mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
15e7647d2f
New roles/sys-svc-container/templates/env.j2 sets TZ={{ HOST_TIMEZONE }} and LANG=C.UTF-8. Every role env.j2 includes it at the top; it renders via stack_host_template, the same engine that resolves the includes in compose.yml.j2, so it works in both compose and swarm. TZ/LANG are removed from the individual role env.j2 so each value stays single-source.
New lint tests/lint/ansible/test_env_base_include.py verifies every role env.j2 includes the base and never re-sets a base-owned key (keys derived from the base file).
mattermost and gitea meta/volumes.yml drop the /etc/timezone host-path bind: swarm hard-rejects a task whose bind source is missing on the node (Debian-trixie nodes have no /etc/timezone). TZ now comes from the base env. /etc/localtime bind also dropped; the container timezone follows TZ.
Non-directive comments were removed from the touched env.j2 (banners, restatements, reference URLs, narration) so the changed files pass the comment-lint; only tool directives remain.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
50 lines
2.3 KiB
Django/Jinja
50 lines
2.3 KiB
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
RAILS_ENV={{ ENVIRONMENT }}
|
|
RAILS_LOG_TO_STDOUT={{ MODE_DEBUG | lower }}
|
|
RAILS_SERVE_STATIC_FILES=true
|
|
|
|
SECRET_KEY_BASE={{ DECIDIM_SECRET_KEY_BASE }}
|
|
DATABASE_URL=postgresql://{{ lookup('database', application_id, 'username') }}:{{ lookup('database', application_id, 'password') | replace('/', '%2F') | replace('@', '%40') }}@{{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}/{{ lookup('database', application_id, 'name') }}?sslmode=disable
|
|
REDIS_URL={{ lookup('engine', 'redis', application_id, 'url') }}/0
|
|
|
|
{% if lookup('objstore', application_id, 'enabled') | bool %}
|
|
STORAGE_PROVIDER=s3
|
|
AWS_BUCKET={{ lookup('objstore', application_id, 'bucket') }}
|
|
AWS_ACCESS_KEY_ID={{ lookup('objstore', application_id, 'access_key') }}
|
|
AWS_SECRET_ACCESS_KEY={{ lookup('objstore', application_id, 'secret_key') }}
|
|
AWS_ENDPOINT={{ lookup('objstore', application_id, 'public_url') | regex_replace('/[^/]+/?$', '') }}
|
|
AWS_REGION={{ lookup('objstore', application_id, 'region') }}
|
|
AWS_PUBLIC={{ lookup('objstore', application_id, 'public') | string | lower }}
|
|
{% endif %}
|
|
|
|
DECIDIM_APPLICATION_NAME={{ DECIDIM_ORGANIZATION_NAME }}
|
|
DECIDIM_FORCE_SSL={{ lookup('tls', application_id, 'enabled') | string | lower }}
|
|
DECIDIM_ALLOW_OPEN_REDIRECTS=false
|
|
PORT=3000
|
|
RAILS_HOSTS={{ lookup("tls", application_id, "url.base") | regex_replace("https?://", "") | regex_replace("/+$", "") }}
|
|
APPLICATION_HOST={{ lookup('tls', application_id, 'url.base') }}
|
|
|
|
LOG_LEVEL={% if MODE_DEBUG | bool %}debug{% else %}info{% endif %}
|
|
|
|
{% set email = lookup('email', application_id) %}
|
|
{% if email.enabled | bool %}
|
|
SMTP_ADDRESS={{ email.host }}
|
|
SMTP_PORT={{ email.port }}
|
|
SMTP_USERNAME={{ email.username }}
|
|
SMTP_PASSWORD={{ email.password | dotenv_quote }}
|
|
SMTP_AUTHENTICATION=login
|
|
SMTP_STARTTLS_AUTO={{ lookup('tls', application_id, 'enabled') | string | lower }}
|
|
MAILER_SENDER={{ DECIDIM_ORGANIZATION_NAME }} <{{ email['from'] }}>
|
|
{% endif %}
|
|
|
|
{% if DECIDIM_OIDC_ENABLED | bool %}
|
|
OIDC_ENABLED=true
|
|
OIDC_CLIENT_ID={{ DECIDIM_OIDC_CLIENT_ID }}
|
|
OIDC_CLIENT_SECRET={{ DECIDIM_OIDC_CLIENT_SECRET }}
|
|
OIDC_ISSUER={{ DECIDIM_OIDC_ISSUER }}
|
|
OIDC_AUTHORIZE_URL={{ DECIDIM_OIDC_AUTHORIZE_URL }}
|
|
OIDC_TOKEN_URL={{ DECIDIM_OIDC_TOKEN_URL }}
|
|
OIDC_USER_INFO_URL={{ DECIDIM_OIDC_USER_INFO_URL }}
|
|
{% endif %}
|