mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
f713ba8350
meta/schema.yml became meta/secrets.yml, but its content still landed at
applications.<app>.credentials — the one meta file whose payload did not sit
under a root named after the file. Every other topic obeys that rule:
meta/volumes.yml goes to volumes, meta/rbac.yml to rbac. Credentials now go to
secrets.credentials.
The path exists exactly once, in utils/manager/credential_key.py, and
OVERRIDE_SECTION is derived from its two segments rather than spelled beside
them, so the dotted form used by --set and the nested form used by the
inventory cannot drift. Six consumers read it: the loader, the generator, the
CLI override parser, the two emit helpers, and the four lookup validators.
--set now accepts exactly one key shape,
applications.<app>.secrets.credentials.<key>. The three short forms are
rejected instead of guessed at: the same short key names different credentials
on different apps. That also retired primary_app_id, which only existed to
disambiguate them.
Three defects surfaced while wiring this up. _apply_one_role_schema still wrote
to the old root, so an app's own credentials would have moved while its
providers' stayed behind. web-app-pgadmin reads through
lookup('applications', ...).credentials.<key>, an access path no regex over
lookup('config', ...) could see, and would have deployed with an empty postgres
password. And _META_NON_GENERIC_TOPICS still listed 'schema' — a bare topic
name, invisible to any path search — so the generic file-root loop assigned the
raw schema under secrets and the follow-up write landed inside the cached
document, truncating keycloak's four credentials to one for every later
reader.
tests/integration/ansible/lookups/config/test_credentials_roundtrip.py pins both
directions of the seam and the cache invariant that last defect broke.
Existing inventories still carry the pre-rename root; migrating them is
deliberately out of scope here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
87 lines
4.2 KiB
YAML
87 lines
4.2 KiB
YAML
---
|
|
application_id: "web-app-odoo"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
swarm_stack_converge_retries: 600
|
|
|
|
websocket_port: "{{ lookup('config', application_id, 'services.odoo.ports.local.websocket') }}"
|
|
|
|
container_port: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.ports.internal.http') }}"
|
|
container_websocket_port: 8072
|
|
|
|
ODOO_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.version') }}"
|
|
ODOO_IMAGE: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.image') }}"
|
|
ODOO_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~'.name') }}"
|
|
ODOO_SERVICE: "{{ entity_name }}"
|
|
ODOO_REPLICAS: "{{ groups[application_id] | length }}"
|
|
|
|
ODOO_CONF_FILE_HOST: "{{ lookup('container', application_id, 'directories.volumes') }}odoo.conf"
|
|
ODOO_ADDONS_HOST: "{{ lookup('container', application_id, 'directories.volumes') }}addons/"
|
|
ODOO_ENTRYPOINT_SCRIPT_FILE: "docker-entrypoint-odoo.sh"
|
|
ODOO_ENTRYPOINT_SCRIPT_HOST_ABS: "{{ [ lookup('container', application_id, 'directories.volumes'), ODOO_ENTRYPOINT_SCRIPT_FILE ] | path_join }}"
|
|
ODOO_ENTRYPOINT_SCRIPT_HOST_REL: "volumes/{{ ODOO_ENTRYPOINT_SCRIPT_FILE }}"
|
|
