mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
f713ba8350
meta/schema.yml became meta/secrets.yml, but its content still landed at
applications.<app>.credentials — the one meta file whose payload did not sit
under a root named after the file. Every other topic obeys that rule:
meta/volumes.yml goes to volumes, meta/rbac.yml to rbac. Credentials now go to
secrets.credentials.
The path exists exactly once, in utils/manager/credential_key.py, and
OVERRIDE_SECTION is derived from its two segments rather than spelled beside
them, so the dotted form used by --set and the nested form used by the
inventory cannot drift. Six consumers read it: the loader, the generator, the
CLI override parser, the two emit helpers, and the four lookup validators.
--set now accepts exactly one key shape,
applications.<app>.secrets.credentials.<key>. The three short forms are
rejected instead of guessed at: the same short key names different credentials
on different apps. That also retired primary_app_id, which only existed to
disambiguate them.
Three defects surfaced while wiring this up. _apply_one_role_schema still wrote
to the old root, so an app's own credentials would have moved while its
providers' stayed behind. web-app-pgadmin reads through
lookup('applications', ...).credentials.<key>, an access path no regex over
lookup('config', ...) could see, and would have deployed with an empty postgres
password. And _META_NON_GENERIC_TOPICS still listed 'schema' — a bare topic
name, invisible to any path search — so the generic file-root loop assigned the
raw schema under secrets and the follow-up write landed inside the cached
document, truncating keycloak's four credentials to one for every later
reader.
tests/integration/ansible/lookups/config/test_credentials_roundtrip.py pins both
directions of the seam and the cache invariant that last defect broke.
Existing inventories still carry the pre-rename root; migrating them is
deliberately out of scope here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
39 lines
2.0 KiB
YAML
39 lines
2.0 KiB
YAML
---
|
|
application_id: "web-app-semaphore"
|
|
container_port: "{{ lookup('config', application_id, 'services.semaphore.ports.internal.http') }}"
|
|
|
|
SEMAPHORE_NAME: "{{ lookup('config', application_id, 'services.semaphore.name') }}"
|
|
|
|
SEMAPHORE_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
SEMAPHORE_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
|
|
|
|
SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ lookup('config', application_id, 'secrets.credentials.access_key_encryption') | regex_replace('^base64:', '') }}"
|
|
SEMAPHORE_COOKIE_HASH: "{{ lookup('config', application_id, 'secrets.credentials.cookie_hash') | regex_replace('^base64:', '') }}"
|
|
SEMAPHORE_COOKIE_ENCRYPTION: "{{ lookup('config', application_id, 'secrets.credentials.cookie_encryption') | regex_replace('^base64:', '') }}"
|
|
|
|
SEMAPHORE_ADMIN_USERNAME: "{{ lookup('users', 'web-app-semaphore-breakglass').username }}"
|
|
SEMAPHORE_ADMIN_PASSWORD: "{{ lookup('users', 'web-app-semaphore-breakglass').password }}"
|
|
SEMAPHORE_ADMIN_EMAIL: "{{ lookup('users', 'web-app-semaphore-breakglass').email }}"
|
|
SEMAPHORE_ADMIN_NAME: "Semaphore Break-glass Admin"
|
|
|
|
SEMAPHORE_OIDC_ADMIN_LOGIN: "{{ lookup('users', 'administrator').username }}"
|
|
SEMAPHORE_OIDC_ADMIN_EMAIL: "{{ lookup('users', 'administrator').email }}"
|
|
SEMAPHORE_OIDC_ADMIN_NAME: "{{ lookup('users', 'administrator').username }}"
|
|
|
|
SEMAPHORE_OIDC_PROVIDERS_JSON: >-
|
|
{{ {
|
|
"keycloak": {
|
|
"display_name": "Sign in with Keycloak",
|
|
"provider_url": OIDC.CLIENT.ISSUER_URL,
|
|
"client_id": OIDC.CLIENT.ID,
|
|
"client_secret": OIDC.CLIENT.SECRET,
|
|
"redirect_url": (lookup('tls', application_id, 'url.base') | regex_replace('/+$', '')) ~ "/api/auth/oidc/keycloak/redirect",
|
|
"username_claim": "preferred_username",
|
|
"email_claim": "email",
|
|
"name_claim": "name",
|
|
"scopes": ["openid", "profile", "email"]
|
|
}
|
|
} | to_json }}
|
|
|
|
SEMAPHORE_LDAP_SEARCH_FILTER: "(&(objectClass=inetOrgPerson)({{ LDAP.USER.ATTRIBUTES.ID }}=%s))"
|