing lifecycle
- Forward --help correctly to subcommand argparse
- Add unit tests for lifecycle filtering logic
https://chatgpt.com/share/695d09d2-c864-800f-9e23-b9db0c6f3537
* update test-deploy-workstation workflow to use make clean-container and make test-deploy with TEST_DEPLOY_TYPE=workstation
* extend Makefile test-deploy to accept TEST_DEPLOY_TYPE (default server) and pass it through to scripts/tests/deploy.sh
* note: add missing newline at end of test-deploy-workstation.yml to avoid diff noise
* Replace heredoc-based Dockerfile logic with printf to avoid silent build failures
* Ensure superadmin credentials are reliably written into xwiki.cfg at build time
* Introduce shared REST session task to fetch JSESSIONID and XWiki-Form-Token
* Use cookie + CSRF token headers consistently for all REST write operations
* Switch uri auth parameters to url_username / url_password for clarity and consistency
* Normalize internal URLs via XWIKI_DOCKER_REACH_URL
* Make extension install, admin setup, and cleanup idempotent and reliable
https://chatgpt.com/share/695c1c63-0218-800f-ba36-f7640b0d1f2f
* Delete ci-publish.yml which relied on workflow_run and skipped publishing on test failures
* Ensure images are built and published directly on version tag pushes
* Keep stable tagging gated by successful code analyses only
https://chatgpt.com/share/695be89a-6f30-800f-bee4-40cfd4ef6263
- Always build and publish Docker images for v* tags (version + latest),
independent of test results
- Run full code analyses in parallel and only mark Git + container :stable
when all checks succeed
- Replace rebuild-on-stable with pure imagetools retagging (no rebuild)
- Prevent race conditions by ordering stable tagging after image publish
- Ensure latest always tracks the most recent version image
https://chatgpt.com/share/695bdfa5-dbe0-800f-bb1c-4fe81eba6058
- Ensure Matomo is bootstrapped when API token is missing, even if already installed
- Make Matomo load conditional on reachability and token availability
- Move run-once flag in sys-token-store to ensure proper token hydration
- Improve trusted_hosts patching to include service and Docker reach host
- Clean up redundant conditions and minor task inconsistencies
https://chatgpt.com/share/6957bc5f-ff70-800f-a3bd-c4cf2518a336
- Include sys-token-store as a dependency for frontend injections
- Make Matomo loading conditional on reachability or missing token
- Handle undefined reachability checks conservatively
- Remove redundant empty-token validation spacing
- Ensure deterministic and idempotent Matomo bootstrap behavior
https://chatgpt.com/share/69579627-1b40-800f-971b-039bc8dc413b
- Detect broken yay binaries via ldd (missing shared libraries)
- Remove stale /usr/bin/yay to force a clean rebuild
- Ensure build prerequisites (git, base-devel, patch) are installed
- Harden yay build with strict shell flags
- Normalize task formatting and quoting
https://chatgpt.com/share/6955615b-63b8-800f-b365-0060bad50609
- Migrate Mailu credentials from legacy mailu_token to tokens['web-app-mailu']
- Update all affected application templates to use the new token structure
- Adjust inventory validation to no longer special-case mailu_token
- Minor typing and formatting cleanups in inventory creation and tests
https://chatgpt.com/share/69554915-87c8-800f-afd5-12118dbb1107
Add a validation guard after token store inclusion to abort execution
when users.administrator.tokens['web-app-matomo'] is empty or whitespace.
This prevents silent Matomo API failures caused by misconfigured tokens.
https://chatgpt.com/share/69552203-4f40-800f-94b1-7ce54ca81d0a
**Body**
* add sys-token-store filter plugin to hydrate users.*.tokens from persisted store (users win if non-empty)
* load token store during sys-token-store core run and inject hydrated tokens into users fact
* remove legacy lookup task and simplify docs + store path naming
* switch Matomo frontend injection to use hydrated users.administrator.tokens[web-app-matomo] directly
* ensure Mailu token handling uses sys-token-store write task and checks token presence via users.*.tokens
* add unittest for token hydration filter plugin with path-based module loading
* Move SSH key handling to users.<name>.authorized_keys (list-only) and write keys via shared user role
* Enforce at least one SSH key for administrator user
* Wrap backup user keys with restricted command wrapper before writing authorized_keys
* Remove legacy inventory file copy and CLI flag/function for administrator authorized_keys
* Extend user setup generator to include authorized_keys field
* Rename administrator scripts path to root scripts path and update dependent variables
* Update inventory sample and docs to reflect new SSH key workflow
https://chatgpt.com/share/695510b8-23f4-800f-b5db-877b07a1469b
kevinveenbirkenbach