mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 19:32:17 +00:00
kevinveenbirkenbachandClaude Opus 5
f713ba8350
meta/schema.yml became meta/secrets.yml, but its content still landed at
applications.<app>.credentials — the one meta file whose payload did not sit
under a root named after the file. Every other topic obeys that rule:
meta/volumes.yml goes to volumes, meta/rbac.yml to rbac. Credentials now go to
secrets.credentials.
The path exists exactly once, in utils/manager/credential_key.py, and
OVERRIDE_SECTION is derived from its two segments rather than spelled beside
them, so the dotted form used by --set and the nested form used by the
inventory cannot drift. Six consumers read it: the loader, the generator, the
CLI override parser, the two emit helpers, and the four lookup validators.
--set now accepts exactly one key shape,
applications.<app>.secrets.credentials.<key>. The three short forms are
rejected instead of guessed at: the same short key names different credentials
on different apps. That also retired primary_app_id, which only existed to
disambiguate them.
Three defects surfaced while wiring this up. _apply_one_role_schema still wrote
to the old root, so an app's own credentials would have moved while its
providers' stayed behind. web-app-pgadmin reads through
lookup('applications', ...).credentials.<key>, an access path no regex over
lookup('config', ...) could see, and would have deployed with an empty postgres
password. And _META_NON_GENERIC_TOPICS still listed 'schema' — a bare topic
name, invisible to any path search — so the generic file-root loop assigned the
raw schema under secrets and the follow-up write landed inside the cached
document, truncating keycloak's four credentials to one for every later
reader.
tests/integration/ansible/lookups/config/test_credentials_roundtrip.py pins both
directions of the seam and the cache invariant that last defect broke.
Existing inventories still carry the pre-rename root; migrating them is
deliberately out of scope here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
56 lines
3.1 KiB
YAML
56 lines
3.1 KiB
YAML
---
|
|
application_id: "web-app-bookwyrm"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
container_port: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.ports.internal.http') }}"
|
|
container_hostname: "{{ lookup('container_hostname', application_id) }}"
|
|
|
|
BOOKWYRM_REGISTRATION_OPEN: "{{ lookup('config', application_id, 'services.bookwyrm.registration_open') | string | lower }}"
|
|
BOOKWYRM_ALLOW_INVITE_REQUESTS: "{{ lookup('config', application_id, 'services.bookwyrm.allow_invite_request') | string | lower }}"
|
|
|
|
BOOKWYRM_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
|
|
|
|
BOOKWYRM_URL: "{{ lookup('tls', application_id, 'url.base') }}"
|
|
BOOKWYRM_HOSTNAME: "{{ lookup('domain', application_id) }}"
|
|
|
|
BOOKWYRM_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
BOOKWYRM_OIDC_LABEL: "{{ OIDC.BUTTON_TEXT }}"
|
|
BOOKWYRM_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
|
|
BOOKWYRM_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET }}"
|
|
BOOKWYRM_OIDC_ISSUER: "{{ OIDC.CLIENT.ISSUER_URL }}"
|
|
BOOKWYRM_OIDC_AUTH_URL: "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
|
|
BOOKWYRM_OIDC_TOKEN_URL: "{{ OIDC.CLIENT.TOKEN_URL }}"
|
|
BOOKWYRM_OIDC_USERINFO_URL: "{{ OIDC.CLIENT.USER_INFO_URL }}"
|
|
BOOKWYRM_OIDC_LOGOUT_URL: "{{ OIDC.CLIENT.LOGOUT_URL }}"
|
|
BOOKWYRM_OIDC_JWKS_URL: "{{ OIDC.CLIENT.CERTS }}"
|
|
BOOKWYRM_OIDC_SCOPES: "openid,email,profile"
|
|
BOOKWYRM_OIDC_UNIQUE_ATTRIBUTE: "{{ OIDC.ATTRIBUTES.USERNAME }}"
|
|
BOOKWYRM_SSO_PROXY_GATED: "{{ lookup('sso', application_id, 'is_proxy_gated') }}"
|
|
|
|
BOOKWYRM_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.name') }}"
|
|
BOOKWYRM_IMAGE: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.image') }}"
|
|
BOOKWYRM_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.version') }}"
|
|
BOOKWYRM_REPOSITORY: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.repository') }}"
|
|
BOOKWYRM_REF: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.ref') }}"
|
|
BOOKWYRM_WORKER_CONTAINER: "{{ lookup('config', application_id, 'services.worker.name') }}"
|
|
BOOKWYRM_MIGRATE_CONTAINER: "{{ lookup('config', application_id, 'services.migrate.name') }}"
|
|
|
|
BOOKWYRM_REDIS_HOST: "{{ lookup('engine', 'redis', application_id, 'host') }}"
|
|
BOOKWYRM_REDIS_PORT: "{{ lookup('engine', 'redis', application_id, 'port') }}"
|
|
BOOKWYRM_REDIS_BASE_URL: "{{ lookup('engine', 'redis', application_id, 'url') }}"
|
|
BOOKWYRM_REDIS_BROKER_URL: "{{ BOOKWYRM_REDIS_BASE_URL }}/0"
|
|
BOOKWYRM_REDIS_CACHE_URL: "{{ BOOKWYRM_REDIS_BASE_URL }}/1"
|
|
BOOKWYRM_REDIS_BROKER_DB: 0
|
|
BOOKWYRM_REDIS_ACTIVITY_DB: 1
|
|
BOOKWYRM_BROKER_URL: "{{ BOOKWYRM_REDIS_BROKER_URL }}"
|
|
BOOKWYRM_REDIS_ACTIVITY_URL: "{{ BOOKWYRM_REDIS_CACHE_URL }}"
|
|
|
|
BOOKWYRM_EMAIL: "{{ lookup('email', application_id) }}"
|
|
EMAIL_HOST: "{{ BOOKWYRM_EMAIL.host }}"
|
|
EMAIL_PORT: "{{ BOOKWYRM_EMAIL.port }}"
|
|
EMAIL_HOST_USER: "{{ BOOKWYRM_EMAIL.username }}"
|
|
EMAIL_HOST_PASSWORD: "{{ BOOKWYRM_EMAIL.password }}"
|
|
EMAIL_USE_TLS: "{{ BOOKWYRM_EMAIL.tls | bool | string | lower }}"
|
|
EMAIL_USE_SSL: "{{ (not (BOOKWYRM_EMAIL.tls | bool)) | string | lower }}"
|
|
EMAIL_DEFAULT_FROM: "BookWyrm <{{ BOOKWYRM_EMAIL['from'] }}>"
|