Introduce `system_service_run_final` to defer service execution until the end
of the play. Services marked with this flag are collected during setup and
executed later by the new `sys-service-runner` role.
Key changes:
- Add `system_service_run_final` flag to sys-service
- Automatically suppress flush for deferred services
- Collect deferred services into a final run list
- Introduce sys-service-runner role with per-unit rescue diagnostics
- Migrate health check services to deferred execution
https://chatgpt.com/share/6951921d-0c20-800f-8d42-1ff01a1f08ef
- replace pkgmgr-install with sys-pip-install for cleanback
- install cleanback as a regular pip package
- align roles with pyproject-based distribution
- keep system-wide, non-interactive installation semantics
https://chatgpt.com/share/69517d20-f850-800f-b6ff-6b983247888f
- switch compose volumes from /Backups to /var/lib/infinito
- add PATH_INFINITO_BACKUP_DIR and drop BACKUPS_FOLDER_PATH
- update backup provider permissions + cleanup service to use new path
- make pull-specific-host accept --folder and raise if no remote backups
- adjust unit tests accordingly
https://chatgpt.com/share/69515eed-001c-800f-b1da-aee8d8683e63
- replace legacy checkcsp CLI invocation with docker run
- add configurable CSP checker image and optional pull behavior
- update health script to build and execute docker commands
- pre-pull image during deploy when MODE_UPDATE is enabled
- clean up service ExecStart arguments and handle empty ignore lists
https://chatgpt.com/share/69514fa3-7eec-800f-8deb-ed07b6b6e1b6
- add `tokens` support to generated default_users
- normalize sys-token-store output variable to `sys_token_store_token`
- align Matomo role to new token-store interface
- reorder Matomo task files for clearer execution flow
https://chatgpt.com/share/69513d00-9a7c-800f-8b1f-5c31e0e21b75
- introduce global PATH_INFINITO_* secrets paths in group_vars
- replace BKP_DOCKER_2_LOC_DATABASES_CSV with PATH_INFINITO_DATABASE_SECRETS
- align sys-ctl-bkp-docker-2-loc and sys-token-store to shared secrets layout
- remove role-local defaults in favor of global path definitions
- drop outdated Nextcloud backup recovery docs
https://chatgpt.com/share/695132e1-1768-800f-b7e6-b72927f14b81
- Ensure secrets directory and databases.csv are created before service setup
- Remove permission handling on absent files
- Fix Ansible loop variable collision in baudolo command assertions
https://chatgpt.com/share/69512ac8-6054-800f-a5e3-103b8ab53bba
- Force sys-pip-install to use system python (/usr/bin/python3) instead of active venv
- Add explicit PATH for system-wide pip installs
- Add diagnostics task to verify installation context with system python
- Replace systemctl is-active check with Result/ExecMainStatus to correctly handle oneshot units
- Prevent false failures when oneshot services exit successfully
https://chatgpt.com/share/695123ba-8da4-800f-ae0d-2f09a5efb1e7
Ignore DL3008, DL3033 and DL3041 for the systemd/dbus installation step.
This image is used for multi-distro CI testing, where package version
pinning is neither portable nor desirable.
https://chatgpt.com/share/6950ffb3-1970-800f-9533-a115905ef6b7
The run_once integration test only detected short-form `set_fact`
and failed to recognize fully qualified module usage
(`ansible.builtin.set_fact`).
This caused false negatives for roles correctly using FQCN-compliant
Ansible syntax.
Fix:
- Accept both `set_fact` and `ansible.builtin.set_fact` when collecting
global run_once_<suffix> definitions
- Accept both forms when detecting per-role run_once definitions
- Remove redundant prefilter token, as structural detection is sufficient
No production logic is affected.
https://chatgpt.com/share/6950fe2c-4b24-800f-9f40-85b2fed3bfba
- Move databases.csv permission task from seed phase to core tasks
- Ensure root-only permissions are enforced early and unconditionally
- Remove custom run-once logic and related state tracking
- Simplify role logic and improve determinism
- Update run-once integration test documentation and expectations
- Add TODO to verify Docker-in-Docker behavior
- Refactor sys-service handler to use include_tasks for better structure
- Add robust systemctl restart diagnostics based on exit code (is-active)
- Ensure systemctl status and journalctl output are shown before failing
- Prevent premature handler failure by making systemd restart non-fatal
- Minor style cleanup in filter plugin (PEP8 / quoting)
https://chatgpt.com/share/6950f59e-d6cc-800f-9981-f9af4cbb5590
- Install systemd and dbus in Docker image for CI service tests
- Run systemd as PID 1 with proper container conventions
- Mark container environment explicitly via ENV container=docker
- Simplify container detection to rely on explicit env flag
- Skip host-only tasks (timezone, systemctl handlers) inside containers
- Adjust docker-compose runner for privileged systemd execution
- Reduce CI parallelism to avoid OOM kills
This makes systemd-based Ansible roles reliable in Docker/CI
and avoids fragile virtualization heuristics.
https://chatgpt.com/share/6950110b-111c-800f-bbcd-83a551d5a3b8
Limit Gitea's database connection pool by setting
MAX_OPEN_CONNS, MAX_IDLE_CONNS and CONN_MAX_LIFETIME
using GITEA__database__* environment variables.
