mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
f7bb608927
files/ now mirrors the role's own structure: php, ruby and shell, each split
into addons for the per-integration scripts that tasks/addons/ drives and utils
for what more than one caller shares. set_encrypted_appconfig.php serves gitlab,
mattermost and zammad; doorkeeper_allow_onion_redirect.rb serves zammad and
openproject; init-gate.sh belongs to the role itself. The partner directories
survive because two scripts are both named provision_oauth_app.rb.
NEXTCLOUD_INIT_GATE_FILE had to split. It was the source path under files/, the
name Dockerfile.j2 COPYs into /usr/local/bin, and the ENTRYPOINT, all at once;
moving the script would have produced /usr/local/bin/shell/utils/init-gate.sh.
The basename keeps that name and NEXTCLOUD_INIT_GATE_SRC carries the path.
The same commit closes two of the three faces of one defect. resolve_enabled
reports TLS off for an .onion domain, correctly -- the vhost is plaintext and
Tor carries the transport crypto -- so every redirect URI built from
lookup('tls', ...) is http, and Doorkeeper rejects it. Zammad raises out of
app.save! and fails the task at rc 1; OpenProject discards result.errors, keeps
the unsaved model whose plaintext_secret already exists, reports
oauth_application_created:true, and only dies three tasks later on a null
client_id. The prelude relaxes force_ssl_in_redirect_uri for .onion hosts and
delegates every other host to the previous setting, so clearnet is unchanged at
both partners; the OpenProject script now raises with the real validation
errors.
The third face is PeerTube, whose Keycloak callback is registered http and
requested https, and it stays open: fixing it means changing either PeerTube's
scheme, which is its federation identity, or the registration side.
Evidence: run 31658270172, jobs 94319317307 ("Redirect URI must be an HTTPS/SSL
URI.") and 94319317278 (changed:true, then length on NoneType).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
41 lines
1.1 KiB
Bash
41 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
APP_DIR="/var/www/html"
|
|
CONFIG_PHP="$APP_DIR/config/config.php"
|
|
OCC="$APP_DIR/occ"
|
|
INIT_LOCK="$APP_DIR/nextcloud-init-sync.lock"
|
|
IMAGE_VERSION_PHP="/usr/src/nextcloud/version.php"
|
|
|
|
slot="${TASK_SLOT:-1}"
|
|
case "$slot" in
|
|
''|*[!0-9]*) slot=1 ;;
|
|
esac
|
|
|
|
if [ "$slot" -ne 1 ]; then
|
|
app_user="${NEXTCLOUD_INIT_GATE_USER:?NEXTCLOUD_INIT_GATE_USER env missing}"
|
|
image_version="$(php -r "require '$IMAGE_VERSION_PHP'; echo implode('.', \$OC_Version);")"
|
|
|
|
while true; do
|
|
status=''
|
|
if ( exec 9>"$INIT_LOCK"; flock -n 9 ) && [ -f "$CONFIG_PHP" ] && [ -f "$OCC" ]; then
|
|
status="$(su "$app_user" -s /bin/sh -c "php $OCC status" 2>/dev/null || true)"
|
|
fi
|
|
|
|
ready=1
|
|
case "$status" in *"- installed: true"*) ;; *) ready=0 ;; esac
|
|
case "$status" in *"- maintenance: false"*) ;; *) ready=0 ;; esac
|
|
case "$status" in *"- needsDbUpgrade: false"*) ;; *) ready=0 ;; esac
|
|
case "$status" in *"- version: $image_version"*) ;; *) ready=0 ;; esac
|
|
|
|
if [ "$ready" -eq 1 ]; then
|
|
break
|
|
fi
|
|
|
|
echo "Task slot ${slot}: waiting for slot 1 to finish Nextcloud init..."
|
|
sleep 10
|
|
done
|
|
fi
|
|
|
|
exec /entrypoint.sh "$@"
|