mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
25588d44b5
meta/services.yml switches the SSO integration of SeaweedFS off on a Tor
node, but variant 0 pinned services.sso to a literal true (#868). A round
writes the variant pins into its inventory, the inventory value wins over
the expression in services.yml, and a Tor round therefore enabled SSO for
a frontend it does not deploy. Measured in a round inventory:
`sso {'enabled': True, 'shared': True}` with svc-net-tor in its groups.
The pin now carries the same gate as logout, dashboard and prometheus,
which #832 already fixed the same way. The sso block in services.yml is
marked for the variants-coverage and bond-baseline guards like the
frontend block, since no variant may force this consumer on a Tor node.
Verified on a local Tor round of variant 0: the round inventory holds
`{'enabled': "{{ 'svc-net-tor' not in group_names }}", 'shared': ...}`
for the sso block instead of True, and after the deploy only the
seaweedfs container runs; seaweedfs-sso-proxy and seaweedfs-redis, which
an earlier deploy had started, are gone, and the rendered compose file
holds no SSO service. tests/integration/roles/meta/variants and the
sso-variant-tor lint pass; without the two markers test_bond_baseline
and test_coverage fail on services.sso.
feature/store-i18n carries the same pin change for all four services in
d70e2bb967, so the two branches merge without a conflict in
meta/variants.yml.
Closes #868
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
36 lines
1.4 KiB
YAML
36 lines
1.4 KiB
YAML
---
|
|
# nocheck: sso-variant-tor — meta/services.yml gates sso on
|
|
# "svc-net-tor not in group_names": the frontend is off on a tor node by design, so
|
|
# there is no SSO-over-onion flow to exercise.
|
|
- services:
|
|
container_backup:
|
|
enabled: true
|
|
sso:
|
|
enabled: "{{ 'svc-net-tor' not in group_names }}"
|
|
shared: "{{ 'svc-net-tor' not in group_names }}"
|
|
logout:
|
|
enabled: "{{ 'svc-net-tor' not in group_names }}"
|
|
shared: "{{ 'svc-net-tor' not in group_names }}"
|
|
dashboard:
|
|
enabled: "{{ 'svc-net-tor' not in group_names }}"
|
|
shared: "{{ 'svc-net-tor' not in group_names }}"
|
|
prometheus:
|
|
enabled: "{{ 'svc-net-tor' not in group_names }}"
|
|
shared: "{{ 'svc-net-tor' not in group_names }}"
|
|
- services:
|
|
container_backup:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
sso:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
logout:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
dashboard:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|
|
prometheus:
|
|
enabled: false
|
|
shared: false # nocheck: variants-static-override backup shared stays literally true
|