- Add host-level AAAA DNS sanity test against CoreDNS
- Fail hard on SERVFAIL (breaks Node/getaddrinfo with EAI_AGAIN)
- Allow empty AAAA responses (IPv4-only setup is valid)
- Keep A-record validation unchanged
This prevents silent IPv6 resolver regressions that break CSP checks.
https://chatgpt.com/share/696abc27-19dc-800f-9ead-6598c2f3c302
sys-svc-docker role as a post-restart validation handler.
This change moves the inner-container DNS validation out of the CI test
suite and into the Docker service lifecycle itself, ensuring that DNS is
verified exactly where it matters: inside the Docker-in-Docker daemon.
Key changes:
- Add roles/sys-svc-docker/files/test-dns.sh:
- Runs inside the DinD container
- Waits for dockerd readiness
- Executes a BusyBox test container with explicit --dns
- Verifies DOMAIN and subdomain resolve to the expected IP
- Fails hard if DNS is broken
- Register DNS self-test as a docker restart handler:
- Runs once per deployment
- Only executed when DOCKER_IN_CONTAINER and MODE_DEBUG are enabled
- Uses ansible.builtin.script with role_path for correct resolution
- Remove inner Docker DNS test from scripts/tests/dns.sh:
- CI test suite now only validates host → CoreDNS → outer container chain
- DinD DNS validation is now part of the Docker service health lifecycle
This ensures that:
- DNS is validated after every Docker restart
- DinD networking failures are detected immediately
- CI and production share the same DNS validation logic
- Docker-in-Docker DNS becomes a first-class health invariant
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Quote dig server argument to avoid word splitting (SC2086)
- Replace &&/|| pseudo-if with proper if/else blocks (SC2015)
- Validate INFINITO_CONTAINER early via required env guard
- Keep DNS test logic unchanged, only harden correctness and linting
This makes scripts/tests/dns.sh fully shellcheck -x compliant and more robust.
https://chatgpt.com/share/696a4053-93f8-800f-959b-f99e2d7d12e2
- Introduce env.ci as single source of truth for CI networking
- Make docker-compose, CoreDNS and Docker daemon fully env-driven
- Render CoreDNS Corefile from template via envsubst
- Replace hardcoded IPs/domains with environment variables
- Integrate env-based networking into Ansible defaults
- Remove static Corefile and daemon.json
This makes DNS and networking deterministic and reproducible across
host, CoreDNS, infinito runner and Docker-in-Docker.
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Rename act-based targets for clarity:
- test-deploy -> test-act
- test-deploy-app -> test-act-app
- Rename rapid local deploy target:
- test-deploy-rapid -> test-local-rapid
- Add test-local-full target to run a full local deploy against a generated
inventory containing all apps of the selected TEST_DEPLOY_TYPE
- Add scripts/tests/deploy-local-full.sh:
- Discover apps on host via make ci-deploy-discover
- Bootstrap container via scripts/docker/entry.sh
- Generate dedicated inventory with --include list
- Deploy against that inventory
https://chatgpt.com/share/69692ef1-095c-800f-83cb-924fadfaa554
Promote-stable now validates version tags against the real quality gate
(code-analyses.yml) instead of the nightly scheduler wrapper.
This ensures the stable tag only points to versions that passed the full
CI matrix (lint, security, build, deploy, install, tests).
