- Move get_docker_paths() implementation from filter_plugins to module_utils
to make it reusable by filters and lookup plugins (single source of truth)
- Adapt filter_plugins/get_docker_paths.py to re-export the shared util
- Add new lookup plugin "database" resolving DB settings from applications config
- Fix unit test patching: patch module_utils.docker_paths_utils.get_entity_name
instead of filter module, because imports are now bound at util level
- Add comprehensive unit tests for database lookup covering all helper-variable cases
https://chatgpt.com/share/6983b526-00dc-800f-b3a0-b71e4104d0fc
- add module_utils/domain_mapper to map domains (canonical/aliases) -> application_id
supporting str/list/dict and nested structures
- extend tls_common.resolve_term to optionally resolve alias domains via applications
while keeping legacy lookup via global domains mapping intact
- pass applications into tls_resolve and cert_plan
- add unit tests for domain_mapper
https://chatgpt.com/share/697d500f-b884-800f-ba5b-088a2340f9d6
Move `with-ca-trust.sh` to `sys-ca-selfsigned` as the single source of truth, add `CA_TRUST_NAME`/`trust_name`, and pass it through `compose_ca_inject.py` + `compose_ca_inject_cmd`. Introduce `module_utils/templating.py` for strict multi-pass rendering with fallback env lookup, update TLS self-signed regen logic, purge script, and extend unit tests accordingly.
https://chatgpt.com/share/697c876d-7140-800f-9981-762dfeeafdfe
Introduce module_utils/jinja_strict.py to render nested Jinja-in-vars with hard-fail semantics. Refactor cert_plan, compose_f_args, and compose_ca_inject_cmd to use render_strict so no "{{ ... }}" leaks into generated paths/commands, and add unit tests.
https://chatgpt.com/share/697b8e1b-54fc-800f-b895-7161f00ebd51
- Extract shared TLS logic into module_utils/tls_common
- Introduce cert_plan lookup for certificate paths and SAN computation
- Simplify tls_resolve to strict protocol/port/domain resolution only
- Add global self-signed certificate scope covering all domains
- Mount self-signed cert base into OpenResty container
- Update Nginx templates to use cert_plan for ssl_certificate paths
- Add comprehensive unit tests for tls_common, tls_resolve, and cert_plan
https://chatgpt.com/share/6972c568-9e8c-800f-b89a-a0061966f9a8
- add strong_password generator with special characters
- introduce opensearch_initial_admin_password credential
- wire OpenSearch admin password via env template
- decouple OpenSearch admin password from Shopware admin user
- minor formatting cleanup in service resolver
- Allow credentials generator to run for roles without schema/main.yml so
transitive config-based generation still works.
- Make InventoryManager resilient to missing YAML by defaulting to {} and
only loading schema when schema/main.yml exists.
- Add recursive shared-provider include resolution based on docker.services
config and apply provider schemas/special rules transitively.
- Require database_password injection only when database.enabled=true and shared=true.
- Update unit/integration tests to create required files for .exists() checks and
validate transitive provider role credential generation.
https://chatgpt.com/share/69639d93-4c10-800f-bc6c-8e5b9fb75088
- Move generate_value/generate_secure_alphanumeric out of InventoryManager into new ValueGenerator
- Wire InventoryManager to use self.value_generator for all secret generation
- Tighten schema include logic for shared databases: require enabled=true and shared=true
- Update unit tests to patch ValueGenerator.generate_value instead of InventoryManager.generate_value
- Add end-to-end integration test for InventoryManager using real files and a fake VaultHandler
- Remove redundant legacy unit test file and add dedicated ValueGenerator unit tests
https://chatgpt.com/share/6962d2e6-7fdc-800f-ba83-9e150b19a5f0
Extend credentials generator to include schemas for shared provider roles
(OpenLDAP, Keycloak, Matomo, and svc-db-<type>) based on docker.services.*.shared
flags in role config. Credentials are now emitted/added for all involved
applications while preserving existing inventory formatting, and CLI overrides
can target specific apps via applications.<app>.credentials.<key>.
Replace legacy feature flags (features.central_database, features.oauth2) with
docker service based configuration:
- docker.services.database.shared
- docker.services.oauth2.enabled
Update InventoryManager logic accordingly and adapt all unit tests to mock
the new config structure.
This ensures inventory generation now follows the canonical docker service
configuration model.
https://chatgpt.com/share/69628906-5efc-800f-999b-2ae3ece1907f
- Restore lifecycle-based role exclusion via cli.meta.roles.lifecycle_filter
- Make tested lifecycles configurable through TESTED_LIFECYCLES env
- Apply lifecycle gating consistently for workstation and server tests
- Fix minor bug in invokable parsing (avoid shadowing built-in list)
- Improve logging with lifecycle exclusion details
https://chatgpt.com/share/695fbcf4-2148-800f-8685-56ee73a9bae0
- Always derive roles/ path from repository root instead of accepting a parameter
- Fail fast if roles directory is missing or mislocated
- Add explicit typing and Path-based path handling
- Update unit tests to rely on real repo roles instead of temporary fixtures
- Ensure tests cover correct role discovery and inventory validation
https://chatgpt.com/share/695fb926-1f5c-800f-9012-e2922bb1df3f
- Print full raw inventory file when application_id validation fails
- Fix invalid reason detection to use in_roles / in_inventory flags
- Simplify CI debugging for per-app dedicated deploy tests
https://chatgpt.com/share/695fb5d2-801c-800f-a1c8-06c2bcace450
Replace manual global warning state in sounds module with lru_cache-based
"warn once" implementation, eliminating the unused global variable flagged
by CodeQL.
