mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
e11c9517b2
All 22 run: hooks in app.yml were rails and rake calls against the database, yet the launcher executes them only while building the image. Two of them carried rotating values, the OIDC client secret and the administrator password, so every rotation forced a full rebuild with bundle install and asset precompile: 961.82s in one pass and 13m16s in the next, on a job that then missed its wall-clock budget by 201s. They now run against the running instance through container exec, following the pattern web-app-openproject already uses: real .rb files under files/ruby, values through ENV.fetch, a readback that prints booleans rather than values, and an assert that fails the deploy when a rotated credential did not arrive. ensure_admin_user.rb mirrors the Y/Y path of admin:create using upstream's own grant_admin!, change_trust_level! and activate; setting the flags by hand had skipped auto_approve_user, the staff welcome message, the notification levels, trust level 1 and the email confirmation. What stays in run: is the CA trust call, which writes into the image and would not survive a recreate. With the rest gone, the bootstrap digestf47ea0e5bbrecords covers templates, expose, params, volumes, after_code and docker_args, and nothing in that set rotates. 00_core.yml carried the same IS_STACK_HOST condition three times; it now includes 04_stack_host.yml once, which holds the three with their own conditions, and their implementations moved under tasks/stack_host/. The OIDC values are read only when OIDC is enabled. Ansible resolves vars lazily, so referencing DISCOURSE_OIDC_LOGOUT_REDIRECT_URL unconditionally would have run its lookup against web-svc-logout on a deployment that has no SSO, failing where the template did not. test_oidc_setting_order.py follows the settings into apply_settings.rb. The invariant88218fc740introduced is unchanged: openid_connect_enabled comes after the discovery document, the client id and the client secret. Four explanatory "# Exception:" comments are removed, two of them fromf47ea0e5bb. They described mechanisms rather than naming a trip-wire, which belongs in a commit body. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
18 lines
904 B
Ruby
18 lines
904 B
Ruby
# nocheck: mirrored-unit-test - reads SiteSetting and User out of the booted
|
|
# application, neither of which exists outside the Discourse console
|
|
|
|
email = ENV.fetch("DISCOURSE_ADMIN_EMAIL")
|
|
password = ENV.fetch("DISCOURSE_ADMIN_PASSWORD")
|
|
|
|
user = User.find_by_email(email)
|
|
puts "administrator_present=#{!user.nil?}"
|
|
puts "administrator_admin=#{user&.admin == true}"
|
|
puts "administrator_active=#{user&.active == true}"
|
|
puts "administrator_password_matches=#{user&.confirm_password?(password) == true}"
|
|
|
|
if ENV.fetch("DISCOURSE_OIDC_ENABLED") == "true"
|
|
puts "oidc_secret_matches=#{SiteSetting.openid_connect_client_secret == ENV.fetch('DISCOURSE_OIDC_CLIENT_SECRET')}"
|
|
puts "oidc_enabled=#{SiteSetting.openid_connect_enabled == true}"
|
|
puts "oidc_host_allowed=#{SiteSetting.allowed_internal_hosts.to_s.split('|').any? { |h| SiteSetting.openid_connect_discovery_document.to_s.include?(h.strip) }}"
|
|
end
|