https://chatgpt.com/share/69691ebf-a380-800f-80fc-bd44d59e90dd
- Add daily stable promotion workflow with CI-gated highest-version selection
- Ensure GHCR images exist before moving stable tag
- Retag version images to :stable without rebuild
- Unify release workflows under infinito-release concurrency group
- Remove legacy highest-version/stable-move scripts and inline logic
https://chatgpt.com/share/696909c1-781c-800f-b52d-d9f967e9698c
- Build CI images with immutable ci-<sha> tags instead of latest
- Pass CI image tag into deploy workflows via INFINITO_IMAGE_TAG
- Derive CI_TAG from checked-out release tag commit
- Retag CI images to <version> and latest on release (no rebuild)
- Make release scripts independent from GITHUB_SHA coupling
- Improve robustness and reproducibility of release pipeline
https://chatgpt.com/share/696832f6-35e4-800f-a574-178013d4426e
- Replace legacy MODE env with TEST_DEPLOY_TYPE across workflows and scripts
- Route CI deploy and discovery through Makefile targets
- Rename deploy-one-app.sh to deploy-app.sh and update all call sites
- Fix Makefile recursion and ensure scripts are executed directly
- Ensure JSON discovery output is clean via silent make target
- Make MISSING_ONLY default true via Makefile
- Respect INFINITO_NO_BUILD in compose up to avoid implicit rebuilds in CI
- Keep explicit build step before compose up for deterministic CI runs
- Improve deploy logging (test_deploy_type instead of mode)
Result:
- Deterministic CI behaviour
- No accidental docker compose rebuilds on up
- Single source of truth for deploy orchestration
- Cleaner env contract between workflows, make, bash and python
https://chatgpt.com/share/69678024-fe38-800f-b877-add46aa55190
- Rename CI workflow and MODE from "rest" to "universal"
- Extend CLI and test runner to support universal deploy type
- Add tasks/stages/02_universal.yml for universal host type
- Update discover logic to use universal app selection
- Remove legacy rest->server mapping and obsolete select helper
https://chatgpt.com/share/6967625e-81c8-800f-8592-5d5b8edec1e2
- add --debug / --no-debug flag to deploy test CLI and runner
- make Ansible debug mode optional instead of always enabled
- extend deploy.sh with debug flag forwarding
- add make target test-deploy-rapid for fast single-app deploys
https://chatgpt.com/share/6966c80c-661c-800f-8fb9-769659da290d
Ensure systemd is started immediately as PID 1 in the infinito container
to avoid blocking on pkgmgr during boot. Increase compose runner timeout
to match healthcheck window and make healthcheck script executable in the
image.
This fixes containers getting stuck in "starting" state and makes CI
startup deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
Add a systemd-based Docker HEALTHCHECK that verifies:
- systemd readiness
- infinito CLI availability and executability
- infinito CLI smoke test (--help)
Update CI compose runner to wait for Docker health status instead of
manual systemd polling. The runner now:
- resolves the infinito container via docker compose
- waits for healthy state
- dumps journalctl and docker logs on timeout
This removes boot race conditions and makes container readiness deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
- Add reusable build-ci-images workflow to build and push ci-<sha> images for all distros
- Make all deploy test workflows use prebuilt CI images (no local rebuilds)
- Replace ci-version workflow with release workflow
- Retag ci images to <version> and latest on tag push (no rebuild)
- Move stable git tag only if all analyses/tests succeed and version is highest
- Make compose image/pull policy configurable via env
https://chatgpt.com/share/69662869-ee1c-800f-9e6c-bbbf47284fad
Replace inline tail logic in deploy workflows with a shared
scripts/ci/log-tail.sh helper that prints the last N lines of all
log files on failure.
This improves debuggability, avoids code duplication, and ensures
consistent log output across server, universal and workstation
pipelines.
https://chatgpt.com/share/69661d0e-81a8-800f-8b98-6c964672d027
- Rename _deploy-matrix.yml -> _deploy-per-app.yml and drop unused inputs
(tested_lifecycles, only_distro, final_exclude_re).
- Keep one runner per app (matrix.app) and run all distros inside that job.
- Makefile: run deploy tests through act workflow_dispatch (no serial script).
- Add scripts/ci/discover.sh and scripts/ci/deploy-one-app.sh as small SRP helpers.
- Update reusable workflow callers to use the renamed file.
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
- Add reusable _deploy-matrix workflow with discovery + per-app deploy across distros
- Enforce serial execution via strategy.max-parallel=1 and act --concurrent-jobs 1
- Support filters: mode (server|workstation|rest), only_app, only_distro, include/exclude regex
- Refactor test runner: remove discovery, require --app, deploy single app with deps only
- Generalize discover script to discover-apps.sh with INCLUDE_RE/EXCLUDE_RE + lifecycle gating
- Update Makefile targets to drive workflow_dispatch inputs for local act runs
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
Move lifecycle filtering into discover-server-apps.sh so only
lifecycle-eligible web-app-* and web-svc-* roles are discovered.
This prevents invalid per-app deploy tests where applications are
excluded later during inventory generation, causing "not present in
inventory" errors.
