Print selected INFINITO_* and GITHUB_SHA variables before starting the CI
compose stack and only indicate whether NIX_CONFIG is set, avoiding secret
exposure while making the effective image/tag visible in logs.
https://chatgpt.com/share/69684776-86c0-800f-b089-7e549a83e87f
- Build CI images workflow now always publishes :latest instead of ci-<sha>
- Removed obsolete tag input and CI tag computation logic
- Deploy in real GitHub Actions now pulls ghcr.io/.../infinito-<distro>:latest
- Skip docker compose build when INFINITO_NO_BUILD=1
- Respect INFINITO_IMAGE for --missing image existence check
This ensures deploy jobs use the already published production image and never rebuild in CI.
https://chatgpt.com/share/69678e2c-7d7c-800f-b422-15e98c8e4b6e
- Control INSTALL_LOCAL_BUILD centrally via Makefile depending on CI context:
- real GitHub Actions runner: disable local rebuild
- act and local runs: enable local rebuild
- Pass INSTALL_LOCAL_BUILD through docker-compose using environment expansion
- Remove hardcoded INSTALL_LOCAL_BUILD=1 from CI container runner
- Keep Dockerfile local-build during image build for CI images
This ensures consistent local/CI behavior and avoids unnecessary rebuilds on real CI runners.
https://chatgpt.com/share/6967876f-e400-800f-90ec-fe870e565bf3
- Rename CI workflow and MODE from "rest" to "universal"
- Extend CLI and test runner to support universal deploy type
- Add tasks/stages/02_universal.yml for universal host type
- Update discover logic to use universal app selection
- Remove legacy rest->server mapping and obsolete select helper
https://chatgpt.com/share/6967625e-81c8-800f-8592-5d5b8edec1e2
- add --debug / --no-debug flag to deploy test CLI and runner
- make Ansible debug mode optional instead of always enabled
- extend deploy.sh with debug flag forwarding
- add make target test-deploy-rapid for fast single-app deploys
https://chatgpt.com/share/6966c80c-661c-800f-8fb9-769659da290d
Ensure systemd is started immediately as PID 1 in the infinito container
to avoid blocking on pkgmgr during boot. Increase compose runner timeout
to match healthcheck window and make healthcheck script executable in the
image.
This fixes containers getting stuck in "starting" state and makes CI
startup deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
Add a systemd-based Docker HEALTHCHECK that verifies:
- systemd readiness
- infinito CLI availability and executability
- infinito CLI smoke test (--help)
Update CI compose runner to wait for Docker health status instead of
manual systemd polling. The runner now:
- resolves the infinito container via docker compose
- waits for healthy state
- dumps journalctl and docker logs on timeout
This removes boot race conditions and makes container readiness deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
Extend wait_for_systemd_ready() to automatically print the last 200 log
lines on timeout for easier CI debugging.
- Adds journalctl output (preferred for systemd containers)
- Adds docker logs fallback
- Improves timeout error diagnostics
https://chatgpt.com/share/69667eca-088c-800f-af12-5682d0038351
Switch CI detection to GITHUB_ACTIONS and disable compose builds via
INFINITO_NO_BUILD=1. The deploy workflows now rely on pulling the prebuilt
CI image instead of triggering local Docker builds.
- Remove legacy UP_BUILD handling
- Enable --no-build in compose when running in real CI
- Keep local/act builds working as before
https://chatgpt.com/share/69666e0b-f08c-800f-93fd-611eced4b100
- Rename _deploy-matrix.yml -> _deploy-per-app.yml and drop unused inputs
(tested_lifecycles, only_distro, final_exclude_re).
- Keep one runner per app (matrix.app) and run all distros inside that job.
- Makefile: run deploy tests through act workflow_dispatch (no serial script).
- Add scripts/ci/discover.sh and scripts/ci/deploy-one-app.sh as small SRP helpers.
- Update reusable workflow callers to use the renamed file.
