- Add host-level AAAA DNS sanity test against CoreDNS
- Fail hard on SERVFAIL (breaks Node/getaddrinfo with EAI_AGAIN)
- Allow empty AAAA responses (IPv4-only setup is valid)
- Keep A-record validation unchanged
This prevents silent IPv6 resolver regressions that break CSP checks.
https://chatgpt.com/share/696abc27-19dc-800f-9ead-6598c2f3c302
sys-svc-docker role as a post-restart validation handler.
This change moves the inner-container DNS validation out of the CI test
suite and into the Docker service lifecycle itself, ensuring that DNS is
verified exactly where it matters: inside the Docker-in-Docker daemon.
Key changes:
- Add roles/sys-svc-docker/files/test-dns.sh:
- Runs inside the DinD container
- Waits for dockerd readiness
- Executes a BusyBox test container with explicit --dns
- Verifies DOMAIN and subdomain resolve to the expected IP
- Fails hard if DNS is broken
- Register DNS self-test as a docker restart handler:
- Runs once per deployment
- Only executed when DOCKER_IN_CONTAINER and MODE_DEBUG are enabled
- Uses ansible.builtin.script with role_path for correct resolution
- Remove inner Docker DNS test from scripts/tests/dns.sh:
- CI test suite now only validates host → CoreDNS → outer container chain
- DinD DNS validation is now part of the Docker service health lifecycle
This ensures that:
- DNS is validated after every Docker restart
- DinD networking failures are detected immediately
- CI and production share the same DNS validation logic
- Docker-in-Docker DNS becomes a first-class health invariant
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Quote dig server argument to avoid word splitting (SC2086)
- Replace &&/|| pseudo-if with proper if/else blocks (SC2015)
- Validate INFINITO_CONTAINER early via required env guard
- Keep DNS test logic unchanged, only harden correctness and linting
This makes scripts/tests/dns.sh fully shellcheck -x compliant and more robust.
https://chatgpt.com/share/696a4053-93f8-800f-959b-f99e2d7d12e2
- Introduce env.ci as single source of truth for CI networking
- Make docker-compose, CoreDNS and Docker daemon fully env-driven
- Render CoreDNS Corefile from template via envsubst
- Replace hardcoded IPs/domains with environment variables
- Integrate env-based networking into Ansible defaults
- Remove static Corefile and daemon.json
This makes DNS and networking deterministic and reproducible across
host, CoreDNS, infinito runner and Docker-in-Docker.
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Rename act-based targets for clarity:
- test-deploy -> test-act
- test-deploy-app -> test-act-app
- Rename rapid local deploy target:
- test-deploy-rapid -> test-local-rapid
- Add test-local-full target to run a full local deploy against a generated
inventory containing all apps of the selected TEST_DEPLOY_TYPE
- Add scripts/tests/deploy-local-full.sh:
- Discover apps on host via make ci-deploy-discover
- Bootstrap container via scripts/docker/entry.sh
- Generate dedicated inventory with --include list
- Deploy against that inventory
https://chatgpt.com/share/69692ef1-095c-800f-83cb-924fadfaa554
- Rename CI workflow and MODE from "rest" to "universal"
- Extend CLI and test runner to support universal deploy type
- Add tasks/stages/02_universal.yml for universal host type
- Update discover logic to use universal app selection
- Remove legacy rest->server mapping and obsolete select helper
https://chatgpt.com/share/6967625e-81c8-800f-8592-5d5b8edec1e2
- add --debug / --no-debug flag to deploy test CLI and runner
- make Ansible debug mode optional instead of always enabled
- extend deploy.sh with debug flag forwarding
- add make target test-deploy-rapid for fast single-app deploys
https://chatgpt.com/share/6966c80c-661c-800f-8fb9-769659da290d
- Add reusable _deploy-matrix workflow with discovery + per-app deploy across distros
- Enforce serial execution via strategy.max-parallel=1 and act --concurrent-jobs 1
- Support filters: mode (server|workstation|rest), only_app, only_distro, include/exclude regex
- Refactor test runner: remove discovery, require --app, deploy single app with deps only
- Generalize discover script to discover-apps.sh with INCLUDE_RE/EXCLUDE_RE + lifecycle gating
- Update Makefile targets to drive workflow_dispatch inputs for local act runs
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
Move lifecycle filtering into discover-server-apps.sh so only
lifecycle-eligible web-app-* and web-svc-* roles are discovered.
