mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
cd15a360ca
LAM is not served at APP_BASE_URL: / redirects to /lam/, whose body is a bare meta refresh to templates/login.php, and /login, /admin/ and /admin all 404 at the vhost root. The shared helper samples for a password field on that interstitial and never reaches the form -- CI traces show no form submission at all and LAM's access log records no POST. Behind that, LAM binds the DN from its Admins list with LDAP.BIND_CREDENTIAL while the helper types the users.administrator secret of a different directory entry. That half is configurable via ADMIN_NATIVE_PASSWORD; the entry point is not, so the opt-out stands and the README records both. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
32 lines
2.2 KiB
Bash
32 lines
2.2 KiB
Bash
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — web-svc-css is injected at the vhost level; assertCspInjections resolves the flag through a loop variable, never a literal gate
|
|
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — ldap is pinned true in services.yml and no variant toggles it, so a gate on it could never skip; LAM is the LDAP front-end itself
|
|
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
# nocheck: persona-block-rationale — LAM answers / with a redirect to /lam/, whose body is only a meta refresh to templates/login.php, so the shared helper's landing probe samples an empty interstitial and never reaches the form; and LAM authenticates by binding the DN in its Admins list, which templates/env.j2 fills with LDAP.DN.ADMINISTRATOR.DATA and LDAP.BIND_CREDENTIAL, not the lookup('users','administrator').password the helper types (see README "Persona contract opt-outs").
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — meta/services.yml admits only the web-app-lam administrator RBAC group to the oauth2-proxy (sso.oauth2.allowed_groups) and biber carries no roles, so biber is denied at the proxy before LAM is reached (see README "Persona contract opt-outs").
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|