X.509 limits commonName to 64 characters, and openssl refuses a longer
one while generating the CSR:
ASN1_mbstring_ncopy:string too long:../crypto/asn1/a_mbstr.c:106:maxsize=64
The global leaf builds its CN as `<DOMAIN_PRIMARY upper> Global TLS`, so
any primary domain longer than 53 characters fails the deploy in
sys-front-tls-selfsigned. Worktree stacks hit it first: their domain is
derived from the branch name (`fix-security-exec-argv-secrets-store-1153
.infinito.test` gives a 66 character CN).
The CN is now truncated to 64 characters in all three branches (global,
explicit subject CN, per-app primary domain). Clients verify the SAN
list, not the CN, so a truncated CN changes nothing for them, and an
existing certificate is only regenerated on SAN drift, as before.
sys-ca-selfsigned already caps the root CA's CN.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
On a fresh Fedora dev container lint-mermaid failed most files with
ConnectionClosedError: the browser aborted with
`FATAL:third_party/skia/src/ports/SkFontMgr_FontConfigInterface.cpp:163]
Not implemented.` in its font fallback, because the host had no font at
all. install-lint provisions the browser's libraries by soname on dnf,
yum and pacman, and a font is not a soname; apt-get gets fonts through
puppeteer's --install-deps.
It looked load-dependent because lint-packages installs rpmlint in the
same parallel phase, which pulls fontconfig and Noto Sans: renders
crashed until that transaction landed, and every later run was green.
With every font removed, lint-mermaid alone fails 274 of 289 files the
same way.
ensure() now installs the distribution's font provide when
/usr/share/fonts holds no file (`font(:lang=en)` on dnf and yum,
`ttf-font` on pacman), and browser_installed() counts the font, so the
install-lint stamp is not fresh on a font-less host.
Closes#1154
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
045ef095f2 taught the generic redirect vhost a Matrix location and let
web-app-matrix include web-opt-rdr-domains for its server name on its
own. The first put one app's contract into a shared role and made every
redirect source (www, aliases, asset, css) advertise the Matrix
delegation; the second bypassed current_play_redirect_domains and could
overwrite a vhost the server name already had, such as the Synapse one.
Every redirect vhost now serves `/.well-known/` from `<well-known>/<domain>/`
and hands a missing file or the bare directory to `location /` via
`error_page 403 404 = /`, so it still answers 301 with the original
request URI. web-app-matrix only writes its delegation file into the
directory of its server name.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
https://seaweedfs.org/ answers 404, which fails test-external
(tests/external/repository/test_urls_reachable.py) on README.md:167.
The upstream repository declares https://seaweedfs.com as its homepage.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The LiveKit JWT service checks each OpenID token over federation
against the user's homeserver. Server discovery found no delegation:
https://<server_name>/.well-known/matrix/server hit the redirect vhost
of web-opt-rdr-domains, which answered 301 to the dashboard and then
404, so the lookup fell back to <server_name>:8448. In compose OpenResty
runs in the host network and answers there; in swarm it publishes 80
and 443 only, the dial was refused and Element Call's token exchange
returned 401 M_UNAUTHORIZED (main run 40017166046, Nextcloud#12).
The role also wrote the delegation to `<well-known>/matrixserver`,
because the file path joined the directory and `server` without a
separator.
The file now lands at `<well-known>/matrix/server`, and the redirect
vhost serves `/.well-known/matrix/` from the shared well-known
directory, so discovery delegates to the Synapse domain on 443 in both
modes. Both flavors share tasks/utils/well_known.yml, which also
includes web-opt-rdr-domains for the server name when no play-wide
redirect claims it, so the delegation has a vhost there too.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
#1180 gave web-app-matrix a canonical `jitsi` domain for its own Jitsi
and listed it under `services.jitsi.domains`. When Jitsi is shared or
disabled nothing serves that domain, and the blackbox healthz job of
web-app-prometheus probed every canonical domain, so the probe of
https://jitsi.matrix.<domain>/healthz/ready failed with "tls:
unrecognized name" and `prometheus scrape: every consumer role reports
up=1 and passes its probe` went red (main run 40017166046: Matrix#2,
Nextcloud#12).
web_health_expectations already skipped such keys. The rule now lives
in utils/domains/unserved.py: a key claimed by a service entity that is
disabled, or enabled but shared, is not served by that app. The health
filter uses it unchanged, and prometheus.yml.j2 filters its targets
through the new `served_domains` filter, which also drops the
`<key>_onion` mirror of a skipped key.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Since #1180, web-app-matrix declares a canonical `jitsi` domain for its
internal Jitsi, also when it uses the shared web-app-jitsi (only the web
health check skips it then). canonical_domains_map checks every
canonical domain for uniqueness, so a host that serves web-app-jitsi on
jitsi.<domain> fails the constructor with
"Domain 'jitsi.infinito.nexus' is already configured for 'web-app-jitsi'
and 'web-app-matrix'" (echoserver, 2026-10-23).
