mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c59e2838d6
In swarm, `docker stack deploy` drops the host IP of a short port mapping, so a `127.0.0.1:<ports.local>` publish lands on the ingress routing mesh on every node. The provisioning of these three roles only worked because the mesh answered on the host: - web-app-gitea waited for `DOCKER_REACH_HOST:<ports.local.http>` with wait_for and polled `/api/v1/version` there with uri_retry. - web-app-shopware waited for `DOCKER_REACH_HOST:<ports.local.http>`. - web-app-fider bootstrapped its first tenant in swarm by POSTing to `127.0.0.1:<ports.local.http>` on the hosting node. As long as these calls depend on the mesh, container_ports cannot stop publishing loopback ports in swarm. The probes now run inside the service's own container through the resolved `<PREFIX>_LOCAL_CID` on `<PREFIX>_HOST_NODE`, against the internal port: - Gitea uses the curl it ships. The first wait accepts any HTTP answer, as wait_for did. The post-migration wait still requires 200. - Shopware runs the wget probe its compose healthcheck already uses. - Fider ships no HTTP client, so bash writes the tenant POST to /dev/tcp. The body comes in on stdin and the status line is checked for 200/201. Fider's compose path is unchanged. The compose render of all three roles is unchanged. The host-side ingress guard from svc-swarm-node stays in place until the remaining host-side consumers are moved. Refs #1089 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
82 lines
4.5 KiB
YAML
82 lines
4.5 KiB
YAML
---
|
|
application_id: "web-app-gitea"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
GITEA_LDAP_AUTH_ARGS:
|
|
- '--name "LDAP ({{ DOMAIN_PRIMARY }})"'
|
|
- '--host "{{ LDAP.SERVER.DOMAIN }}"'
|
|
- "--port {{ LDAP.SERVER.PORT }}"
|
|
- '--security-protocol "{{ LDAP.SERVER.SECURITY | trim or "unencrypted" }}"'
|
|
- '--bind-dn "{{ LDAP.DN.ADMINISTRATOR.DATA }}"'
|
|
- '--bind-password "{{ LDAP.BIND_CREDENTIAL }}"'
|
|
- '--user-search-base "{{ LDAP.DN.OU.USERS }}"'
|
|
- '--user-filter "(&(objectClass=inetOrgPerson)(uid=%s))"'
|
|
- '--admin-filter "(memberOf=cn={{ application_id }}-administrator,{{ LDAP.DN.OU.ROLES }})"'
|
|
- '--username-attribute "{{ LDAP.USER.ATTRIBUTES.ID }}"'
|
|
- '--firstname-attribute "{{ LDAP.USER.ATTRIBUTES.FIRSTNAME }}"'
|
|
- '--surname-attribute "{{ LDAP.USER.ATTRIBUTES.SURNAME }}"'
|
|
- '--email-attribute "{{ LDAP.USER.ATTRIBUTES.MAIL }}"'
|
|
- '--public-ssh-key-attribute "{{ LDAP.USER.ATTRIBUTES.SSH_PUBLIC_KEY }}"'
|
|
- "--synchronize-users"
|
|
GITEA_CONTAINER: "{{ lookup('config', application_id, 'services.gitea.name') }}"
|
|
GITEA_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
|
|
GITEA_USER: "git"
|
|
GITEA_CONFIG: "/data/gitea/conf/app.ini"
|
|
GITEA_LOOPBACK_VERSION_URL: "http://127.0.0.1:{{ lookup('config', application_id, 'services.gitea.ports.internal.http') }}/api/v1/version"
|
|
|
|
GITEA_REDIS_ENABLED: "{{ lookup('config', application_id, 'services.redis.enabled') }}"
|
|
GITEA_REDIS_ADDRESS: "{{ lookup('engine', 'redis', application_id, 'host') }}:{{ lookup('engine', 'redis', application_id, 'port') }}"
|
|
