mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
73b21eef98
00_core.yml included 01_setup_oidc.yml only when services.sso.enabled was true, but that file carried the whole tenant bootstrap: wait for HTTP, count tenants, POST /_api/tenants, create the admin user and activate the tenant. Only its last task configured the Keycloak provider. With SSO off no tenant was ever created. Fider's RequireTenant middleware then answers every tenant route, /api/v1/tags included, with 307 to /signup, and /signup is open to any visitor, who can claim the fresh installation and become its administrator. The MCP read fider_list_tags got that 307 in the swarm SSO-off matrix row. The tenant bootstrap moves unchanged into tasks/01_tenant.yml, which 00_core.yml includes on the stack host regardless of SSO. The OIDC file becomes tasks/02_setup_oidc.yml and keeps only the provider upsert, still gated on services.sso.enabled. The README states which bootstrap steps run without SSO. A unit test evaluates the include and task guards for every SSO, stack-host and deploy-mode state: a fresh stack host posts exactly one tenant with and without SSO, an existing tenant is never posted again, the Keycloak provider is written only with SSO, and a non-stack host runs none of it. The compose matrix row with SSO off stayed green because nothing there read a tenant route. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>