ODOO_ENTRYPOINT_SCRIPT_DOCKER: "{{ [ '/usr/local/bin/', ODOO_ENTRYPOINT_SCRIPT_FILE ] | path_join }}"
|
|
ODOO_INIT_MODULES: "{{ ODOO_MODULES_CORE | join(',') }}"
|
|
ODOO_UPDATE_MARKER: "/var/lib/odoo/.odoo-update-pending"
|
|
|
|
ODOO_URL: "{{ lookup('tls', application_id, 'url.base') }}"
|
|
|
|
ODOO_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
ODOO_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
|
|
ODOO_REDIS_ENABLED: "{{ lookup('config', application_id, 'services.redis.enabled') }}"
|
|
|
|
ODOO_ADMINISTRATOR_USERNAME: "{{ lookup('users', 'administrator').username }}"
|
|
ODOO_ADMINISTRATOR_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
ODOO_ADMINISTRATOR_EMAIL: "{{ lookup('users', 'administrator').email }}"
|
|
|
|
ODOO_MASTER_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.master_password') }}"
|
|
|
|
ODOO_MODULES_CORE: "{{ lookup('config', application_id, 'addons') | dict2items | selectattr('value.group','equalto','core') | map(attribute='key') | list }}"
|
|
ODOO_MODULES_OPTIONAL: "{{ lookup('config', application_id, 'addons') | dict2items | selectattr('value.group','equalto','optional') | map(attribute='key') | list
|
|
}}"
|
|
|
|
ODOO_DB_HOST: "{{ lookup('database', application_id, 'host') }}"
|
|
ODOO_DB_NAME: "{{ lookup('database', application_id, 'name') }}"
|
|
ODOO_DB_USER: "{{ lookup('database', application_id, 'username') }}"
|
|
ODOO_DB_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
|
|
ODOO_DB_PORT: "{{ lookup('database', application_id, 'port') }}"
|
|
|
|
ODOO_EMAIL: "{{ lookup('email', application_id) }}"
|
|
ODOO_SMTP_HOST: "{{ ODOO_EMAIL.host }}"
|
|
ODOO_SMTP_PORT: "{{ ODOO_EMAIL.port | default(587) }}"
|
|
ODOO_SMTP_USER: "{{ ODOO_EMAIL.username }}"
|
|
ODOO_SMTP_PASSWORD: "{{ ODOO_EMAIL.password }}"
|
|
ODOO_SMTP_SSL: "{{ lookup('tls', application_id, 'enabled') }}"
|
|
|
|
ODOO_LDAP_SERVER: "{{ LDAP.SERVER.DOMAIN }}"
|
|
ODOO_LDAP_PORT: "{{ LDAP.SERVER.PORT }}"
|
|
ODOO_LDAP_BASE_DN: "{{ LDAP.DN.OU.USERS }}"
|
|
ODOO_LDAP_BIND_DN: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
|
|
ODOO_LDAP_BIND_PASSWORD: "{{ LDAP.BIND_CREDENTIAL }}"
|
|
ODOO_LDAP_FILTER: "({{ ODOO_LDAP_USER_ATTR }}=%s)"
|
|
ODOO_LDAP_USER_ATTR: "{{ LDAP.USER.ATTRIBUTES.ID }}"
|
|
ODOO_LDAP_CREATE_USER: true
|
|
ODOO_LDAP_TLS: "{{ LDAP.SERVER.SECURITY in ['TLS', 'SSL'] }}"
|
|
|
|
ODOO_LDAP_CONFIG:
|
|
name: "OpenLDAP"
|
|
sequence: 1
|
|
company_id: 1
|
|
ldap_server: "{{ ODOO_LDAP_SERVER }}"
|
|
ldap_server_port: "{{ ODOO_LDAP_PORT }}"
|
|
ldap_binddn: "{{ ODOO_LDAP_BIND_DN }}"
|
|
ldap_password: "{{ ODOO_LDAP_BIND_PASSWORD }}"
|
|
ldap_base: "{{ ODOO_LDAP_BASE_DN }}"
|
|
ldap_filter: "{{ ODOO_LDAP_FILTER }}"
|
|
create_user: "{{ ODOO_LDAP_CREATE_USER | lower }}"
|
|
ldap_tls: "{{ ODOO_LDAP_TLS | lower }}"
|
|
|
|
ODOO_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
|
|
ODOO_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET }}"
|
|
ODOO_OIDC_ISSUER_URL: "{{ OIDC.CLIENT.ISSUER_URL }}"
|
|
ODOO_OIDC_AUTHORIZE_URL: "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
|
|
ODOO_OIDC_TOKEN_URL: "{{ OIDC.CLIENT.TOKEN_URL }}"
|
|
ODOO_OIDC_USERINFO_URL: "{{ OIDC.CLIENT.USER_INFO_URL }}"
|
|
ODOO_OIDC_JWKS_URI: "{{ OIDC.CLIENT.CERTS }}"
|
|
ODOO_OIDC_UID_FIELD: "{{ OIDC.ATTRIBUTES.USERNAME }}"
|