Added draft for pixelfed OIDC

filter_plugins/docker_image.py

@@ -0,0 +1,20 @@
+# filter_plugins/docker_image.py
+
+def get_docker_image(applications, application_id, image_key):
+    app = applications.get(application_id, {})
+    docker = app.get("docker", {})
+    images = docker.get("images", {})
+    versions = docker.get("versions", {})
+    version = versions.get(image_key) or app.get("version")
+    image = images.get(image_key)
+
+    if not image or not version:
+        raise ValueError(f"Missing image or version for {application_id}:{image_key}")
+    
+    return f"{image}:{version}"
+
+class FilterModule(object):
+    def filters(self):
+        return {
+            'get_docker_image': get_docker_image,
+        }

roles/docker-discourse/templates/discourse_application.yml.j2

@@ -102,15 +102,15 @@ hooks:
     - exec:
         cd: $home/plugins
         cmd:
-          - git clone https://github.com/discourse/docker_manager.git
-          - git clone https://github.com/discourse/discourse-activity-pub.git
-          - git clone https://github.com/discourse/discourse-calendar.git
-          - git clone https://github.com/discourse/discourse-akismet.git
-          - git clone https://github.com/discourse/discourse-cakeday.git
-          - git clone https://github.com/discourse/discourse-solved.git
-          - git clone https://github.com/discourse/discourse-voting.git
-          - git clone https://github.com/discourse/discourse-oauth2-basic.git
-          - git clone https://github.com/discourse/discourse-openid-connect.git
+          - git clone  --depth=1 https://github.com/discourse/docker_manager.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-activity-pub.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-calendar.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-akismet.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-cakeday.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-solved.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-voting.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-oauth2-basic.git
+          - git clone  --depth=1 https://github.com/discourse/discourse-openid-connect.git
 
 ## Any custom commands to run after building
 run:

roles/docker-matomo/meta/main.yml

@@ -19,4 +19,4 @@ galaxy_info:
   logo:
     class: "fa-solid fa-chart-line"
   run_after:
-    - "docker-ldap"
+    - "docker-postgres"

roles/docker-matrix/vars/configuration.yml

@@ -20,6 +20,8 @@ features:
   central_database:   true
 csp:
   flags:
+    script-src:
+      unsafe-eval:   true
     script-src-elem:
       unsafe-inline: true
       unsafe-eval:   true
@@ -27,8 +29,7 @@ csp:
       unsafe-inline: true
   whitelist:
     connect-src:
-      - "{{ primary_domain }}"
-      - "matrix.{{ primary_domain }}"
+      - "*"
     script-src-elem:
       - "element.{{ primary_domain }}"
       - "https://cdn.jsdelivr.net"

roles/docker-pgadmin/meta/main.yml

@@ -25,4 +25,4 @@ galaxy_info:
   logo:
     class: "fa-solid fa-database"
   run_after:
-    - docker-postgres
+    - docker-matomo

roles/docker-phpldapadmin/meta/main.yml

@@ -25,3 +25,4 @@ galaxy_info:
     class: "fa-solid fa-user-lock"
   run_after:
     - docker-ldap
+    - docker-matomo

roles/docker-phpmyadmin/meta/main.yml

@@ -26,4 +26,5 @@ galaxy_info:
   logo:
     class: "fa-solid fa-database"
   run_after:
-    - docker-mariadb
+    - docker-mariadb
+    - docker-matomo

roles/docker-pixelfed/Todo.md

@@ -1,2 +1,2 @@
 # Todo
-- Integrate OIDC as soon as possible
+- [Integrate OIDC as soon as possible](https://github.com/pixelfed/pixelfed/pull/5608)

roles/docker-pixelfed/templates/docker-compose.yml.j2

@@ -5,7 +5,7 @@ services:
 {% include 'templates/docker/services/redis.yml.j2' %}
 
   application:
-    image: zknt/pixelfed:{{applications.pixelfed.version}}
+    image: "{{ applications[application_id].images.pixelfed }}"
 {% include 'roles/docker-compose/templates/services/base.yml.j2' %}
     volumes:
       - "data:/var/www/storage"
@@ -15,7 +15,7 @@ services:
 {% include 'templates/docker/container/depends-on-database-redis.yml.j2' %}
 {% include 'templates/docker/container/networks.yml.j2' %}
   worker:
-    image: zknt/pixelfed:{{applications.pixelfed.version}}
+    image: "{{ applications[application_id].images.pixelfed }}"
 {% include 'roles/docker-compose/templates/services/base.yml.j2' %}
     volumes:
       - "data:/var/www/storage"

