mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
6279a4f199
Variant 1 and 2 pin services.sso.enabled false, so templates/env.j2 skips
the whole OIDC block and with it OC_EXCLUDE_RUN_SERVICES=idp. OpenCloud
then starts its built-in IDP, and lico's bootstrap rejects a non-https iss
unconditionally (bootstrap/bootstrap.go: "invalid iss value, URL must start
with https://"). An onion has no TLS, so OC_URL is http, the single-binary
runtime fatals on every start, the service sits at 0/1, openresty cannot
resolve the upstream and the guest persona gets a 502 instead of a page.
Pin tor.enabled false in those two variants. utils.github.variant.axes
tor_capable reads exactly that literal false and never schedules them
behind the onion; variant 0 keeps the onion and still rotates through both
states, so the SSO-less branch stays covered on clearnet rather than being
dropped entirely.
The sso-variant-tor opt-out is role-level because the lint offers no
per-variant granularity, so it also stops enforcing "an SSO variant must
pin the onion" for this role. That partially reverts e16eb5728 here: its
rule presumes the onion is possible for every variant, which for OpenCloud
without an external IdP it is not.
The variants-coverage marker on the tor key goes with it. It existed only
because tor was true in every variant and the false polarity had nowhere
to live; it lives in variant 1 and 2 now and test_coverage passes without
the suppression.
Not addressed: a tor node deployed without Keycloak still crash-loops, and
nothing fails loudly to say why.
Verified: tests/lint/ansible/roles/meta plus tests/integration/roles/meta
101 passed / 534 subtests, tests/lint/repository/test_comments_valid
passed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
103 lines
3.3 KiB
YAML
103 lines
3.3 KiB
YAML
---
|
|
# Matrix-deploy variant overrides for web-app-opencloud.
|
|
# See docs/contributing/artefact/files/role/variants.md for the file format.
|
|
#
|
|
# nocheck: sso-variant-tor — the SSO-less variants run OpenCloud's built-in IDP,
|
|
# and lico rejects a non-https iss (bootstrap.go: "invalid iss value, URL must
|
|
# start with https://"). An onion has no TLS, so OC_URL is http and the whole
|
|
# single-binary runtime crash-loops. Variant 0 carries the onion.
|
|
|
|
# variant pinning every dynamic services.yml flag to true so the
|
|
# matrix exercises the in-group_names branch of web-app-opencloud.
|
|
- services:
|
|
container_backup:
|
|
enabled: true
|
|
css:
|
|
enabled: true
|
|
shared: true
|
|
dashboard:
|
|
enabled: true
|
|
shared: true
|
|
email:
|
|
enabled: true
|
|
shared: true
|
|
ldap:
|
|
enabled: true
|
|
shared: true
|
|
logout:
|
|
enabled: true
|
|
shared: true
|
|
matomo:
|
|
enabled: true
|
|
shared: true
|
|
sso:
|
|
enabled: true
|
|
shared: true
|
|
prometheus:
|
|
enabled: true
|
|
shared: true
|
|
tor:
|
|
enabled: true
|
|
|
|
- services:
|
|
container_backup:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
css:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
dashboard:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
email:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
ldap:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
logout:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
matomo:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
sso:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
prometheus:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
tor:
|
|
enabled: false
|
|
|
|
- services:
|
|
container_backup:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
ldap:
|
|
enabled: true
|
|
shared: true
|
|
sso:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
css:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
dashboard:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
email:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
logout:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
matomo:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
prometheus:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
tor:
|
|
enabled: false
|