mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
b0ca8784e2
The OIDC admin wiring is gated on SSO alone, and SSO is 'web-app-keycloak' in group_names. Round 1 takes keycloak variant 1, which pins ldap off, so svc-db-openldap is not in the closure; the block still resolved its swarm service and the waiter spent 600 attempts on a service that does not exist (run 33698844864, Mattermost#1, 25 minutes). In compose the same block would have died on a missing container, so the defect is mode-independent.
The number it fetched is already in the registry: svc-db-openldap/tasks/04_users.yml:118 writes uidNumber from the same lookup('users'), and an earlier run shows inventory uid 1001 against ldapsearch 1001. Reading it directly removes the cross-stack exec entirely.
Keycloak's mattermost-id mapper reads the uidNumber attribute, which until now only the LDAP federation wrote, so the same round would have produced no id claim to match. ensure_realm_user.sh now mirrors the uid into that attribute whenever it is passed one, leaving callers without a uid unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
71 lines
3.3 KiB
YAML
71 lines
3.3 KiB
YAML
---
|
|
application_id: "web-app-mattermost"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
container_port: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.ports.internal.http') }}"
|
|
|
|
MATTERMOST_DATABASE_DSN: "{{ lookup('database', application_id, 'url_full') }}?sslmode=disable&connect_timeout=10"
|
|
|
|
MATTERMOST_CONTAINER: "{{ lookup('config', application_id, 'services.mattermost.name') }}"
|
|
MATTERMOST_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
|
|
|
|
MATTERMOST_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
|
|
MATTERMOST_LITELLM_ENABLED: "{{ lookup('config', application_id, 'services.litellm.enabled') | bool }}"
|
|
MATTERMOST_LITELLM_BASE_URL: "{{ LITELLM_OPENAI_BASE_LOCAL_URL }}"
|
|
MATTERMOST_LITELLM_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.litellm_api_key') }}"
|
|
MATTERMOST_LITELLM_SERVICE_ID: infinito-litellm
|
|
MATTERMOST_LITELLM_BOT_ID: infinito-litellm-agent
|
|
MATTERMOST_LITELLM_BOT_NAME: agent
|
|
|
|
MATTERMOST_LITELLM_SERVICE:
|
|
id: "{{ MATTERMOST_LITELLM_SERVICE_ID }}"
|
|
name: Infinito LiteLLM
|
|
type: openaicompatible
|
|
apiKey: "{{ MATTERMOST_LITELLM_API_KEY }}"
|
|
apiURL: "{{ MATTERMOST_LITELLM_BASE_URL }}"
|
|
defaultModel: "{{ LITELLM_CHAT_MODEL }}"
|
|
orgId: ""
|
|
tokenLimit: 0
|
|
streamingTimeoutSeconds: 0
|
|
|
|
MATTERMOST_LITELLM_BOT:
|
|
id: "{{ MATTERMOST_LITELLM_BOT_ID }}"
|
|
name: "{{ MATTERMOST_LITELLM_BOT_NAME }}"
|
|
displayName: Agent
|
|
customInstructions: ""
|
|
serviceID: "{{ MATTERMOST_LITELLM_SERVICE_ID }}"
|
|
model: "{{ LITELLM_CHAT_MODEL }}"
|
|
enableVision: false
|
|
disableTools: false
|
|
channelAccessLevel: 0
|
|
channelIDs: []
|
|
userAccessLevel: 0
|
|
userIDs: []
|
|
teamIDs: []
|
|
maxFileSize: 0
|
|
|
|
MATTERMOST_MCP_ENABLED: "{{ lookup('config', application_id, 'services.mattermostmcp.enabled') | bool }}"
|
|
MATTERMOST_MCP_PLUGIN_ID: mattermost-ai
|
|
MATTERMOST_MCP_TOKEN_DESCRIPTION: mcp
|
|
|
|
MATTERMOST_KEYCLOAK_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-keycloak', 'keycloak') }}"
|
|
MATTERMOST_KEYCLOAK_ADMIN_USER: "{{ lookup('config', 'web-app-keycloak', 'services.keycloak.accounts.system.username') }}"
|
|
MATTERMOST_KEYCLOAK_ADMIN_PASS: "{{ lookup('users', 'administrator').password }}"
|
|
|
|
MATTERMOST_MCP_CONTAINER: "{{ lookup('config', application_id, 'services.mattermostmcp.name') }}"
|
|
MATTERMOST_MCP_PORT: "{{ lookup('config', application_id, 'services.mattermostmcp.ports.internal.http') }}"
|
|
MATTERMOST_MCP_INSTANCE_DIR: "{{ [lookup('container', application_id, 'directories.instance'), 'mcp'] | path_join }}"
|
|
MATTERMOST_MCP_UPSTREAM_PATH: "{{ lookup('config', application_id, 'mcp.adapter.upstream_path') }}"
|
|
MATTERMOST_MCP_UPSTREAM_URL: "http://{{ MATTERMOST_CONTAINER }}:{{ container_port }}{{ MATTERMOST_MCP_UPSTREAM_PATH }}"
|
|
MATTERMOST_MCP_BEARER: "{{ lookup('config', application_id, 'secrets.credentials.mcp_bearer') }}"
|
|
MATTERMOST_MCP_CONTRACT:
|
|
upstream_kind: mcp
|
|
provider: "{{ application_id }}"
|
|
upstream_url: "{{ MATTERMOST_MCP_UPSTREAM_URL }}"
|
|
auth_subject: "{{ lookup('config', application_id, 'mcp.auth_subject') }}"
|
|
mutating_tools_enabled: "{{ lookup('config', application_id, 'mcp.tools.mutating_tools_enabled') | bool }}"
|
|
tools: "{{ lookup('file', 'mcp/tools.json') | from_json }}"
|
|
limits: "{{ lookup('config', application_id, 'mcp.limits') }}"
|
|
schema_sha256: "{{ lookup('config', application_id, 'mcp.tools.schema_sha256') }}"
|