mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b358a8bb00
tasks/00_core.yml built webserver_extra_configuration by concatenating the helper iframes, the admin allowlist and the logout panel template lookups with `~`. With the shipped empty `services.keycloak.admin.allowed_networks` the allowlist template rendered no text, Ansible's template lookup returned None for it, and `~` wrote the word "None" into the auth vhost. OpenResty then refused `unknown directive "Nonelocation"` in front of the logout panel location and every deploy with Keycloak went red. The role now resolves the declared networks once in KEYCLOAK_ADMIN_NETWORKS and the task appends the allowlist template only when that list is not empty, the same guard the logout panel uses. The template renders the restricted /admin location unconditionally from KEYCLOAK_ADMIN_NETWORKS. With a list that did not contain the deploy host, the deploy still went red: Keycloak answers `/` with a redirect to `/admin/`, so the CSP health check and the front proxy probe, which request `/` from the host, got 403 and hlth-csp failed. While the allowlist is active, `location = /` now redirects to the account console of the platform realm instead, and the README no longer claims the deploy needs no entry for any reason. test_admin_allowlist.py rendered the template with plain Jinja, which yields '' for an empty template, so it could not see the None. It now evaluates the task's own webserver_extra_configuration expression through Ansible's Templar and real template lookup, which reproduces "HELPER_IFRAMES\nNoneLOGOUT_PANEL" on the old task, and covers the root redirect. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>