mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
f713ba8350
meta/schema.yml became meta/secrets.yml, but its content still landed at
applications.<app>.credentials — the one meta file whose payload did not sit
under a root named after the file. Every other topic obeys that rule:
meta/volumes.yml goes to volumes, meta/rbac.yml to rbac. Credentials now go to
secrets.credentials.
The path exists exactly once, in utils/manager/credential_key.py, and
OVERRIDE_SECTION is derived from its two segments rather than spelled beside
them, so the dotted form used by --set and the nested form used by the
inventory cannot drift. Six consumers read it: the loader, the generator, the
CLI override parser, the two emit helpers, and the four lookup validators.
--set now accepts exactly one key shape,
applications.<app>.secrets.credentials.<key>. The three short forms are
rejected instead of guessed at: the same short key names different credentials
on different apps. That also retired primary_app_id, which only existed to
disambiguate them.
Three defects surfaced while wiring this up. _apply_one_role_schema still wrote
to the old root, so an app's own credentials would have moved while its
providers' stayed behind. web-app-pgadmin reads through
lookup('applications', ...).credentials.<key>, an access path no regex over
lookup('config', ...) could see, and would have deployed with an empty postgres
password. And _META_NON_GENERIC_TOPICS still listed 'schema' — a bare topic
name, invisible to any path search — so the generic file-root loop assigned the
raw schema under secrets and the follow-up write landed inside the cached
document, truncating keycloak's four credentials to one for every later
reader.
tests/integration/ansible/lookups/config/test_credentials_roundtrip.py pins both
directions of the seam and the cache invariant that last defect broke.
Existing inventories still carry the pre-rename root; migrating them is
deliberately out of scope here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
60 lines
2.3 KiB
Django/Jinja
60 lines
2.3 KiB
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
MUSIC_DIRECTORY_PATH={{FUNKWHALE_MUSIC_DIR}}
|
|
|
|
FUNKWHALE_WEB_WORKERS=4
|
|
FUNKWHALE_HOSTNAME={{ lookup('domain',application_id) }}
|
|
FUNKWHALE_PROTOCOL={{ lookup('tls', application_id, 'protocols.web') }}
|
|
|
|
LOGLEVEL={% if MODE_DEBUG | bool %}debug{% else %}error{% endif %}
|
|
|
|
DJANGO_LOGLEVEL={% if MODE_DEBUG | bool %}debug{% else %}error{% endif %}
|
|
|
|
{% set email = lookup('email', application_id) %}
|
|
{% if email.enabled | bool %}
|
|
EMAIL_CONFIG=smtp+tls://{{ lookup('users', 'no-reply').username }}:{{ email.password }}@{{ email.host }}:{{ email.port }}
|
|
|
|
DEFAULT_FROM_EMAIL={{ email['from'] }}
|
|
{% endif %}
|
|
|
|
REVERSE_PROXY_TYPE=nginx
|
|
|
|
FUNKWHALE_API_PORT={{ FUNKWHALE_DOCKER_API_PORT }}
|
|
|
|
CELERYD_CONCURRENCY={{FUNKWHALE_CELERYD_CONCURRENCY}}
|
|
|
|
MEDIA_ROOT={{ FUNKWHALE_MEDIA_DIR }}
|
|
|
|
{% if lookup('objstore', application_id, 'enabled') | bool %}
|
|
AWS_ACCESS_KEY_ID={{ lookup('objstore', application_id, 'access_key') }}
|
|
AWS_SECRET_ACCESS_KEY={{ lookup('objstore', application_id, 'secret_key') }}
|
|
AWS_STORAGE_BUCKET_NAME={{ lookup('objstore', application_id, 'bucket') }}
|
|
AWS_S3_ENDPOINT_URL={{ lookup('objstore', application_id, 'url') }}
|
|
AWS_S3_REGION_NAME={{ lookup('objstore', application_id, 'region') }}
|
|
PROXY_MEDIA=true
|
|
{% endif %}
|
|
|
|
STATIC_ROOT={{FUNKWHALE_STATIC_DIR}}
|
|
|
|
DJANGO_SETTINGS_MODULE=config.settings.production
|
|
|
|
DJANGO_SECRET_KEY={{ lookup('config', application_id, 'secrets.credentials.django_secret')}}
|
|
|
|
{% if lookup('config',application_id, 'services.ldap.enabled', False) %}
|
|
LDAP_ENABLED=True
|
|
LDAP_SERVER_URI={{ LDAP.SERVER.URI }}
|
|
LDAP_BIND_DN={{ LDAP.DN.ADMINISTRATOR.DATA }}
|
|
LDAP_BIND_PASSWORD={{ LDAP.BIND_CREDENTIAL | dotenv_quote }}
|
|
LDAP_SEARCH_FILTER={{ LDAP.FILTERS.USERS.LOGIN | replace('%' ~ LDAP.USER.ATTRIBUTES.ID, '{0}') }}
|
|
LDAP_START_TLS=False
|
|
LDAP_ROOT_DN={{ LDAP.DN.ROOT }}
|
|
LDAP_USER_ATTR_MAP=username:{{ LDAP.USER.ATTRIBUTES.ID }},first_name:{{ LDAP.USER.ATTRIBUTES.FIRSTNAME }},last_name:{{ LDAP.USER.ATTRIBUTES.SURNAME }},email:{{ LDAP.USER.ATTRIBUTES.MAIL }}
|
|
{% endif %}
|
|
|
|
FUNKWHALE_FRONTEND_PATH=/srv/funkwhale/front/dist
|
|
|
|
DATABASE_URL={{ lookup('database', application_id, 'url_full') }}
|
|
CACHE_URL={{ lookup('engine', 'redis', application_id, 'url') }}/0
|
|
WEB_CONCURRENCY={{ POSTGRES_ALLOWED_AVG_CONNECTIONS }}
|
|
WORKER_THREADS={{ POSTGRES_ALLOWED_AVG_CONNECTIONS | int // 2 }}
|