mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
0039602379
SeaweedFS is a server-side S3 backend for its consumers; only the
filer/master admin UIs are browser-facing. Split them into a `frontend`
service that stays off on onion nodes ('svc-net-tor' in group_names):
- frontend disabled: no nginx proxy container, no filer/master vhosts,
no oauth2 SSO sidecar; the S3 API vhost is unaffected
- stale filer/master vhosts from earlier frontend-enabled deploys are
removed so the site-wide CSP health probe stops hitting dead domains
- csp_skip_domains additionally skips canonicals a disabled service
declares via services.<name>.domains (defense in depth)
- UI personas (admin/biber/guest/storage-buckets) gate on the
FRONTEND_SERVICE_ENABLED flag; tor variants dropped (backend role)
Verified on the onion node: 4/4 UI specs skip, S3 API reachable, CSP
health check green, matrix S3 media consumer unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
SEAWEEDFS_FILER_URL={{ lookup('canonical_url', application_id, 'filer') | dotenv_quote }}
|
|
|
|
SEAWEEDFS_MASTER_URL={{ lookup('canonical_url', application_id, 'master') | dotenv_quote }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|
|
FRONTEND_SERVICE_ENABLED={{ lookup('config', application_id, 'services.frontend.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
DASHBOARD_SERVICE_ENABLED={{ lookup('config', application_id, 'services.dashboard.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
PROMETHEUS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.prometheus.enabled') | string | lower }}
|
|
|
|
{% set buckets = [] %}
|
|
{% for role in group_names | select('match', '^web-app-') | reject('equalto', application_id) | list %}
|
|
{% set objstore = lookup('objstore', role) %}
|
|
{% if objstore.engine == 'seaweedfs' and objstore.shared %}
|
|
{% set _ = buckets.append({'role': role, 'bucket': objstore.bucket}) %}
|
|
{% endif %}
|
|
{% endfor %}
|
|
SEAWEEDFS_CONSUMER_BUCKETS={{ buckets | to_json | dotenv_quote }}
|