mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
ab72cff929
7a70d27b7 made a variant that switches SSO on also switch the onion on, because
that pairing is where the platform breaks in ways clearnet never shows. The same
argument reaches further than SSO: a Secure cookie is dropped, an https identity
provider refuses to embed, and crypto.subtle is undefined for any feature on a
non-secure origin, not only for a login. A variant that never runs the onion is
not testing the deployment users get.
So the rule now covers every variant of a role that declares a tor block.
Variant 1 stays exempt - it is the minimal, partner-free round every role
declares and the one place the stack is exercised without the onion at all - and
a role whose meta/services.yml pins tor.enabled to a literal false is skipped
outright, because that declaration already says the role has no onion and needs
no comment repeating it.
That found 137 variants. 101 were variant 1. Of the rest, 28 are the LDAP-only
auth-isolation rounds, which gain real coverage from running LDAP over the onion
and are flipped on here. Four cannot: svc-net-tor is the provider itself, and
nextcloud's variant 8 pairs the clearnet-only PeerTube. Both carry a marker
naming the reason; opentalk and coturn need none, since their services.yml pins
the literal false the rule now reads.
Flipping them exposed a contract that contradicted itself. test_auth_isolation
and test_non_baseline_explicit_disables demanded `shared: false` beside
`enabled: false`, while variants-static-override flagged that same line as a
static override - which is why all 133 of them carried a nocheck marker. The
demand only makes sense where `shared` is dynamic: a literal base value cannot
leak through deep-merge, so restating it protects nothing. Both contracts now
ask for it only in that case, and the 133 lines are gone.
The result is a stricter rule with fewer lines: 189 insertions against 193
deletions.
Verified: tests/lint 336 passed / 307 subtests, tests/integration/roles 107
passed / 610 subtests. The rule is checked in both directions - it reported 137
offenders before the resolution and none after.
Not measured: 28 additional onion rounds cost matrix wall-clock, against swarm
jobs already capped at 355 minutes and one that has hit that ceiling before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
25 lines
885 B
YAML
25 lines
885 B
YAML
---
|
|
# Matrix-deploy variant overrides for svc-net-tor.
|
|
# See docs/contributing/artefact/files/role/variants.md for the file format.
|
|
#
|
|
# nocheck: sso-variant-tor — this role IS the onion provider; its tor block is the
|
|
# provider definition, not a consumer gate, so there is nothing to pin on.
|
|
|
|
# Test deployments run without guard pinning so a single degraded entry guard
|
|
# cannot stall the whole node; production keeps the Tor default (true). They
|
|
# also join a private chutney Tor net (offline, localhost-speed onion publish
|
|
# and rendezvous) whose ~9 extra in-container tor nodes need a larger resource
|
|
# footprint than the public flavor.
|
|
- services:
|
|
tor:
|
|
use_entry_guards: false # nocheck: variants-static-override
|
|
flavor: chutney
|
|
cpus: "1.0"
|
|
mem_limit: 2g
|
|
pids_limit: 512
|
|
|
|
- services:
|
|
tor:
|
|
use_entry_guards: false
|
|
flavor: public
|