3 Commits

Include renames

Author	SHA1	Message	Date
kevinveenbirkenbachandClaude Opus 4.7	f67b913a4b	feat(swarm): swarm-aware deploy CLI with inventory-derived dep closure ... New ``cli.administration.deploy.swarm`` package wraps the strict ``cli.administration.deploy.dedicated`` runner with a layered closure so swarm deploys never require operators (or test scripts) to enumerate every infra role: effective --id = seed (operator --id, else inventory_role_groups) ∪ dep-walk(seed via applications_if_group_and_all_deps) ∪ default-placement safety net The dep-walker is the same SPOT (``utils.roles.applications.in_group_deps.applications_if_group_and_all_deps``) the runtime constructor consumes via ``lookup('applications_current_play')``, so the CLI-side closure and the in-play role set stay in sync. The dedicated CLI keeps strict explicit-only semantics: ``main`` was split into ``parse_args`` + ``run_from_args`` so the swarm wrapper can share parser, mode wiring, validator and runner verbatim and only mutate ``args.id``. Meta-side: ``svc-db-postgres`` gains ``default_placement: manager`` (semantic symmetry with mariadb). ``default_placement`` is now a PLACEMENT hint only ("if deployed, run on the manager"); deploy decisions come from the dep-walk. Apps that declare ``mariadb:`` pull svc-db-mariadb; apps that declare ``postgres:`` pull svc-db-postgres; apps that declare neither get no central DB. Shared utils extracted so the four consumers stay aligned: * ``utils.inventory.groups.inventory_has_group``: YAML + INI static inventory group probe (extracted from ValidDeployId). * ``utils.roles.meta_lookup.{get_role_default_placement, iter_roles_with_default_placement}``: single source of truth for ``default_placement`` discovery (lookup plugin is now a thin wrapper). Test pipeline (``scripts/tests/deploy/swarm/*``): * Heredoc-Python shells converted to proper modules under ``utils.tests.swarm.*`` and invoked via ``python -m``: - extend_inventory.py (was 08_extend_inventory.sh) - write_extras.py (was 09_write_extras.sh dynamic half) - derive_includes.py (replaces 06's hardcoded includes array) - write_hosts_entries.py (replaces 02's hardcoded /etc/hosts heredoc; derives every canonical + www-redirect domain from APP_ID via canonical_domains_map + generate_all_domains, so the test works for any app in the matrix without per-app maintenance) * 01_create_network.sh deleted (single docker command inlined in workflow). * 11_deploy.sh deleted (swarm CLI now called directly in workflow). * 09_write_extras.sh: static half moved to inventories/development/swarm.yml. * Remaining shell scripts renumbered 01-13 without gaps. * 08_wait_converge.sh: case block on DB_DEP replaced with single conditional (container name == DB_DEP). * 06_provision_inventory.sh: hardcoded includes array replaced with `mapfile -t includes < <(python -m utils.tests.swarm.derive_includes)`. * Workflow YAML step references updated to new script names + module invocations. New tests (39 covering the closure surface): * tests/unit/cli/administration/deploy/swarm/test_closure.py (14) * tests/unit/utils/inventory/test_groups.py (11) * tests/unit/utils/roles/test_meta_lookup.py (+3 for default_placement) * tests/unit/utils/roles/validation/test_deploy_id.py (unchanged 8 tests still pass after refactor onto the shared util). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-05 02:24:51 +02:00
kevinveenbirkenbachandClaude Opus 4.7	944e782d84	refactor(applications): introduce status lookup + rbac_app_ids filter; rename allowed_applications → APPLICATIONS_WHITELIST ... - plugins/lookup/status.py: new lookup returning {whitelist, running, groups, all}, cached per (whitelist, groups). Consumers replace direct group_vars references. - web-app-keycloak/filter_plugins/rbac_per_app.py: add `rbac_app_ids` (intersect input list with invokable apps; sorted, deduped). - web-app-keycloak/tasks/update/05c_per_app_mappers.yml: drop two set_fact tasks; consume KEYCLOAK_RBAC_{ALL,RUN}_APP_IDS as constants from vars/main.yml. Split orphan-purge scope (all host-deployed) from mapper-sync scope (current run). - Rename Ansible-side `allowed_applications` → `APPLICATIONS_WHITELIST` (group_vars/all default, deploy CLI `-e` injection, generated include `when:` clause, debug task, test asserts). Python kwarg name unchanged (internal contract). - test-e2e-playwright: `TEST_E2E_PLAYWRIGHT_ONLY_ROLES` consumes `lookup('status').running`; `TEST_E2E_PLAYWRIGHT_APPS` moved from set_fact to vars/main.yml constant. - 01_constructor debug: collapse to single `status:` block over the lookup result. - web-app-{opencloud,opentalk}/vars: drop dead `group_names | default([])` + fix latent `| lower`-on-list precedence bug. - New lint `test_no_jinja_default_on_ansible_magic_var.py`: forbid `| default(...)` on Ansible magic vars (group_names, inventory_hostname, …); meta-scan + 7 fixture positive cases. - Unit tests for `rbac_app_ids` (10) and `status` lookup (8). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 18:39:52 +02:00
kevinveenbirkenbachandClaude Opus 4.7	a26bfc4e94	refactor(cli): reorg admin/contributing tree + per-folder help system ... Module moves (with imports, paths, argv literals, scripts, docs, and parents[N] formulas updated in lockstep): - cli/deploy -> cli/administration/deploy - cli/validate/inventory -> cli/administration/inventory/validate - cli/vault -> cli/administration/secrets/vault - cli/administration/inventory/encrypt -> cli/administration/secrets/seal - cli/mirror -> cli/contributing/mirror The new cli/administration/secrets cluster collocates the whole-file ansible-vault wrapper next to the inventory-aware per-field sealer. The user-facing CLI subcommand paths follow the package layout, e.g. "infinito administration deploy dedicated <inv>" and "infinito administration inventory validate <inv>". Help system redesign in cli/core/{discovery,help,app}.py: - Discovery now distinguishes runnable commands (directories with __main__.py) from category folders (directories that only group further commands). Empty support packages are filtered out. - Each category folder MAY carry a README.md; its H1 heading is used as the title and its first paragraph as the one-line description in the help output. - "infinito" / "infinito --help" prints only the top-level entries (one level deep). "infinito <category>" navigates into a folder and shows its sub-folders and commands one level deep, with the README title as the page heading and the invocation as a dim subtitle. - New "--tree [N]" flag walks the tree under the (optional) path prefix recursively. N caps the depth (1-based); omit N for an unbounded walk. The output uses Unicode tree connectors, an emoji per entry (folder for categories, gear for commands), a globally aligned description column, and multi-line wrapped descriptions with tree-continuity bars on continuation lines. - Category and command listings use the full invocation ("infinito meta callorder") rather than the bare leaf name, so the output is copy-pasteable. Convention doc + 17 CLI READMEs: - New docs/contributing/artefact/files/cli/readme_md.md describes the H1+paragraph layout the help system reads, and how it differs from role/docs READMEs. - README.md added for cli/{administration, build, contributing, meta} and their immediate sub-folders, plus cli/meta/roles/applications and its resolution sub-folder. Each follows the "title with trailing emoji + single descriptive paragraph" convention. Mirror resolver/sync description strings (the help system reads them from argparse --help output) added so they no longer surface as "options:" in the global index. cli/mirror/cleanup already had a description and is unchanged. Fixes uncovered by the move: - import unittest.mock added to four dedicated-deploy tests so unittest.mock.patch resolves under stdlib unittest discovery (Python 3.13 no longer surfaces unittest.mock through "import unittest" alone). - parents[N] index in the new cli/administration/inventory/validate/__init__.py corrected from 3 to 4 to match the deeper layout. - test_paths.INVENTORY_VALIDATOR_PATH assertion and test_runner substring assertions updated to match the new validator path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-08 20:17:09 +02:00