- Filter invokable roles by server prefixes
- Apply lifecycle_filter blacklist using TESTED_LIFECYCLES
- Always emit valid JSON for CI matrix generation
https://chatgpt.com/share/695fd936-0ee4-800f-a57f-2d7995e15ba0
* Add `cli.deploy.test` module to orchestrate compose-based CI deploy tests
* Support server per-app runs (including run_after dependencies) and workstation selection
* Add optional image build flags (--no-cache, --missing) and stack retention on failure
* Simplify `scripts/tests/deploy.sh` to a thin wrapper that forwards args to the Python runner
https://chatgpt.com/share/695f9e22-6e9c-800f-9a50-65f553619af2
- Replace clean-container with compose down for predictable teardown
- Add explicit up/down targets to Makefile
- Sync bind-mounted source into internal repo using rsync --chown=root:root
- Prevent git dubious ownership errors in CI containers running as root
https://chatgpt.com/share/695d7045-a1f8-800f-83d0-f5872d85cfcf
* Introduce lifecycle gating to CI deploy tests
* Only allow roles with tested lifecycles (alpha, beta, rc, stable)
* Automatically exclude roles with untested or missing lifecycle metadata
* Simplify static BASE_EXCLUDE by relying on lifecycle filtering
https://chatgpt.com/share/695d16d9-e210-800f-92d7-a1a429644be2
- Always build and publish Docker images for v* tags (version + latest),
independent of test results
- Run full code analyses in parallel and only mark Git + container :stable
when all checks succeed
- Replace rebuild-on-stable with pure imagetools retagging (no rebuild)
- Prevent race conditions by ordering stable tagging after image publish
- Ensure latest always tracks the most recent version image
https://chatgpt.com/share/695bdfa5-dbe0-800f-bb1c-4fe81eba6058
- switch deploy tests to docker compose exec (-T) instead of docker exec
- remove hard dependency on INFINITO_CONTAINER
- ensure clean CI state via compose down -v before deploy tests
- start coredns + infinito exclusively via compose
- enable host cgroup namespace for systemd containers (cgroup: host)
https://chatgpt.com/share/6953e367-b674-800f-bc55-97e8625314cf
- switch workflow to `make test-deploy` with matrix-driven INFINITO_DISTRO
- centralize container naming via INFINITO_CONTAINER
- add clean-container helper for reliable CI reruns
- remove --distro CLI flag and rely on env-based distro selection
- pass NIX_CONFIG as docker build arg for rate-limit-safe builds
https://chatgpt.com/share/6953d266-aa80-800f-88b8-0413926a81f0
- replace localhost special-casing with valid FQDN (infinito.localhost)
- derive system email DOMAIN and HOST directly from DOMAIN_PRIMARY
- align Mailu TLS_FLAVOR with SYSTEM_EMAIL.TLS (mail vs notls)
- tie OIDC_VERIFY_SSL to TLS_ENABLED for consistent test/CI behavior
- update CI deploy script to use new primary domain
https://chatgpt.com/share/695311c0-fbe8-800f-8058-9d40a06b189a
- add --vars-file CLI option to load host_vars overrides from YAML
- merge vars-file overrides before JSON --vars (JSON takes precedence)
- implement deep-merge logic for YAML vars files
- update CI deploy script to use vars file instead of inline JSON
- add unit test for apply_vars_overrides_from_file
- remove obsolete MASK_CREDENTIALS_IN_LOGS TODO entry
https://chatgpt.com/share/6952e51d-6c50-800f-8764-31dc8c609cdb
- switch CI DNS to CoreDNS-based *.localhost resolution (A/AAAA → loopback)
- set PRIMARY_DOMAIN to localhost for CI deploys
- add explicit DNS resolution assert for test.localhost
- deploy explicit default_server vhost returning 404 text/plain
- assert default vhost behavior via HTTP before app domains exist
https://chatgpt.com/share/6952cf2a-bbd4-800f-b2b8-c4baba66e301
- ensure files created by Ansible under /tmp/gh-action are visible to Docker host
- prevent file-vs-directory bind mount errors in GitHub CI
- align container filesystem with docker compose host paths
https://chatgpt.com/share/69528062-ff74-800f-ae11-a658b5917307
kevinveenbirkenbach