mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
29015311b6
meta/volumes.yml says where a volume lands inside its container. Wherever a
second file spelled the same path out, the two drifted independently: the mount
moves, the consumer keeps pointing at the old place, and nothing fails until the
process looks for content that is not there. e031b7f61 fixed exactly this for
web-app-moodle; this generalises it and makes the rule hold.
The lookup gains what a caller needs. `targets` maps each mounting service to
its container path, and `target` is the one path an entry mounts at -- present
only when every mount agrees. An entry that lands at different paths per service
omits `target` rather than picking one, and the caller names the service:
"{{ lookup('volume', application_id, 'prometheus_config').target }}"
"{{ lookup('volume', 'web-app-prometheus', 'host_sys').targets['node-exporter'] }}"
66 literals across 48 role files now derive. Replacement only happened where the
path stood alone -- /srv/app inside /srv/app/data is a different path -- and
every rewritten file was re-parsed, Jinja and YAML alike. Three sites the tool
refused rather than guess were done by hand: zammad's path sat in a Jinja list
literal, seaweedfs' inside a quoted string feeding a filter, and openresty's
/var/run/docker.sock is not a mount target at all but the socket on the host,
which only happens to spell the same string. That one carries the single
nocheck.
tests/lint/repository/spot/test_volumes_path_single_spot.py keeps it that way.
roles/*/files/ is out of scope by construction: it is copied verbatim into an
image and executed there, so a Dockerfile or entrypoint has no Ansible to
evaluate a lookup with.
One defect this found, and it was in the tooling rather than the roles: deciding
ambiguity AFTER filtering short paths made web-app-prometheus' host_sys look
single-valued -- it mounts /sys for cadvisor and /host/sys for node-exporter,
and /sys is below the length filter. The template would have rendered an
undefined `.target`. Both the converter and the rule now decide ambiguity over
every target and filter afterwards, and that call reads targets['node-exporter'].
Verified by resolving rather than by reading: all 70 accesses in the diff were
run against the real registry and every one yields a non-empty path equal to the
literal it replaced. make test-lint: 328 passed.
Not verified: no Ansible render, so a call site whose surrounding context cannot
build the applications registry would still fail at deploy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
74 lines
3.8 KiB
YAML
74 lines
3.8 KiB
YAML
---
|
|
# General
|
|
application_id: "web-app-penpot"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
PENPOT_FRONTEND_CONTAINER: "{{ lookup('config', application_id, 'services.frontend.name') }}"
|
|
PENPOT_BACKEND_CONTAINER: "{{ lookup('config', application_id, 'services.backend.name') }}"
|
|
PENPOT_EXPORTER_CONTAINER: "{{ lookup('config', application_id, 'services.exporter.name') }}"
|
|
|
|
PENPOT_FRONTEND_SERVICE: "frontend"
|
|
PENPOT_BACKEND_SERVICE: "backend"
|
|
PENPOT_EXPORTER_SERVICE: "exporter"
|
|
|
|
PENPOT_BACKEND_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, PENPOT_BACKEND_SERVICE) }}"
|
|
|
|
PENPOT_BACKEND_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.backend.ports.internal.http') }}"
