mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
38902309f4
On an onion deployment Pixelfed's server-side code-to-token exchange dials the Keycloak .onion authority. libcurl refuses to resolve .onion names (RFC 7686) before /etc/hosts or the SSO extra_hosts pin is consulted, so the callback died with "cURL error 6: Not resolving .onion address" and both OIDC login specs timed out (Pixelfed#0, compose, Tor, PR #869 run 37954856725). Pixelfed builds its league/oauth2 GenericProvider without a proxy option, so the proxy has to come from the environment. When the issuer is an onion, env.j2 now sets http_proxy and https_proxy to the Tor socks5h endpoint, with the object store host in no_proxy. Both Pixelfed services pin host.docker.internal, the compose SOCKS endpoint, since the worker reads the same env file. Clearnet deploys render no proxy. Verified with a local compose deploy of variant 0 (SSO, seaweedfs, Tor): the rendered token URL is an .onion authority, the env carries socks5h://host.docker.internal:9050, and both pixelfed OIDC login specs pass. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
34 lines
1.6 KiB
Django/Jinja
34 lines
1.6 KiB
Django/Jinja
{% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
|
|
{% set service_name = 'pixelfed' %}
|
|
{{ service_name }}:
|
|
{{ lookup('container_image', application_id, 'pixelfed') }}
|
|
{{ lookup('compose_only', 'container_name', PIXELFED_CONTAINER) }}
|
|
{% include 'roles/sys-svc-container/templates/base.yml.j2' %}
|
|
entrypoint: "{{ PIXELFED_ENTRYPOINT_DOCKER }}"
|
|
{{ lookup('container_extra_hosts', host_alias=true) | indent(4) }}
|
|
{{ lookup('container_volumes', service_name) | indent(4) }}
|
|
{{ lookup('container_ports', ['pixelfed', 'http', DOCKER_BIND_HOST]) | indent(4) }}
|
|
{{ lookup('container_depends_on', application_id) | indent(4) }}
|
|
{{ lookup('container_networks') | indent(4) }}
|
|
{% set service_name = 'worker' %}
|
|
{{ service_name }}:
|
|
{{ lookup('compose_only', 'container_name', PIXELFED_WORKER_CONTAINER) }}
|
|
{{ lookup('container_image', application_id, 'pixelfed') }}
|
|
{% include 'roles/sys-svc-container/templates/base.yml.j2' %}
|
|
environment:
|
|
AUTORUN_LARAVEL_EVENT_CACHE: "false"
|
|
AUTORUN_LARAVEL_ROUTE_CACHE: "false"
|
|
AUTORUN_LARAVEL_VIEW_CACHE: "false"
|
|
AUTORUN_ENABLED: "false"
|
|
{{ lookup('container_volumes', service_name) | indent(4) }}
|
|
entrypoint: "{{ PIXELFED_WORKER_ENTRYPOINT_DOCKER }}"
|
|
{{ lookup('container_extra_hosts', host_alias=true) | indent(4) }}
|
|
{{ lookup('container_healthcheck', service_name) | indent(4) }}
|
|
{{ lookup('container_depends_on', application_id, extra={
|
|
'pixelfed': {'condition': 'service_started'},
|
|
}) | indent(4) }}
|
|
{{ lookup('container_networks') | indent(4) }}
|
|
|
|
{{ lookup('compose_volumes') }}
|
|
{{ lookup('compose_networks') }}
|