roles/docker-pixelfed/templates/env.j2

@@ -131,4 +131,24 @@ TRUST_PROXIES="*"
 #PASSPORT_PRIVATE_KEY=
 #PASSPORT_PUBLIC_KEY=
 
-ENABLE_CONFIG_CACHE=true
+ENABLE_CONFIG_CACHE=true
+
+{% if applications | is_feature_enabled('oidc',application_id) %}
+
+################################### 
+# OpenID Connect settings
+###################################
+# @see https://github.com/pixelfed/pixelfed/commit/b3c27815788e4b47e7eb3fca727d817512cf26c2#diff-66e408190a301e81b5f1c079463487c54a6452c4944dc5ae80770f50101283ff
+
+PF_OIDC_ENABLED={{ applications[application_id].features.oidc | string | lower }}
+PF_OIDC_AUTHORIZE_URL="{{oidc.client.authorize_url}}"
+PF_OIDC_TOKEN_URL="{{oidc.client.token_url}}"
+PF_OIDC_PROFILE_URL="{{ oidc.client.user_info_url }}"
+PF_OIDC_LOGOUT_URL="{{oidc.client.logout_url}}"
+PF_OIDC_USERNAME_FIELD="{{oidc.attributes.username}}"
+PF_OIDC_FIELD_ID="{{oidc.attributes.username}}"
+PF_OIDC_CLIENT_SECRET={{oidc.client.secret}}
+PF_OIDC_CLIENT_ID={{oidc.client.id}}
+PF_OIDC_SCOPES="openid,profile,email"
+
+{% endif %}

roles/docker-pixelfed/vars/configuration.yml

@@ -1,5 +1,7 @@
 titel:                "Pictures on {{primary_domain}}"
-version:              "latest"
+#version:              "latest"
+images:
+  pixelfed:           "ghcr.io/pixelfed/pixelfed:latest"
 features:
   matomo:             true
   css:                true
@@ -7,6 +9,8 @@ features:
   central_database:   true
 csp:
   flags:
+    script-src:
+      unsafe-eval:   true
     script-src-elem:
       unsafe-inline: true
       unsafe-eval:   true

roles/docker-taiga/vars/configuration.yml

@@ -20,6 +20,8 @@ csp:
       unsafe-eval:   true
     style-src:
       unsafe-inline: true
+    script-src:
+      unsafe-eval:    true
 domains:
   canonical:
     - "kanban.{{ primary_domain }}"

roles/docker-wordpress/vars/configuration.yml

@@ -16,6 +16,7 @@ features:
   portfolio_iframe:   false
   oidc:               true
   central_database:   true
+version:              latest
 csp:
   flags:
     style-src:
@@ -31,7 +32,8 @@ csp:
       - "data:"
       - "https://fonts.bunny.net"
     script-src-elem:
-      - "https://cdn.gtranslate.net"
+      - "https://cdn.gtranslate.net"    # Necessary for translation plugins
+      - "https://translate.google.com"  # Necessary for translation plugins
       - "blog.{{ primary_domain }}"
     style-src:
       - "https://fonts.bunny.net"

tests/unit/test_docker_image.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+import unittest
+
+# Add filter_plugins/ to the import path
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "../../..", "filter_plugins")))
+
+from docker_image import FilterModule
+
+class TestGetDockerImage(unittest.TestCase):
+    def setUp(self):
+        self.get_docker_image = FilterModule().filters()["get_docker_image"]
+
+    def test_version_from_docker_versions(self):
+        applications = {
+            "akaunting": {
+                "version": "1.0.0",
+                "docker": {
+                    "images": { "akaunting": "docker.io/akaunting/akaunting" },
+                    "versions": { "akaunting": "2.0.0" }
+                }
+            }
+        }
+        result = self.get_docker_image(applications, "akaunting", "akaunting")
+        self.assertEqual(result, "docker.io/akaunting/akaunting:2.0.0")
+
+    def test_fallback_to_application_version(self):
+        applications = {
+            "akaunting": {
+                "version": "1.2.3",
+                "docker": {
+                    "images": { "akaunting": "ghcr.io/akaunting/akaunting" },
+                    "versions": {}
+                }
+            }
+        }
+        result = self.get_docker_image(applications, "akaunting", "akaunting")
+        self.assertEqual(result, "ghcr.io/akaunting/akaunting:1.2.3")
+
+    def test_missing_image_raises_error(self):
+        applications = {
+            "akaunting": {
+                "version": "1.0.0",
+                "docker": {
+                    "images": {},
+                    "versions": {}
+                }
+            }
+        }
+        with self.assertRaises(ValueError):
+            self.get_docker_image(applications, "akaunting", "akaunting")
+
+    def test_missing_version_raises_error(self):
+        applications = {
+            "akaunting": {
+                "docker": {
+                    "images": { "akaunting": "some/image" },
+                    "versions": {}
+                }
+            }
+        }
+        with self.assertRaises(ValueError):
+            self.get_docker_image(applications, "akaunting", "akaunting")
+
+if __name__ == "__main__":
+    unittest.main()