This prevents invalid per-app deploy tests where applications are
excluded later during inventory generation, causing "not present in
inventory" errors.
- Filter invokable roles by server prefixes
- Apply lifecycle_filter blacklist using TESTED_LIFECYCLES
- Always emit valid JSON for CI matrix generation
https://chatgpt.com/share/695fd936-0ee4-800f-a57f-2d7995e15ba0
* Add `cli.deploy.test` module to orchestrate compose-based CI deploy tests
* Support server per-app runs (including run_after dependencies) and workstation selection
* Add optional image build flags (--no-cache, --missing) and stack retention on failure
* Simplify `scripts/tests/deploy.sh` to a thin wrapper that forwards args to the Python runner
https://chatgpt.com/share/695f9e22-6e9c-800f-9a50-65f553619af2
* Introduce lifecycle gating to CI deploy tests
* Only allow roles with tested lifecycles (alpha, beta, rc, stable)
* Automatically exclude roles with untested or missing lifecycle metadata
* Simplify static BASE_EXCLUDE by relying on lifecycle filtering
https://chatgpt.com/share/695d16d9-e210-800f-92d7-a1a429644be2
- switch deploy tests to docker compose exec (-T) instead of docker exec
- remove hard dependency on INFINITO_CONTAINER
- ensure clean CI state via compose down -v before deploy tests
- start coredns + infinito exclusively via compose
- enable host cgroup namespace for systemd containers (cgroup: host)
https://chatgpt.com/share/6953e367-b674-800f-bc55-97e8625314cf
- switch workflow to `make test-deploy` with matrix-driven INFINITO_DISTRO
- centralize container naming via INFINITO_CONTAINER
- add clean-container helper for reliable CI reruns
- remove --distro CLI flag and rely on env-based distro selection
- pass NIX_CONFIG as docker build arg for rate-limit-safe builds
https://chatgpt.com/share/6953d266-aa80-800f-88b8-0413926a81f0
- replace localhost special-casing with valid FQDN (infinito.localhost)
- derive system email DOMAIN and HOST directly from DOMAIN_PRIMARY
- align Mailu TLS_FLAVOR with SYSTEM_EMAIL.TLS (mail vs notls)
- tie OIDC_VERIFY_SSL to TLS_ENABLED for consistent test/CI behavior
- update CI deploy script to use new primary domain
https://chatgpt.com/share/695311c0-fbe8-800f-8058-9d40a06b189a
- add --vars-file CLI option to load host_vars overrides from YAML
- merge vars-file overrides before JSON --vars (JSON takes precedence)
- implement deep-merge logic for YAML vars files
- update CI deploy script to use vars file instead of inline JSON
- add unit test for apply_vars_overrides_from_file
- remove obsolete MASK_CREDENTIALS_IN_LOGS TODO entry
https://chatgpt.com/share/6952e51d-6c50-800f-8764-31dc8c609cdb
- switch CI DNS to CoreDNS-based *.localhost resolution (A/AAAA → loopback)
- set PRIMARY_DOMAIN to localhost for CI deploys
- add explicit DNS resolution assert for test.localhost
- deploy explicit default_server vhost returning 404 text/plain
- assert default vhost behavior via HTTP before app domains exist
https://chatgpt.com/share/6952cf2a-bbd4-800f-b2b8-c4baba66e301
- ensure files created by Ansible under /tmp/gh-action are visible to Docker host
- prevent file-vs-directory bind mount errors in GitHub CI
- align container filesystem with docker compose host paths
https://chatgpt.com/share/69528062-ff74-800f-ae11-a658b5917307
- Install systemd and dbus in Docker image for CI service tests
- Run systemd as PID 1 with proper container conventions
- Mark container environment explicitly via ENV container=docker
- Simplify container detection to rely on explicit env flag
- Skip host-only tasks (timezone, systemctl handlers) inside containers
- Adjust docker-compose runner for privileged systemd execution
- Reduce CI parallelism to avoid OOM kills
This makes systemd-based Ansible roles reliable in Docker/CI
and avoids fragile virtualization heuristics.