|
|
PENPOT_EXPORTER_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.exporter.ports.internal.http') }}"
|
|
|
|
PENPOT_PUBLIC_URI: "{{ lookup('tls', application_id, 'url.base') }}"
|
|
|
|
PENPOT_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
|
|
|
|
PENPOT_ASSETS_FS_DIRECTORY: "{{ lookup('volume', 'web-app-penpot', 'assets').target }}"
|
|
|
|
PENPOT_DATABASE_USERNAME: "{{ lookup('database', application_id, 'username') }}"
|
|
PENPOT_DATABASE_NAME: "{{ lookup('database', application_id, 'name') }}"
|
|
PENPOT_DATABASE_HOST: "{{ lookup('database', application_id, 'host') }}"
|
|
PENPOT_DATABASE_PORT: "{{ lookup('database', application_id, 'port') }}"
|
|
PENPOT_DATABASE_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
|
|
PENPOT_DATABASE_URI: "postgresql://{{ PENPOT_DATABASE_HOST }}:{{ PENPOT_DATABASE_PORT }}/{{ PENPOT_DATABASE_NAME }}"
|
|
PENPOT_DATABASE_MAX_POOL_SIZE: "{{ [60, [5, (((POSTGRES_MAX_CONNECTIONS | int) - 30) // ([groups[application_id] | default([]) | length, 1] | max))] | max] | min
|
|
}}"
|
|
|
|
PENPOT_REDIS_URI: "{{ lookup('engine', 'redis', application_id, 'url') }}/0"
|
|
|
|
PENPOT_BACKEND_URI: "http://{{ PENPOT_BACKEND_SERVICE }}:{{ PENPOT_BACKEND_INTERNAL_PORT }}"
|
|
PENPOT_EXPORTER_URI: "http://{{ PENPOT_EXPORTER_SERVICE }}:{{ PENPOT_EXPORTER_INTERNAL_PORT }}"
|
|
|
|
PENPOT_SSO_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
PENPOT_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
|
|
PENPOT_NATIVE_LOGIN_ENABLED: "{{ not (PENPOT_SSO_ENABLED | bool) }}"
|
|
PENPOT_REGISTRATION_ENABLED: "{{ PENPOT_SSO_ENABLED | bool }}"
|
|
|
|
PENPOT_FLAGS: >-
|
|
{{ 'enable-registration' if PENPOT_REGISTRATION_ENABLED | bool else 'disable-registration' }}
|
|
{{ 'enable-login-with-password' if PENPOT_NATIVE_LOGIN_ENABLED | bool else 'disable-login-with-password' }}
|
|
enable-prepl-server
|
|
disable-telemetry
|
|
disable-onboarding
|
|
{{ 'enable-login-with-oidc' if PENPOT_SSO_ENABLED | bool else '' }}
|
|
{{ 'enable-login-with-ldap' if PENPOT_LDAP_ENABLED | bool else '' }}
|
|
|
|
PENPOT_ADMIN_EMAIL: "{{ lookup('users', 'administrator').email }}"
|
|
PENPOT_ADMIN_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
PENPOT_ADMIN_FULLNAME: "{{ lookup('users', 'administrator').username }}"
|
|
|
|
PENPOT_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
|
|
PENPOT_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET }}"
|
|
PENPOT_OIDC_BASE_URI: "{{ OIDC.CLIENT.ISSUER_URL }}"
|
|
PENPOT_OIDC_AUTH_URI: "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
|
|
PENPOT_OIDC_TOKEN_URI: "{{ OIDC.CLIENT.TOKEN_URL }}"
|
|
PENPOT_OIDC_USER_URI: "{{ OIDC.CLIENT.USER_INFO_URL }}"
|
|
PENPOT_OIDC_SCOPES: "openid profile email"
|
|
PENPOT_SSRF_ALLOWED_HOSTS: "{{ PENPOT_OIDC_BASE_URI | regex_replace('^https?://', '') | regex_replace('[:/].*$', '') }}"
|
|
|
|
PENPOT_LDAP_HOST: "{{ LDAP.SERVER.DOMAIN }}"
|
|
PENPOT_LDAP_PORT: "{{ LDAP.SERVER.PORT }}"
|
|
PENPOT_LDAP_BASE_DN: "{{ LDAP.DN.OU.USERS }}"
|
|
PENPOT_LDAP_BIND_DN: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
|
|
PENPOT_LDAP_BIND_PASSWORD: "{{ LDAP.BIND_CREDENTIAL }}"
|
|
PENPOT_LDAP_ATTRS_USERNAME: "{{ LDAP.USER.ATTRIBUTES.ID }}"
|
|
PENPOT_LDAP_ATTRS_EMAIL: "{{ LDAP.USER.ATTRIBUTES.MAIL }}"
|
|
PENPOT_LDAP_ATTRS_FULLNAME: "{{ LDAP.USER.ATTRIBUTES.FULLNAME }}"
|