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
- Add reusable _deploy-matrix workflow with discovery + per-app deploy across distros
- Enforce serial execution via strategy.max-parallel=1 and act --concurrent-jobs 1
- Support filters: mode (server|workstation|rest), only_app, only_distro, include/exclude regex
- Refactor test runner: remove discovery, require --app, deploy single app with deps only
- Generalize discover script to discover-apps.sh with INCLUDE_RE/EXCLUDE_RE + lifecycle gating
- Update Makefile targets to drive workflow_dispatch inputs for local act runs
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
Apply TESTED_LIFECYCLES filtering directly in the deploy test runner so roles
with unsupported lifecycles (e.g. pre-alpha) are excluded consistently for
both workstation and server workflows.
This prevents roles like desk-copyq (lifecycle: pre-alpha) from being deployed
in CI unless explicitly enabled via TESTED_LIFECYCLES.
https://chatgpt.com/share/6963e316-0a50-800f-a895-8828269a0ca3
- Allow credentials generator to run for roles without schema/main.yml so
transitive config-based generation still works.
- Make InventoryManager resilient to missing YAML by defaulting to {} and
only loading schema when schema/main.yml exists.
- Add recursive shared-provider include resolution based on docker.services
config and apply provider schemas/special rules transitively.
- Require database_password injection only when database.enabled=true and shared=true.
- Update unit/integration tests to create required files for .exists() checks and
validate transitive provider role credential generation.
https://chatgpt.com/share/69639d93-4c10-800f-bc6c-8e5b9fb75088
Extend credentials generator to include schemas for shared provider roles
(OpenLDAP, Keycloak, Matomo, and svc-db-<type>) based on docker.services.*.shared
flags in role config. Credentials are now emitted/added for all involved
applications while preserving existing inventory formatting, and CLI overrides
can target specific apps via applications.<app>.credentials.<key>.
- Replace direct docker compose up with python-based orchestrator (Compose.up)
- Centralize stack startup, systemd readiness wait, and init logic in Compose.up
- Run container init via scripts/docker/entry.sh instead of make target
- Remove duplicate systemd wait in deploy test runner
- Add cli.deploy.test.up entrypoint for make up integration
https://chatgpt.com/share/6962a2c8-0f50-800f-8bfb-2efd16adaf40
Ensure that localhost inventories always define ansible_python_interpreter when using
ansible_connection=local. This prevents Ansible from falling back to interpreter
auto-discovery (interpreter_python=auto_silent), which could select unexpected Python
binaries inside containers (e.g. /usr/sbin/python3.13) and break module execution.
The interpreter is now pinned to $PYTHON if set, otherwise to sys.executable.
https://chatgpt.com/share/69628603-3e18-800f-a6f9-2b367728a9ff
Ensure stdout is captured when calling run_after_resolution inside the infinito
container so declared galaxy_info.run_after deps (e.g. matomo, mailu) are
correctly detected and added to deploy_ids.
https://chatgpt.com/share/69617fbb-5af4-800f-848d-edeb2c1125a8
Add a systemd readiness gate to the CI compose wrapper to avoid a race
where systemctl is called before DBus/systemd is fully ready.
This prevents sporadic failures like:
"System has not been booted with systemd as init system (PID 1)".
No Dockerfile or Ansible role changes required.
https://chatgpt.com/share/696045b5-bd08-800f-acd9-e3a4e2e23e52
Resolve run_after dependencies via Compose.exec inside the infinito
CI container instead of invoking the resolver on the host.
This ensures:
- consistent runtime environment (PYTHONPATH, installed code)
- correct resolution when local and container sources differ
- alignment with other compose-based CI execution paths
https://chatgpt.com/share/69603903-d158-800f-815d-c506e3a3a44a
Avoid returning from finally in the test runner, which previously
overrode non-zero exit codes when --keep-stack-on-failure was set.
The compose stack is now conditionally kept without affecting the
actual test result.