The defaults now use one namespace per owner:
- web-app-matrix internal Jitsi: jitsi.matrix.<domain> (was jitsi.<domain>)
- web-app-jitsi: jitsi.call.<domain> (was meet.<domain>)
- web-app-bigbluebutton: bbb.call.<domain> (was bbb.talk.<domain>)
This changes the public URL of BigBlueButton and of the shared Jitsi on
every host that relies on the defaults.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Core `auth`, the list of enabled auth plugins, was written only by
05_ldap_sync.yml. Variant 1 of meta/variants.yml is SSO without LDAP and
skips that file, while 04_oidc.yml sets every mdl_user row to
auth='oidc'. Those users point at a plugin the site never enabled.
Moodle 5.3 rejects such a user in validate_auth_not_disabled(), so after
the second deploy of variant 1 the MCP service account, now auth='oidc',
gets "wsaccessusernologin" and "List the MCP tools with the minted
bearer" fails all 30 attempts (main run 39841510219, job 120466819062).
Before 5.3 only a literal 'nologin' was refused, which hid the gap. Users
of variant 1 could not log in at all for the same reason.
04_oidc.yml now enables oidc itself; 05_ldap_sync.yml runs after it and
widens the list to oidc,ldap where both are on. alternateloginurl moves
out of the loop that passes --component=auth_oidc, because core reads it
from mdl_config, not from the plugin's config.
Cherry-picked from dcb8f6866b on feature/store-i18n, with main's
MOODLE_OIDC_PLUGIN_URL_PATH kept for the login URL (Moodle 5.3 serves
the plugin under auth/oidc).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
An earlier commit on this branch turned the three off because the ansible flavor ran
them without a published port, proxy entry, domain or certificate. They
now stay on and are wired end to end.
Element Call: MDAD's LiveKit server and JWT service get their own
entities in meta/services.yml with resource limits, local ports and a
public media port (TCP and UDP). The runner container publishes them
through container_ports, and the Synapse vhost proxies /livekit-server/
(websocket) and /livekit-jwt-service/ to them. The JWT service checks
each OpenID token against the user's homeserver over federation, and
federation was not reachable in this flavor: Synapse served it only on
a plain-HTTP listener that the runner published directly on 8448.
Synapse now serves the client and federation resources on one listener,
OpenResty serves the Synapse vhost on 443 and as default_server on the
federation port, the direct 8448 publish is gone, and the role writes
/.well-known/matrix/server as the compose flavor does. With a
self-signed CA the JWT container mounts the CA bundle as Synapse does.
Jitsi: a new services.jitsi entity follows the shared-service contract.
It is enabled in the ansible flavor off tor nodes. When web-app-jitsi is
in the inventory, Element points at that shared Jitsi and MDAD's own
Jitsi stays off. Otherwise MDAD runs its own Jitsi on jitsi.<domain>
with a front-proxy vhost, its web port published to the runner and its
videobridge on a public UDP port. The entity lists the jitsi domain, so
the web health probe skips it whenever Matrix does not serve it. The
jitsi_*_container_network overrides were dropped: MDAD reads none of
them, Jitsi always ran on its own network. Variant 0 covers the shared
case, variant 1 the internal one. On an onion-primary deploy both call
stacks stay off, so Element never advertises a clearnet call surface.
MDAD's Prosody keeps an account's first password, so after a credential
rotation jicofo failed SASL with the new one. The role now derives the
jicofo and videobridge passwords from the macaroon secret and recreates
both accounts on every deploy.
Heisenbridge stays on by default. It runs in the nested host network,
where MDAD's container-name URLs do not resolve, so its homeserver URL
and the appservice URL in its registration point at 127.0.0.1.
A bootstrap that a previous deploy left failed (for example after a
Docker Hub rate limit) is now reset and restarted, so a mode=update
deploy converges instead of failing on the stale unit state.
Playwright proves each path: the RTC spec fetches a LiveKit token from
the JWT service and opens the SFU signalling websocket, the Jitsi spec
checks Element's preferred domain and joins a conference (signing in
through Keycloak first when the shared Jitsi sits behind SSO), and the
Heisenbridge spec opens a DM with the bot and waits for its answer to
"help".
Closes#1165
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
