mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
0a581f6622
Synapse on an onion node could never complete SSO: it has no Tor, so the http://auth.<onion> issuer was unresolvable server-side (discovery/jwks/ token), and Synapse hard-rejects non-https issuers on top. - runner/hostpin.{sh,service}: pin the onion auth host to the runner's real default gateway (node OpenResty) from /proc/net/route, Before=docker.service so nested containers see it from their first request; host-gateway is unusable in nested DinD (resolves to the inner docker0) - Synapse bind-mounts the runner's /etc/hosts; token iss stays the onion issuer the browser uses - bootstrap.service: PassEnvironment (systemd units do not inherit container env; MATRIX_MDAD_PLAYBOOK_TAGS only worked via its fallback default) - vars.yml.j2: skip_verification on onion (Synapse's escape hatch for issuers without https; Tor provides transport security per RFC 7686) - 02_render_inventory: drop the MDAD bootstrap marker + bounce the runner on inventory changes — mode=update reconfigures the nested stack at all now - MATRIX_SERVER_NAME follows matrix_domain onto the onion so MXIDs built from it (DM spec, bridge configs) reference users that exist - specs: shared Firefox onion fixture (16 files), gotoElementApp reload-retry against Element's Tor-triggered init race, seaweedfs spec gates on the filer frontend, env uses canonical_url consumer= Verified in-container: SSO 302 to onion Keycloak, admin+biber OIDC login, E2EE DM admin<->biber, CSP — all green over Tor. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
974 B
JavaScript
20 lines
974 B
JavaScript
const { test, expect } = require("./onion-test");
|
|
const { gotoOnion } = require("./personas");
|
|
|
|
exports.register = function (shared) {
|
|
test("matrix element enforces Content-Security-Policy and exposes canonical domain from applications lookup", async ({ page }) => {
|
|
const { elementBaseUrl, canonicalDomain } = shared.env;
|
|
const diagnostics = shared.attachDiagnostics(page);
|
|
const response = await gotoOnion(page, `${elementBaseUrl}/`);
|
|
expect(response, "Expected element landing response").toBeTruthy();
|
|
expect(response.status(), "Expected element landing status < 400").toBeLessThan(400);
|
|
shared.assertCspResponseHeader(response, "matrix element landing");
|
|
const documentUrl = response.url();
|
|
expect(
|
|
documentUrl.includes(canonicalDomain),
|
|
`Expected canonical domain "${canonicalDomain}" to back the element URL`,
|
|
).toBe(true);
|
|
await shared.expectNoCspViolations(page, diagnostics, "matrix element landing");
|
|
});
|
|
};
|