https://chatgpt.com/share/696032fd-57d8-800f-bcc8-a0edf7b829a4
- Restore lifecycle-based role exclusion via cli.meta.roles.lifecycle_filter
- Make tested lifecycles configurable through TESTED_LIFECYCLES env
- Apply lifecycle gating consistently for workstation and server tests
- Fix minor bug in invokable parsing (avoid shadowing built-in list)
- Improve logging with lifecycle exclusion details
https://chatgpt.com/share/695fbcf4-2148-800f-8685-56ee73a9bae0
- Print full raw inventory file when application_id validation fails
- Fix invalid reason detection to use in_roles / in_inventory flags
- Simplify CI debugging for per-app dedicated deploy tests
https://chatgpt.com/share/695fb5d2-801c-800f-a1c8-06c2bcace450
* Avoid GitHub Actions matrix job limits by looping distros inside the per-app job
* Simplify discover output emission and pin checkout/upload-artifact to stable versions
* Tidy long log lines and minor formatting in deploy/test helpers
https://chatgpt.com/share/695fa9b9-4460-800f-bcc3-d566b83649b2
* Add `cli.deploy.test` module to orchestrate compose-based CI deploy tests
* Support server per-app runs (including run_after dependencies) and workstation selection
* Add optional image build flags (--no-cache, --missing) and stack retention on failure
* Simplify `scripts/tests/deploy.sh` to a thin wrapper that forwards args to the Python runner
https://chatgpt.com/share/695f9e22-6e9c-800f-9a50-65f553619af2
- Introduce CLI tool to resolve galaxy_info.run_after dependencies transitively
- Detect and report circular run_after dependencies explicitly
- Validate role existence and run_after schema strictly
- Provide whitespace-separated output for easy shell usage
- Add comprehensive unittest coverage including CLI behavior and error cases
https://chatgpt.com/share/695f8e09-54f4-800f-9f5f-ed9c2fdd664b
- Replace DEFAULT_SYSTEM_EMAIL merge with flat SYSTEM_EMAIL_* variables
- Update templates across apps to new variable names
- Fix msmtp health check to use -t and local username fallback
- Improve postfix localhost config (localdomain, mydestination, timeouts)
- Extend sys-hostname to ensure /etc/hosts mapping once
https://chatgpt.com/share/695e8f39-0694-800f-b91c-a74f4b78d7c8
- Introduce meta roles lifecycle_filter CLI to select roles by lifecycle
- Support whitelist/blacklist modes, selection filtering, and auto-detected roles dir
- Fix blacklist handling for roles with missing lifecycle
- Forward --help correctly to subcommand argparse
- Add unit tests for lifecycle filtering logic
https://chatgpt.com/share/695d09d2-c864-800f-9e23-b9db0c6f3537
- Migrate Mailu credentials from legacy mailu_token to tokens['web-app-mailu']
- Update all affected application templates to use the new token structure
- Adjust inventory validation to no longer special-case mailu_token
- Minor typing and formatting cleanups in inventory creation and tests
https://chatgpt.com/share/69554915-87c8-800f-afd5-12118dbb1107
* Move SSH key handling to users.<name>.authorized_keys (list-only) and write keys via shared user role
* Enforce at least one SSH key for administrator user
* Wrap backup user keys with restricted command wrapper before writing authorized_keys
* Remove legacy inventory file copy and CLI flag/function for administrator authorized_keys
* Extend user setup generator to include authorized_keys field
* Rename administrator scripts path to root scripts path and update dependent variables
* Update inventory sample and docs to reflect new SSH key workflow
https://chatgpt.com/share/695510b8-23f4-800f-b5db-877b07a1469b
* Replace global `SSL_ENABLED` flag with `TLS_ENABLED`
* Update web protocol/ports (http/https, ws/wss) to use `TLS_ENABLED`
* Switch cert-related roles and nginx TLS header gating to `TLS_ENABLED`
* Update app env templates (BookWyrm, Confluence, Jira, Magento, OpenProject, WordPress, etc.) to use `TLS_ENABLED`
* Adjust inventory generator to write `TLS_ENABLED` and update CLI help text accordingly
* Update unit tests for inventory vars overrides to expect `TLS_ENABLED`
https://chatgpt.com/share/695306ef-a798-800f-b118-e07b525e1811
- add --vars-file CLI option to load host_vars overrides from YAML
- merge vars-file overrides before JSON --vars (JSON takes precedence)
- implement deep-merge logic for YAML vars files
- update CI deploy script to use vars file instead of inline JSON
- add unit test for apply_vars_overrides_from_file
- remove obsolete MASK_CREDENTIALS_IN_LOGS TODO entry
https://chatgpt.com/share/6952e51d-6c50-800f-8764-31dc8c609cdb
kevinveenbirkenbach