mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.8
0a581f6622
Synapse on an onion node could never complete SSO: it has no Tor, so the http://auth.<onion> issuer was unresolvable server-side (discovery/jwks/ token), and Synapse hard-rejects non-https issuers on top. - runner/hostpin.{sh,service}: pin the onion auth host to the runner's real default gateway (node OpenResty) from /proc/net/route, Before=docker.service so nested containers see it from their first request; host-gateway is unusable in nested DinD (resolves to the inner docker0) - Synapse bind-mounts the runner's /etc/hosts; token iss stays the onion issuer the browser uses - bootstrap.service: PassEnvironment (systemd units do not inherit container env; MATRIX_MDAD_PLAYBOOK_TAGS only worked via its fallback default) - vars.yml.j2: skip_verification on onion (Synapse's escape hatch for issuers without https; Tor provides transport security per RFC 7686) - 02_render_inventory: drop the MDAD bootstrap marker + bounce the runner on inventory changes — mode=update reconfigures the nested stack at all now - MATRIX_SERVER_NAME follows matrix_domain onto the onion so MXIDs built from it (DM spec, bridge configs) reference users that exist - specs: shared Firefox onion fixture (16 files), gotoElementApp reload-retry against Element's Tor-triggered init race, seaweedfs spec gates on the filer frontend, env uses canonical_url consumer= Verified in-container: SSO 302 to onion Keycloak, admin+biber OIDC login, E2EE DM admin<->biber, CSP — all green over Tor. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
8 lines
221 B
JavaScript
8 lines
221 B
JavaScript
const { test } = require("./onion-test");
|
|
|
|
exports.register = function (shared) {
|
|
test("guest: public-landing → auth chain → never authenticated", async ({ page }) => {
|
|
await shared.runGuestFlow(page);
|
|
});
|
|
};
|