mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
487c4c5d44
EspoCRM resolves authenticationMethod against metadata files whose keys are their filenames, and the file is LDAP.json. The value 'Ldap' matched no key, and the generated fallback class Logins\Ldap does not exist in any casing, so InjectableFactory raised before any directory I/O - HTTP 500 in 37ms on every authenticated request of the LDAP-only variant. Making LDAP resolve exposes a second break: the directory bind now really runs, while the shared persona prefers ADMIN_NATIVE_PASSWORD, EspoCRM's app-local secret, over the directory password. Omit that key when LDAP is on so admin.js falls through to ADMIN_PASSWORD. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
42 lines
2.8 KiB
Bash
42 lines
2.8 KiB
Bash
{% if not ESPOCRM_LDAP_ENABLED | bool %}
|
|
ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
|
|
{% endif %}
|
|
|
|
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('config', application_id, 'users.administrator.username') | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — web-svc-css injects the shared stylesheet; the persona CSP helper resolves injectors through a computed loop, never a literal gate argument
|
|
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — templates/env.j2 hands SMTP to the app via ESPOCRM_CONFIG_SMTP_*; no persona surface sends mail, real delivery is asserted in roles/web-app-mailu/files/playwright/playwright.spec.js
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — the persona drives the OIDC login path; ESPOCRM_CONFIG_AUTHENTICATION_METHOD=LDAP is exercised in the LDAP-only matrix variant
|
|
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — the EspoCRM installer aborts without ESPOCRM_DATABASE_*, so every rendered page already proves MariaDB
|
|
MARIADB_SERVICE_ENABLED={{ lookup('config', application_id, 'services.mariadb.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
# nocheck: persona-block-rationale — biber only ever exists in EspoCRM through OIDC auto-provisioning (ESPOCRM_CONFIG_OIDC_CREATE_USER=true, templates/env.j2:67); the role seeds only the administrator (env.j2:12-13), so the sso: false variants leave biber without any account (see README "Persona contract opt-outs").
|
|
PERSONA_BIBER_BLOCKED={{ 'false' if (lookup('config', application_id, 'services.sso.enabled') | bool) else 'true' }}
|
|
|
|
# nocheck: playwright-service-gate — reCAPTCHA v3 guards the native login form with live Google keys that a headless persona cannot satisfy
|
|
RECAPTCHA_SERVICE_ENABLED={{ lookup('config', application_id, 'services.recaptcha.enabled') | string | lower }}
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|