mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
15e7647d2f
New roles/sys-svc-container/templates/env.j2 sets TZ={{ HOST_TIMEZONE }} and LANG=C.UTF-8. Every role env.j2 includes it at the top; it renders via stack_host_template, the same engine that resolves the includes in compose.yml.j2, so it works in both compose and swarm. TZ/LANG are removed from the individual role env.j2 so each value stays single-source.
New lint tests/lint/ansible/test_env_base_include.py verifies every role env.j2 includes the base and never re-sets a base-owned key (keys derived from the base file).
mattermost and gitea meta/volumes.yml drop the /etc/timezone host-path bind: swarm hard-rejects a task whose bind source is missing on the node (Debian-trixie nodes have no /etc/timezone). TZ now comes from the base env. /etc/localtime bind also dropped; the container timezone follows TZ.
Non-directive comments were removed from the touched env.j2 (banners, restatements, reference URLs, narration) so the changed files pass the comment-lint; only tool directives remain.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
73 lines
2.7 KiB
Django/Jinja
73 lines
2.7 KiB
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
OC_URL={{ OPENCLOUD_URL }}
|
|
OC_DOMAIN={{ OPENCLOUD_DOMAIN }}
|
|
PROXY_TLS=false
|
|
OC_INSECURE={{ 'true' if MODE_DEBUG | bool else 'false' }}
|
|
OC_LOG_LEVEL={{ 'debug' if MODE_DEBUG | bool else 'info' }}
|
|
OC_LOG_PRETTY=false
|
|
OC_LOG_COLOR=false
|
|
OC_DEFAULT_LANGUAGE={{ HOST_LL_CC.split('_')[0] | default('en') }}
|
|
|
|
OC_JWT_SECRET={{ OPENCLOUD_JWT_SECRET | dotenv_quote }}
|
|
OC_MACHINE_AUTH_API_KEY={{ OPENCLOUD_MACHINE_AUTH_API_KEY | dotenv_quote }}
|
|
OC_TRANSFER_SECRET={{ OPENCLOUD_TRANSFER_SECRET | dotenv_quote }}
|
|
STORAGE_SYSTEM_JWT_SECRET={{ OPENCLOUD_STORAGE_SYSTEM_JWT_SECRET | dotenv_quote }}
|
|
|
|
IDM_ADMIN_PASSWORD={{ OPENCLOUD_ADMIN_PASSWORD | dotenv_quote }}
|
|
IDM_CREATE_DEMO_USERS=false
|
|
|
|
FRONTEND_CHECK_FOR_UPDATES=false
|
|
|
|
{% if OPENCLOUD_OIDC_ENABLED | bool %}
|
|
OC_EXCLUDE_RUN_SERVICES=idp
|
|
OC_OIDC_ISSUER={{ OIDC.CLIENT.ISSUER_URL }}
|
|
PROXY_OIDC_REWRITE_WELLKNOWN=true
|
|
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt
|
|
PROXY_USER_OIDC_CLAIM={{ OIDC.ATTRIBUTES.USERNAME }}
|
|
PROXY_USER_CS3_CLAIM=username
|
|
WEB_OIDC_CLIENT_ID={{ OIDC.CLIENT.ID }}
|
|
WEB_OIDC_METADATA_URL={{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}
|
|
PROXY_AUTOPROVISION_ACCOUNTS=false
|
|
GRAPH_ASSIGN_DEFAULT_USER_ROLE=true
|
|
WEB_OPTION_ACCOUNT_EDIT_LINK_HREF={{ OIDC.CLIENT.ACCOUNT.PROFILE_URL }}
|
|
{% endif %}
|
|
|
|
{% if OPENCLOUD_LDAP_ENABLED | bool %}
|
|
OC_LDAP_URI={{ LDAP.SERVER.URI }}
|
|
OC_LDAP_INSECURE=true
|
|
OC_LDAP_BIND_DN={{ LDAP.DN.ADMINISTRATOR.DATA }}
|
|
OC_LDAP_BIND_PASSWORD={{ LDAP.BIND_CREDENTIAL | dotenv_quote }}
|
|
OC_LDAP_USER_BASE_DN={{ LDAP.DN.OU.USERS }}
|
|
OC_LDAP_USER_FILTER=(objectclass=inetOrgPerson)
|
|
OC_LDAP_USER_OBJECTCLASS=inetOrgPerson
|
|
OC_LDAP_USER_SCHEMA_ID={{ LDAP.USER.ATTRIBUTES.ID }}
|
|
OC_LDAP_USER_SCHEMA_USERNAME={{ LDAP.USER.ATTRIBUTES.ID }}
|
|
OC_LDAP_USER_SCHEMA_MAIL={{ LDAP.USER.ATTRIBUTES.MAIL }}
|
|
OC_LDAP_USER_SCHEMA_DISPLAY_NAME={{ LDAP.USER.ATTRIBUTES.FULLNAME }}
|
|
OC_LDAP_GROUP_BASE_DN={{ LDAP.DN.OU.GROUPS }}
|
|
OC_LDAP_GROUP_FILTER=(objectclass=groupOfNames)
|
|
OC_LDAP_GROUP_OBJECTCLASS=groupOfNames
|
|
OC_LDAP_GROUP_SCHEMA_ID=cn
|
|
OC_LDAP_GROUP_SCHEMA_GROUPNAME=cn
|
|
OC_LDAP_GROUP_SCHEMA_MEMBER=member
|
|
GRAPH_LDAP_SERVER_WRITE_ENABLED=false
|
|
OC_LDAP_DISABLE_USER_MECHANISM=none
|
|
{% endif %}
|
|
|
|
{% if OPENCLOUD_OPENTALK_ENABLED | bool and OPENCLOUD_OPENTALK_URL %}
|
|
WEB_OPTION_OPENTALK_URL={{ OPENCLOUD_OPENTALK_URL }}
|
|
{% endif %}
|
|
|
|
{% set email = lookup('email', application_id) %}
|
|
{% if email.enabled | bool %}
|
|
NOTIFICATIONS_SMTP_HOST={{ email.host }}
|
|
NOTIFICATIONS_SMTP_PORT={{ email.port }}
|
|
NOTIFICATIONS_SMTP_USERNAME={{ email.username }}
|
|
NOTIFICATIONS_SMTP_PASSWORD={{ email.password | dotenv_quote }}
|
|
NOTIFICATIONS_SMTP_SENDER={{ email.username }}
|
|
NOTIFICATIONS_SMTP_AUTHENTICATION=login
|
|
NOTIFICATIONS_SMTP_ENCRYPTION={{ 'starttls' if email.start_tls else 'ssltls' }}
|
|
NOTIFICATIONS_SMTP_INSECURE=false
|
|
{% endif %}
|