mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
155c903b6b
08_users/realm.yml seeded the realm from `lookup('users') | non_reserved_users`
while 08_rbac_groups_realm.yml built group memberships from the raw
`lookup('users')`. The membership builder has its own guards, but both are dead
against real data: across all 269 default users, none carries a `reserved` key
and none has an empty password. So membership was effectively unfiltered while
seeding filtered on `accounts`.
helpdesk and no-reply (accounts: [mailbox], roles: [bot]) were therefore
demanded as members of roles/web-app-mailu/bot but never created, and
ensure_group_path_members.sh exits 1 on the first miss. Four jobs -- Mattermost 1,
Friendica 1, Matrix 1, OpenProject 1 -- each burned five cross-node recovery
attempts on a data failure no reschedule could fix.
Rather than adding the filter at the site that forgot it, remove the ability to
forget: lookup('users_non_reserved') resolves users and applies the predicate in
one place, and all four consumers now read it -- the two Keycloak user tasks, the
RBAC group builder, and OPENLDAP_USERS, which had it right all along. The filter
stays as the pure predicate the lookup calls.
Reproduced offline against the real user model, byte-identical to the CI member
list: before, bot demanded helpdesk and no-reply; after, members are exactly the
four seeded accounts.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
47 lines
2.3 KiB
YAML
47 lines
2.3 KiB
YAML
---
|
|
application_id: "svc-db-openldap"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
OPENLDAP_PORT: "{{ lookup('config', application_id, 'services.openldap.ports.local.ldap') }}"
|
|
OPENLDAP_SERVER_URI: "ldap://{{ DOCKER_REACH_HOST }}:{{ OPENLDAP_PORT }}"
|
|
|
|
OPENLDAP_CONFIG_URI: "ldapi:///"
|
|
|
|
OPENLDAP_LDIF_PATH_HOST: "{{ lookup('container', application_id, 'directories.volumes') }}ldif/"
|
|
OPENLDAP_LDIF_PATH_DOCKER: "/tmp/ldif/"
|
|
OPENLDAP_LDIF_TYPES:
|
|
- configuration
|
|
- groups
|
|
|
|
OPENLDAP_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
|
|
OPENLDAP_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
|
|
OPENLDAP_IMAGE: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.image') }}"
|
|
OPENLDAP_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.version') }}"
|
|
OPENLDAP_SERVICE: "{{ entity_name }}"
|
|
OPENLDAP_BIND_DN: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
|
|
OPENLDAP_BIND_PW: "{{ LDAP.BIND_CREDENTIAL }}"
|
|
|
|
OPENLDAP_NETWORK_SWITCH_PUBLIC: "{{ lookup('config', application_id, 'services.openldap.network.public') }}"
|
|
OPENLDAP_NETWORK_SWITCH_LOCAL: "{{ lookup('config', application_id, 'services.openldap.network.local') }}"
|
|
OPENLDAP_EXPOSED: "{{ lookup('config', application_id, 'services.openldap.exposed') | bool }}"
|
|
OPENLDAP_NETWORK_EXPOSE_LOCAL: "{{ OPENLDAP_NETWORK_SWITCH_PUBLIC | bool or OPENLDAP_NETWORK_SWITCH_LOCAL | bool or OPENLDAP_EXPOSED | bool }}"
|
|
|
|
OPENLDAP_PROVISION_CONFIGURATION: "{{ lookup('config', application_id, 'services.openldap.provision.configuration') }}"
|
|
OPENLDAP_PROVISION_CREDENTIALS: "{{ lookup('config', application_id, 'services.openldap.provision.credentials') }}"
|
|
OPENLDAP_PROVISION_SCHEMAS: "{{ lookup('config', application_id, 'services.openldap.provision.schemas') }}"
|
|
OPENLDAP_PROVISION_USERS: "{{ lookup('config', application_id, 'services.openldap.provision.users') }}"
|
|
OPENLDAP_PROVISION_GROUPS: "{{ lookup('config', application_id, 'services.openldap.provision.groups') }}"
|
|
OPENLDAP_PROVISION_UPDATE: "{{ lookup('config', application_id, 'services.openldap.provision.update') }}"
|
|
OPENLDAP_USERS: "{{ lookup('users_non_reserved') }}"
|
|
|
|
OPENLDAP_PYTHON_HEADER_PACKAGE_TEMPLATES_BY_OS_FAMILY:
|
|
Debian:
|
|
- python__PY_MM__-dev
|
|
- python3-dev
|
|
RedHat:
|
|
- python__PY_MM__-devel
|
|
- python__PY_MM_NODOT__-devel
|
|
- python3-devel
|
|
Archlinux:
|
|
- python
|