0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 c55f508e05 feat(readme): draw mandatory and disabled service relations

The cosmos generator linked a consumer to its provider only through an
'<role>' in group_names reference or an explicit provides: name. A hard
dependency has neither -- pinning the provider on unconditionally is
exactly what removes the Jinja reference the generator was reading -- so
web-svc-asset's bond to web-svc-file vanished from the diagram the moment
it became binding. Match a service key against the provider's own primary
key from the registry, in both directions.

Services the role turns off drew a solid 1:1 edge, claiming a mandatory
relationship for something that carries nothing at deploy time. They now
render as a red 0..0 edge; edge merging gained a real precedence so a
provider consumed through two keys stays live when only one is off.

Named colour, not hex: a '#' opens an entity code in the mermaid lexer and
turns the whole diagram into a parse error on GitHub.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-17 18:02:31 +02:00

2.8 KiB

Raw Permalink Blame History

Health CSP Crawler

Description

This Ansible role automates the validation of Content Security Policy (CSP) enforcement for all configured domains by crawling them using a CSP Checker.

Overview

Designed for Archlinux systems, this role periodically checks whether web resources (JavaScript, fonts, images, etc.) are blocked by CSP headers. It integrates Python and Node.js tooling and installs a systemd service with timer support.

Cosmos

The diagram places Health CSP Crawler in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-ctl-hlth-csp 💻]
        svc_csp["csp"]
        svc_csp_checker["csp-checker"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

CSP Resource Validation: Uses Puppeteer to simulate browser requests and detect blocked resources.
Domain Extraction: Parses all .conf files in the NGINX config folder to determine the list of domains to check.
Automated Execution: Registers a systemd service and timer for recurring health checks.
Error Notification: Integrates with sys-ctl-alm-compose for alerting on failure.
Ignore List Support: Optional variable to suppress network block reports from specific external domains.

Configuration

Variables

HEALTH_CSP_IGNORE_NETWORK_BLOCKS_FROM (list, default: [])
Optional list of domains whose network block failures (e.g., ORB) should be ignored during CSP checks.

Example:

HEALTH_CSP_IGNORE_NETWORK_BLOCKS_FROM:
  - pxscdn.com
  - cdn.example.org

This will run the CSP checker with:

checkcsp start --short --ignore-network-blocks-from pxscdn.com -- cdn.example.org <domains...>

Systemd Integration

The role configures a systemd service and timer which executes the CSP crawler periodically against all NGINX domains.

License

Infinito.Nexus Community License (Non-Commercial) https://s.infinito.nexus/license

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

2.8 KiB Raw Permalink Blame History