mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
ab72cff929
7a70d27b7 made a variant that switches SSO on also switch the onion on, because
that pairing is where the platform breaks in ways clearnet never shows. The same
argument reaches further than SSO: a Secure cookie is dropped, an https identity
provider refuses to embed, and crypto.subtle is undefined for any feature on a
non-secure origin, not only for a login. A variant that never runs the onion is
not testing the deployment users get.
So the rule now covers every variant of a role that declares a tor block.
Variant 1 stays exempt - it is the minimal, partner-free round every role
declares and the one place the stack is exercised without the onion at all - and
a role whose meta/services.yml pins tor.enabled to a literal false is skipped
outright, because that declaration already says the role has no onion and needs
no comment repeating it.
That found 137 variants. 101 were variant 1. Of the rest, 28 are the LDAP-only
auth-isolation rounds, which gain real coverage from running LDAP over the onion
and are flipped on here. Four cannot: svc-net-tor is the provider itself, and
nextcloud's variant 8 pairs the clearnet-only PeerTube. Both carry a marker
naming the reason; opentalk and coturn need none, since their services.yml pins
the literal false the rule now reads.
Flipping them exposed a contract that contradicted itself. test_auth_isolation
and test_non_baseline_explicit_disables demanded `shared: false` beside
`enabled: false`, while variants-static-override flagged that same line as a
static override - which is why all 133 of them carried a nocheck marker. The
demand only makes sense where `shared` is dynamic: a literal base value cannot
leak through deep-merge, so restating it protects nothing. Both contracts now
ask for it only in that case, and the 133 lines are gone.
The result is a stricter rule with fewer lines: 189 insertions against 193
deletions.
Verified: tests/lint 336 passed / 307 subtests, tests/integration/roles 107
passed / 610 subtests. The rule is checked in both directions - it reported 137
offenders before the resolution and none after.
Not measured: 28 additional onion rounds cost matrix wall-clock, against swarm
jobs already capped at 355 minutes and one that has hit that ceiling before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
72 lines
2.2 KiB
YAML
72 lines
2.2 KiB
YAML
---
|
|
# Matrix-deploy variant overrides for web-app-opentalk.
|
|
# See docs/contributing/artefact/files/role/variants.md for the file format.
|
|
|
|
# variant pinning every dynamic services.yml flag to true so the
|
|
# matrix exercises the in-group_names branch of web-app-opentalk.
|
|
- services:
|
|
container_backup:
|
|
enabled: true
|
|
coturn:
|
|
enabled: true
|
|
shared: true
|
|
css:
|
|
enabled: true
|
|
shared: true
|
|
dashboard:
|
|
enabled: true
|
|
shared: true
|
|
email:
|
|
enabled: true
|
|
shared: true
|
|
logout:
|
|
enabled: true
|
|
shared: true
|
|
matomo:
|
|
enabled: true
|
|
shared: true
|
|
postgres:
|
|
shared: true
|
|
redis:
|
|
shared: true
|
|
prometheus:
|
|
enabled: true
|
|
shared: true
|
|
seaweedfs:
|
|
shared: true
|
|
tor:
|
|
enabled: false # nocheck: variants-static-override
|
|
- services:
|
|
container_backup:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
coturn:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
css:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
dashboard:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
email:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
logout:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
matomo:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
postgres:
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
redis:
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
prometheus:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
seaweedfs:
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
tor:
|
|
enabled: false # nocheck: variants-static-override
|