This prevents MariaDB connection exhaustion caused by
unbounded idle connections under heavy browsing or
crawler-like access patterns.
https://chatgpt.com/share/694e2f80-f1e0-800f-b0b5-d42d4121f367
Switch CI deploy tests from docker run to docker compose with a long-lived
infinito service. The container now uses `tail -f /dev/null` as command to
prevent restart loops caused by the default `infinito --help` CMD, which
previously killed exec processes with exit code 137.
Changes include:
- make infinito a stable exec target in compose (no premature restarts)
- add compose helpers (build/up/exec/down) to deploy.sh
- move inventory creation and dedicated deploy into the running container
- add conditional cleanup via EXIT trap (keep stack on failure for debugging)
- support per-distro container naming via INFINITO_DISTRO
This stabilizes CI runs and makes debugging failed deploys possible.
https://chatgpt.com/share/694d3f99-07e4-800f-bc05-3a60c902064d
- introduce CoreDNS service behind CI profile
- route CI containers via fixed DNS (172.30.0.53)
- add CoreDNS Corefile for docker.test and external forwarding
- make infinito image distro-selectable via INFINITO_DISTRO
- align volumes, env, and networking for CI runner
https://chatgpt.com/share/694d1f08-9794-800f-b1ff-548e9e6c500f
Move distribution-aware OpenSSH client installation into a dedicated
sys-svc-ssh system service role. Replace inline package installation
in pkgmgr and user-root with role inclusion and shared run-once logic
to improve reuse, consistency, and maintainability.
- move distro-aware docker CLI installation into shared install-cli.sh
- use install-cli.sh only in Dockerfile (container context)
- install docker engine and compose only on hosts via Ansible
- guard engine installation with DOCKER_IN_CONTAINER
- avoid mixing Docker Inc. repo with Debian docker.io packages
https://chatgpt.com/share/694c3985-f228-800f-ac5c-b0ae41558596
* Set Matomo `trusted_hosts[]` to include both `{{ domain }}` and `{{ DOCKER_REACH_HOST }}:{{ http_port }}` (idempotent)
* Add `http_port` var for reuse
* Switch `MATOMO_INDEX_PHP_URL` to local reach URL to make API calls reliable on localhost
https://chatgpt.com/share/694c1e06-fcac-800f-9c03-d92a150a4c73
- derive internal email domain with .localdomain fallback for localhost
- ensure valid email domains for local installations
- remove hardcoded administrator emails from all roles
- prepare roles to consume centrally defined system email settings
https://chatgpt.com/share/694c05d5-e8c0-800f-8d86-602aaa82be21
Wrap Matomo bootstrap in block/rescue to capture failures and
dump docker-compose.yml, effective compose config, and env files.
Env files are only shown when MASK_CREDENTIALS_IN_LOGS is false.
https://chatgpt.com/share/694bde08-a72c-800f-9ac3-a8aa9aef3bde
- Use service-based MATOMO_URL inside compose network
- Provide fully qualified MATOMO_SITE_URL (incl. scheme) for installer
- Align vars with dynamic service naming
- Prevent Playwright installer failures due to invalid URLs
https://chatgpt.com/share/694bd2bf-353c-800f-a0cc-0e4d9f2e550f
* add token configuration and bootstrap service to role config
* introduce dedicated bootstrap env file wired via env_file override
* replace nix/playwright-based installer with one-shot compose bootstrap
* determine bootstrap need based on config.ini.php and token presence
* move post-install API configuration into separate task file
https://chatgpt.com/share/694bcac4-1a00-800f-9aff-dbcd9a2003dc
Enable docker_compose_env to explicitly override the env_file used by
docker-container base template. Falls no override is provided, the
existing application_id-based env resolution remains unchanged.
https://chatgpt.com/share/694bc569-1778-800f-8039-9da09fcd438b
Add new sys-token-store role to manage per-user, per-app tokens in a single
on-host YAML store.
- Store tokens under /var/lib/infinito/secrets/tokens.yml
- Map users to multiple app tokens (users → tokens → app)
- Ensure secure directories and file permissions
- Load and persist token store server-side (slurp + copy)
- Idempotent token creation and merging
- Generate tokens when missing
- Export resolved token for downstream roles
Constants are defined uppercase, runtime variables lowercase.
https://chatgpt.com/share/694bb78b-45e4-800f-879c-82c11a1b8d0b
kevinveenbirkenbach
dependabot[bot]