https://chatgpt.com/share/6950110b-111c-800f-bbcd-83a551d5a3b8
Switch CI deploy tests from docker run to docker compose with a long-lived
infinito service. The container now uses `tail -f /dev/null` as command to
prevent restart loops caused by the default `infinito --help` CMD, which
previously killed exec processes with exit code 137.
Changes include:
- make infinito a stable exec target in compose (no premature restarts)
- add compose helpers (build/up/exec/down) to deploy.sh
- move inventory creation and dedicated deploy into the running container
- add conditional cleanup via EXIT trap (keep stack on failure for debugging)
- support per-distro container naming via INFINITO_DISTRO
This stabilizes CI runs and makes debugging failed deploys possible.
https://chatgpt.com/share/694d3f99-07e4-800f-bc05-3a60c902064d
- Mount /tmp/gh-action into the CI container so Docker can access run-scoped paths
- Scope OpenResty www and nginx volumes to GITHUB_RUN_ID when running in container
- Avoid leaking host /etc/nginx and /var/www into CI runs
- Remove redundant preflight
https://chatgpt.com/share/694918d0-53b4-800f-93a7-ec82946f3e24
* Refactor docker entrypoint to run local build via a single helper function
* Add INSTALL_LOCAL_BUILD_SILENCE flag to fully suppress DEV build output
* Enable INSTALL_LOCAL_BUILD for invokable resolution without noisy logs
* Keep behavior deterministic and non-redundant while preserving failure semantics
https://chatgpt.com/share/694874d7-508c-800f-aa89-d9cef71128dc
- Drop legacy compatibility wrapper in cli.meta.applications.invokable
- Resolve repository root explicitly via pathlib
- Ensure filter_plugins are importable outside Ansible
- Run invokable discovery with INSTALL_LOCAL_BUILD=1 in deploy tests
- Make deploy.sh fail fast when invokable resolution is unavailable
- Normalize sorting and exclusion logic (drv-* roles, locale-safe sort)
- Export NIX_CONFIG in CI jobs and Makefile
- Pass NIX_CONFIG as docker build-arg
- Use NIX_CONFIG only in relevant Dockerfile RUN steps (no secret persistence)
- Forward NIX_CONFIG to test and deploy containers
https://chatgpt.com/share/6947c681-abc8-800f-ba12-de2ff3a7abad
- Switch Dockerfile build args to PKGMGR_IMAGE_REPO/TAG
- Copy source to INFINITO_SRC_DIR and install infinito via pkgmgr
- Use entry.sh (INSTALL_LOCAL_BUILD) for build-time local override
- Update build/test scripts to new arg/env names
https://chatgpt.com/share/69455d5d-e13c-800f-8c37-fc0ece49d386
- Install Docker CLI in the Docker image (distro-aware)
- Switch deploy container runner from Docker-in-Docker to host /var/run/docker.sock
with clearer diagnostics when docker/permissions are missing
- Rewrite scripts/tests/deploy.sh to build a local infinito-<distro> image via Make
and run deployment strictly against that local tag (no pkgmgr/GHCR pulls)
https://chatgpt.com/share/694513c7-daec-800f-a9b5-c8fb25274958
kevinveenbirkenbach