mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
aa6bbe3b20
SOFTWARE_NAME, SOFTWARE_DOMAIN, SOFTWARE_URL and ORGANIZATION are declared once in group_vars/all/00_general.yml and derive from each other. Eleven templates wrote the value instead, so a rename would reach the four declarations and every consumer that reads them, and silently miss the literal. The lint reads the name from the declaration rather than carrying it, and searches case-insensitively: the domain is the name lowered, the URL is https:// plus the domain and the organization is the name again, so one literal finds the value of all four. A hit is reported with the variable it should have been, derived from the scheme in front of it and its case. The escape is nocheck: software-identity, same line or the one above. Every migrated template renders the same bytes as before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
3.4 KiB
Bash
57 lines
3.4 KiB
Bash
# Stock pixelfed /login expects an email, not a username; used by the native-login test that exercises the upstream form without OIDC.
|
|
ADMIN_EMAIL={{ lookup('users', 'administrator').email | dotenv_quote }}
|
|
|
|
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}
|
|
|
|
BIBER_OIDC_EMAIL_OVERRIDE={{ (lookup('users', 'biber').username ~ '@' ~ SOFTWARE_DOMAIN) | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
KEYCLOAK_ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
KEYCLOAK_ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
KEYCLOAK_BASE_URL={{ lookup('tls', 'web-app-keycloak', 'url.base') | dotenv_quote }}
|
|
|
|
KEYCLOAK_REALM={{ OIDC.CLIENT.REALM | dotenv_quote }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
|
|
|
|
# nocheck: persona-block-rationale — pixelfed's login id is the account e-mail (ADMIN_EMAIL above, files/playwright/test-native-login-administrator.js:20 and :47), not the Keycloak username the shared helper types into the login field (roles/test-e2e-playwright/files/personas/admin.js:74-81), and the artisan-bootstrapped administrator name is reserved so pixelfed's first-time OIDC registration cannot mint it either (tasks/03_administrator.yml:29-45, files/playwright/_shared.js:24-27). Coverage: files/playwright/test-native-login-administrator.js and test-oidc-login-administrator.js (see README "Persona contract opt-outs").
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — biber's first OIDC login only passes pixelfed's `email:strict,…,dns,spoof` validator after the spec rewrites his Keycloak e-mail to a resolvable domain through the Keycloak admin API (BIBER_OIDC_EMAIL_OVERRIDE above, files/playwright/_shared.js:1-7 and :405-440); without that setup step the callback dies in a ValidationException, and the shared helper has no such step. Coverage: files/playwright/test-oidc-login-biber.js (see README "Persona contract opt-outs").
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
PIXELFED_BASE_URL={{ lookup('tls', 'web-app-pixelfed', 'url.base') | dotenv_quote }}
|
|
|
|
SEAWEEDFS_ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
SEAWEEDFS_ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
SEAWEEDFS_APP_BUCKET={{ lookup('objstore', application_id, 'bucket') | dotenv_quote }}
|
|
|
|
SEAWEEDFS_FILER_URL={{ lookup('canonical_url', 'web-app-seaweedfs', 'filer', consumer=application_id) | dotenv_quote }}
|
|
|
|
SEAWEEDFS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.seaweedfs.enabled') | string | lower }}
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|