mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
e96c752549
75 commits: the socialhome role reimplemented against the project it actually
deploys, native-login specs for funkwhale and shopware, a window.open IdP
handoff and a settings-link fallback in the shared persona helpers, a swarm
converge budget that gives up on a terminal task, and a long tail of role
fixes.
Eleven conflicts. The shared persona helpers (keycloak.js, logout.js) take the
incoming structure — they gained real behaviour this branch never had — with
this branch's resolveTimeout convention re-applied over it and
confirmKeycloakLogoutIfPrompted re-attached at every return point; without it
the Keycloak SSO session outlives the logout. playwright.config.js keeps this
branch's version: both sides set actionTimeout, but ours routes through an env
var and 15s is too short behind an onion. socialhome's spec takes the incoming
content — 2dbd6eb10 found the role described the wrong upstream project
entirely — and keeps gotoOnion and expectHstsWhenTls, since demanding HSTS over
a plaintext onion is a false failure. Both READMEs were regenerated rather than
merged by hand.
Three collisions arrived with no conflict marker at all, because each side
changed a different place in a different file:
- group_vars/all/18_swarm.yml declared swarm_stack_converge_retries twice.
Same value, so nothing breaks today; editing the documented one would have
silently changed nothing.
- svc-net-tor and web-app-socialhome both claimed 192.168.74.0/24. Socialhome,
the newer role, moves to 192.168.75.0/24.
- web-app-socialhome/meta/schema.yml arrived as a new file, so ef5ea7cb5's
rename never saw it. Its credential would not have resolved and the role
would have deployed with an unusable administrator account.
The incoming specs also needed this branch's conventions: raw timeouts wrapped,
four page.goto calls routed through gotoOnion, a request.get given an
onion-aware timeout, and 21 roles marked playwright-service-flag over the tor
block this branch added to them.
make quality green on the merge result.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
53 lines
3.3 KiB
Bash
53 lines
3.3 KiB
Bash
# Bluesky's OIDC integration is the variant-A+ login-broker (roles/web-app-bluesky/files/login-broker/);
|
|
# the OIDC marker keys off services.sso.enabled (oauth2-proxy sidecar is the user-facing OIDC
|
|
# entry point) and the LDAP marker keys off services.ldap.enabled (set by the LDAP variant in
|
|
# meta/variants.yml). RBAC is intentionally not mappable (PDS knows only "account exists / does not
|
|
# exist") and is documented as a SSO/RBAC exception in README.md per lifecycle.md. The social-app UI
|
|
# is mobile-first: the logout/account control lives behind a profile menu deep in the SPA, not in a
|
|
# top-level chrome bar that the persona-flow auth-surface check can reach. The bespoke "OIDC:
|
|
# oauth2-proxy + login-broker drop a Bluesky session into social-app via Keycloak (variant A+)" test
|
|
# already proves biber authenticates via the broker (verifies BSKY_STORAGE.accessJwt is present),
|
|
# and the bespoke LDAP variant test proves the same chain under LDAP federation. Both personas are
|
|
# therefore blocked at the generic dashboard → app → logout persona-flow level — the role's OIDC +
|
|
# LDAP tests carry the equivalent contract.
|
|
|
|
ADMIN_HANDLE={{ BLUESKY_ADMIN_HANDLE | dotenv_quote }}
|
|
|
|
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}
|
|
|
|
BLUESKY_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — LDAP is disabled for this role; the flag renders for deploy-fixture parity but no persona scenario gates it.
|
|
LDAP_SERVICE_ENABLED={{ BLUESKY_LDAP_ENABLED | string | lower }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
NODE_TLS_REJECT_UNAUTHORIZED=0
|
|
|
|
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
|
|
|
|
|
|
PDS_BASE_URL={{ lookup('canonical_url', application_id, 'api') | dotenv_quote }}
|
|
|
|
# nocheck: persona-block-rationale — the PDS knows no role beyond "account exists / does not exist" (README "Single Sign-On" records this as the documented RBAC exception), so there is no admin surface for the helper's adminInteraction; the administrator's PDS identity is the derived handle `kc-<username>.<domain>` (vars/main.yml BLUESKY_ADMIN_HANDLE) and is administered through the `pdsadmin` CLI (Administration.md), not a browser panel.
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — social-app is a mobile-first SPA whose logout control sits behind a profile menu the shared auth-surface check cannot reach; the role's own login-broker OIDC test and its LDAP counterpart already prove the Keycloak → broker → BSKY_STORAGE.accessJwt handoff (see TODO.md and the file header).
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|