mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.7
01e0937240
Iterates the role-local Playwright specs from a structural skeleton into
fully green end-to-end scenarios that exercise the SSO handoff for both
the administrator and the biber LDAP persona, against the actual
deployed stack, and adds optional meeting recording for OpenTalk.
OpenCloud (web-app-opencloud)
- Add Keycloak's URL to connect-src and frame-src in the role CSP via
lookup('tls', 'web-app-keycloak', 'url.base') so the SPA can hit the
OIDC discovery and authorize endpoints from the browser
- Switch to read-only LDAP semantics: PROXY_AUTOPROVISION_ACCOUNTS=false,
GRAPH_USERNAME_MATCH removed, GRAPH_ASSIGN_DEFAULT_USER_ROLE=true
- Set OC_LDAP_DISABLE_USER_MECHANISM=none so the user-lookup filter
stops referencing the OpenCloud-only `openclouduserenabled` attribute
that the central LDAP schema does not define
- Pin the image to opencloudeu/opencloud:4.0.6
- Spec primes localStorage forceAllowOldBrowser, bypasses the "browser
not supported" splash, submits via Enter, asserts the Files-view banner
OpenTalk (web-app-opentalk)
- Provision a dedicated confidential Keycloak client `opentalk-controller`
via kcadm so the controller can introspect access tokens; the shared
realm client stays public for the browser PKCE flow. The service
account is granted the realm-management view-users / query-users roles
for the Keycloak admin Web API user-search backend
- Inject an nginx vhost extension via webserver_extra_configuration that
routes /v1/, /signaling, and /livekit on open.talk.<DOMAIN> to the
controller and LiveKit upstreams; the default route stays on the
frontend
- Fix the frontend env vars to upstream names (OIDC_ISSUER, BASE_URL=""),
pin the frontend image to v2.8.1
- Spec races between auto-redirect and explicit "Sign in" CTA, submits
via Enter, asserts the post-login Home-link in the dashboard
- Add OpenTalk recorder (registry.opencode.de/opentalk/recorder v0.16.2)
plus RabbitMQ broker (rabbitmq:4.2.4); wire the controller to publish
recording jobs on the `opentalk_recorder` queue and the recorder to
consume them; provision a dedicated confidential `opentalk-recorder`
Keycloak client for the recorder service account
- Reference Keycloak and the cross-app domain through lookup('tls', ...)
and lookup('domain', ...) in meta/server.yml instead of literal
`auth.<DOMAIN>` / `open.cloud.<DOMAIN>` strings
Cross-cutting
- Rename canonical hostnames to the <vendor>.<category> pattern:
- web-app-opentalk: talk.<DOMAIN> -> open.talk.<DOMAIN>
- web-app-bigbluebutton: meet.<DOMAIN> -> bbb.talk.<DOMAIN>
- Restructure both READMEs to the per-role README contract; drop emojis
from headings; strip em dashes / history phrases / self-SPOT
declarations from IAM.md / LDAP.md / TODO.md
- Replace technical galaxy_info descriptions with user-facing copy so
the dashboard cards read clearly
Validated end-to-end via the Role Loop (deploy-fresh-kept-apps then
deploy-reuse-kept-apps with SERVICES_DISABLED=matomo,email): all
seven OpenTalk containers + the OpenCloud container come up healthy,
scripts/tests/e2e/rerun-spec.sh web-app-opencloud and
scripts/tests/e2e/rerun-spec.sh web-app-opentalk both finish with
`2 passed`, and `make test` is green (1604 + 162 tests).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
6 lines
467 B
Markdown
6 lines
467 B
Markdown
# web-app-opentalk TODO 📝
|
|
|
|
- [ ] Browser-walk an end-to-end meeting flow: log in via Keycloak, create a meeting, join from a second browser, and verify media flows over the LiveKit relay.
|
|
- [ ] Browser-walk an end-to-end recording flow: start a meeting, kick off a recording, and verify the recorder uploads the resulting MP4 to MinIO.
|
|
- [ ] Add MinIO bucket policy hardening and a dedicated service account (the controller currently uses MinIO root credentials).
|