GITEA_REDIS_PASSWORD: "{{ lookup('engine', 'redis', application_id, 'password') }}"
|
|
|
|
GITEA_INTERNAL_API_URL: "http://{{ entity_name }}:{{ lookup('config', application_id, 'services.gitea.ports.internal.http') }}/api/v1"
|
|
|
|
GITEA_MCP_ENABLED: "{{ lookup('config', application_id, 'services.giteamcp.enabled') | bool }}"
|
|
GITEA_MCP_SERVICE_KEY: "{{ lookup('config', application_id, 'mcp.endpoint.service_key') }}"
|
|
GITEA_MCP_CONTAINER: "{{ lookup('config', application_id, 'services.giteamcp.name') }}"
|
|
GITEA_MCP_PORT: "{{ lookup('config', application_id, 'services.giteamcp.ports.internal.http') }}"
|
|
GITEA_MCP_SIDECAR_SERVICE_KEY: giteamcpupstream
|
|
GITEA_MCP_UPSTREAM_NETWORK: "{{ lookup('config', application_id, 'mcp.adapter.upstream_network') }}"
|
|
GITEA_MCP_SIDECAR_CONTAINER: "{{ lookup('config', application_id, 'services.giteamcpupstream.name') }}"
|
|
GITEA_MCP_SIDECAR_PORT: "{{ lookup('config', application_id, 'services.giteamcpupstream.ports.internal.http') }}"
|
|
GITEA_MCP_SIDECAR_URL: "http://{{ GITEA_MCP_SIDECAR_SERVICE_KEY }}:{{ GITEA_MCP_SIDECAR_PORT }}/mcp"
|
|
GITEA_MCP_INSTANCE_DIR: "{{ [lookup('container', application_id, 'directories.instance'), 'mcp'] | path_join }}"
|
|
GITEA_MCP_BEARER: "{{ lookup('config', application_id, 'secrets.credentials.mcp_bearer') }}"
|
|
GITEA_MCP_CONTRACT:
|
|
upstream_kind: mcp
|
|
provider: "{{ application_id }}"
|
|
upstream_url: "{{ GITEA_MCP_SIDECAR_URL }}"
|
|
auth_subject: "{{ lookup('config', application_id, 'mcp.auth_subject') }}"
|
|
mutating_tools_enabled: "{{ lookup('config', application_id, 'mcp.tools.mutating_tools_enabled') | bool }}"
|
|
tools: "{{ lookup('file', 'mcp/tools.json') | from_json }}"
|
|
limits: "{{ lookup('config', application_id, 'mcp.limits') }}"
|
|
schema_sha256: "{{ lookup('config', application_id, 'mcp.tools.schema_sha256') }}"
|
|
GITEA_MCP_UPSTREAM_URL: "http://{{ entity_name }}:{{ lookup('config', application_id, 'services.gitea.ports.internal.http') }}"
|
|
GITEA_MCP_TOKEN_NAME: "gitea-mcp"
|
|
GITEA_MCP_TOKEN_SCOPES: "read:repository,read:issue,read:user,read:organization,read:notification"
|
|
GITEA_MCP_ACCOUNT: "{{ lookup('users', 'mcp-web-app-gitea') }}"
|
|
GITEA_MCP_USERNAME: "{{ GITEA_MCP_ACCOUNT.username }}"
|
|
GITEA_MCP_USER_EMAIL: "{{ GITEA_MCP_ACCOUNT.email }}"
|
|
GITEA_MCP_USER_PASSWORD: "{{ GITEA_MCP_ACCOUNT.password }}"
|
|
GITEA_MCP_TOOL_SCOPES: "user,repository,issue,pull_request,search,file,branch,tag,commit,release"
|
|
GITEA_MCP_COMMAND:
|
|
- "/app/gitea-mcp" # nocheck: literal-path image ships no ENTRYPOINT, so command must carry the binary
|
|
- "-t"
|
|
- "http"
|
|
- "--port"
|
|
- "{{ GITEA_MCP_SIDECAR_PORT | string }}"
|
|
- "-r"
|
|
GITEA_MCP_INITIALIZE_PAYLOAD:
|
|
jsonrpc: "2.0"
|
|
id: 1
|
|
method: initialize
|
|
params:
|
|
protocolVersion: "2025-03-26"
|
|
capabilities: {}
|
|
clientInfo:
|
|
name: infinito-nexus
|
|
version: "1"
|
|
|
|
GITEA_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.shared') | bool }}"
|
|
GITEA_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
|
|
GITEA_IAM_ENABLED: "{{ (GITEA_OIDC_ENABLED | bool) or ( GITEA_LDAP_ENABLED | bool ) }}"
|