Moodle 5 keeps AI provider settings in provider instances, not in the
plugin configuration. The deploy kept writing aiprovider_openai/* through
cfg.php and read the same value back, so its own check stayed green while
no provider existed. The gateway spec then found no settings page and
web-app-moodle#2 failed in run 37646050826.
The deploy now pipes files/php/provision_ai_gateway.php into the
container. It finds the instance by class and name or creates it through
core_ai\manager, points the three text actions at the chat endpoint,
switches image generation off, stores the virtual key and prints what
Moodle stored. The task asserts on that output. An instance an
administrator added is left alone.
The spec finds the instance by MOODLE_AI_PROVIDER_NAME on the providers
page and reads the endpoint from its generate_text action page.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Requirement for a web-app-worldmonitor role: the upstream four-service
stack (dashboard, AIS relay, Redis, REST proxy) behind the platform's
Keycloak login through oauth2-proxy, in compose and in swarm.
It records what the upstream self-hosted mode offers and lacks, eleven
proposed decisions the operator has to confirm before implementation,
the target role layout and the acceptance criteria.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The cache-less rebuild is the fallback for a build whose spaced retries
are exhausted. It ran once, so one more registry timeout turned a
transient network failure into a failed deploy. Both the compose and the
swarm handler now retry it three times, 30 seconds apart, like the build
they back up.
Closes#620
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The entrypoint runs the installer and the cache commands as root. They
create logs/prod, and the entrypoint handed cache and public/legacy back
to the web user but not logs. Apache could not write there, so SuiteCRM
wrote neither its auth.log nor its main log.
The entrypoint now hands logs to the web user after the root-run console
commands, on every boot that holds the boot lock, so volumes of earlier
deploys are repaired too. The deploy fails if a path under logs is not
writable for the web user.
Closes#854
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Dependabot alerts 12 and 13 name postcss-selector-parser and
source-map-js in the root lock file. Both reach the project through
stylelint. The lock now holds postcss-selector-parser 7.1.6 and
source-map-js 1.2.2, the first releases outside the advisories.
Alert 11 on braces stays open, no fixed release exists.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
n8n 2 installs its dependencies as a strict pnpm tree, so the hook's
require('router/lib/layer') and require('bcryptjs') no longer resolve
from the hook file. The n8n.ready hook failed with "Cannot find module
'router/lib/layer'", n8n exited, and the deploy ran into the timeout of
the readiness check. The hook now resolves both through n8n's own
module, the router by way of express.
A user's role is a relation in n8n 2. The hook loads it together with
the user, since the role check refuses an account without it, and
creates a new account with the role as an object, the shape n8n's own
SSO code passes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The entrypoint removed the old tree before it copied the new one. A
copy that failed left the volume without a working Moodle, and every
restart removed again instead of recovering. It now copies into a
staging directory inside the volume and swaps the trees once the copy
is complete, so a failed copy leaves the old tree in place.
An image that ships an older release than the volume records no longer
replaces it and exits with a message instead. Two instances on
different releases would otherwise overwrite each other's tree.
upgrade.php reports "No upgrade needed" on stderr, so the task counted
every run on a current site as a change. It reads stderr now.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The indexer entrypoint is now only our CA-import block followed by exec of the image's own /entrypoint.sh, mounted at /infinito-entrypoint.sh with an explicit command. The certs entrypoint is our own script: it downloads the cert tool only from packages.wazuh.com and fails if that download fails, so there is no silent fallback to the dev bucket. The manager node name is passed in as WAZUH_MANAGER_NODE for both compose and swarm.
WAZUH_CERTS_TOOL_VERSION was a literal in vars/main.yml. It now reads the manager image version from meta/services.yml and keeps major.minor (4.14.6 gives 4.14), so it follows the Docker updater and needs no separate pin.
bcrypt_hash takes an optional salt_seed. Without a seed it keeps the random salt. With a seed the salt is derived from the seed and the secret, so the same password always gives the same hash. Wazuh passes a fixed seed for the indexer admin and the dashboard service hashes, so internal_users.yml no longer changes on every run and no longer triggers a restart.
The manager and the indexer do not set bootstrap.memory_lock, so memlock -1 is not needed and would let a leaking process pin all host RAM. nofile stays: it is a per-process limit and OpenSearch needs a high file-descriptor limit.
Wait for the security-dashboards-plugin roles API response and assert 200 for the admin tier and 403 for the other tiers, with the role list and create-role button checked on the page. Navigate with gotoOnion so the test works over Tor.
The Ace editor overlays its hidden textarea and intercepts pointer events, so the click never reached the input. Focus the editor and let a failure show up instead of swallowing it.
529c5ace4 placed INFINITO_SWARM_SSH_UNDERLAY after
INFINITO_SWARM_STEP_TIMEOUT_MINUTES and gave it a 178-character comment. The
env-file schema caps a comment at 140 and the sort gate wants ASC order; both
only surfaced once the suite ran against the merged tree.
One conflict, in the generated role overview table of README.md.
Both sides had edited the same block. Upstream dropped Redis from the pihole
row; this branch still listed it. Upstream also listed svc-net-wireguard-core,
-plain and -firewalled, which this branch removed in e706170a0b as superseded
by the unified svc-net-wireguard role.
Resolved by taking upstream's block and then running `make readme-index`, so
the table is generated from the roles that actually exist rather than
hand-merged: Redis is gone from pihole, the three legacy WireGuard roles stay
gone, and svc-net-wireguard is listed once. `make readme-index check=true`
reports the table up to date.
Git kept the role deletions silently and correctly - upstream has not touched
those three directories since the merge base, so there was no modify/delete
conflict to resolve.