Additionally remove unused module-level regex/constants and dead files
identified by static analysis to reduce noise and keep the codebase clean.
https://chatgpt.com/share/6943de4d-17a4-800f-9c40-a76d2870e0a5
- Fix E701 by expanding single-line class and loop statements into blocks
- Fix E702 by splitting semicolon-separated statements
- Exclude build/, dist/, venv, and egg-info from Ruff linting
- Apply fixes consistently to source and generated files
No runtime behavior changes; lint-only cleanup to stabilize CI.
https://chatgpt.com/share/6942c9e3-80fc-800f-b471-5e1ee567f8fe
- Import subprocess where used to fix F821 in cli/setup/applications
- Remove accidental test methods from RoleDependencyResolver implementation
- Remove invalid and non-discoverable test functions from test_role_dependency_resolver
- Eliminate test code that was never executed due to wrong scope/indentation
- Restore clear separation between production code and unit tests
https://chatgpt.com/share/6942c3ec-8a10-800f-9a15-c319f5e93089
### Overview
This commit introduces a broad set of improvements across the defaults
generator, credential creation subsystem, inventory creation workflow,
and InventoryManager core logic.
### Major Changes
- Support empty or config/main.yml in defaults generator and ensure that
applications with empty configs are still included in defaults_applications.
- Add '--snippet' and '--allow-empty-plain' modes to create/credentials.py
with non-destructive merging and correct plain-secret handling.
- Ensure empty strings for 'plain' credentials are never encrypted.
- Update InventoryManager to fully support allow_empty_plain and prevent
accidental overwriting or encrypting existing VaultScalar or dict values.
- Add full-size implementation of cli/create/inventory.py including
dynamic inventory building, role filtering, host_vars management, and
parallelised credential snippet generation.
- Fix schemas (Magento, Nextcloud, OAuth2-Proxy, keyboard-color, etc.) to
align with the new credential model and avoid test failures.
- Improve get_app_conf consistency by ensuring credentials.* paths are
always resolvable for applications even when config/main.yml is empty.
### Added Test Coverage
- Unit tests for defaults generator handling empty configs.
- Full test suite for create/inventory.py including merge logic and
vault-safe host_vars loading.
- Extensive tests for InventoryManager: plain-secret behavior,
vault handling, and recursion logic.
- Update or remove outdated tests referencing old schema behaviour.
### Context
This commit is associated with a refactoring and debugging session documented here:
https://chatgpt.com/share/692ec0e1-5018-800f-b568-d09a53e9d0ee
- Added run_openssl_dates() to extract notBefore/notAfter timestamps.
- Modified mapping logic to store multiple cert entries per SAN with metadata.
- find_cert_for_domain() now selects the newest certificate based on notBefore and mtime.
- Exact SAN matches take precedence over wildcard matches.
- Added new unit tests (test_cert_utils_newest.py) verifying freshness logic, fallback handling, and wildcard behavior.
Reference: https://chatgpt.com/share/68ef4b4c-41d4-800f-9e50-5da4b6be1105
- Added new optional parameter 'skip_missing_app' to get_app_conf() in module_utils/config_utils.py to safely return defaults when applications are missing.
- Updated group_vars/all/00_general.yml and roles/web-app-nextcloud/config/main.yml to include skip_missing_app=True in all Nextcloud-related calls.
- Added comprehensive unit tests under tests/unit/module_utils/test_config_utils.py covering missing app handling, schema enforcement, nested lists, and index edge cases.
Ref: https://chatgpt.com/share/68ee6b5c-6db0-800f-bc20-d51470d7b39f
feat(bbb/schema): auto-generate etherpad_api_key; set fsesl_password to alphanumeric_32
test(unit): add InventoryManager tests (Option B) expecting feature-generated creds as plain strings
docs: full autocreation of credentials for BigBlueButton now enabled
See: https://chatgpt.com/share/68d69ee8-3fd4-800f-9209-60026b338934
- Introduced module_utils/role_dependency_resolver.py with full support for include_role, import_role, meta dependencies, and run_after.
- Refactored cli/build/tree.py to use RoleDependencyResolver (added toggles for include/import/dependencies/run_after).
- Extended filter_plugins/canonical_domains_map.py with optional 'recursive' mode (ignores run_after by design).
- Updated roles/web-app-nextcloud to properly include Collabora dependency.
- Added comprehensive unittests under tests/unit/module_utils for RoleDependencyResolver.
Ref: https://chatgpt.com/share/68a519c8-8e54-800f-83c0-be38546620d9
