mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
Prageeth Panicker
bad29c2f0d
playwright.env.j2's SUPER_ADMIN_PASSWORD/USERNAME lines looked up web-app-keycloak's secrets unconditionally, with no check that Keycloak is actually part of the deploy. This has been true since the role's first commit, but was silently masked: the role's old tor: enabled: true pulled in svc-net-tor, which declares Keycloak as its onion-SSO provider, so Keycloak always ended up in the deploy regardless of variant. Removing tor (fix(web-app-wazuh): serve clearnet only) correctly stopped that accidental masking - variant 1 (SSO/LDAP off) no longer pulls Keycloak in at all, so the unconditional lookup now fails with 'Key administrator_password not found', confirmed on both a fedora (compose) and centos (swarm) CI run. Guards both lookups on WAZUH_OIDC_ENABLED (vars/main.yml, already resolved from services.sso.enabled - i.e. whether Keycloak is in group_names), matching the existing guards on PERSONA_ADMINISTRATOR_ BLOCKED and SSO_SERVICE_ENABLED a few lines above in the same file. Falls back to an empty quoted string when SSO is off, so the lookup never executes on that branch. Verified: rendered both lines directly with a stub lookup that raises if called - confirms the lookup is never evaluated when OIDC is off. Confirmed variant 0 (SSO on) is unaffected. 22 passing tests across the role's playwright/lint/mcp-secret suites. Not run: a live compose/swarm deploy of variant 1 - the actual proof this resolves the CI failure, pending next CI run. While investigating, found the same unguarded-lookup pattern exists in web-app-zammad (reads svc-db-postgres's password with no check that postgres is in the deploy) - flagged for Kevin, not touched here since it's unrelated to anything this branch changes.
37 lines
1.7 KiB
Bash
37 lines
1.7 KiB
Bash
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
KEYCLOAK_ADMIN_CLI_CLIENT_ID={{ OIDC.ADMIN.CLI_CLIENT_ID | dotenv_quote }}
|
|
|
|
KEYCLOAK_ADMIN_REALM={{ OIDC.ADMIN.REALM | dotenv_quote }}
|
|
|
|
KEYCLOAK_BASE_URL={{ OIDC.URL | dotenv_quote }}
|
|
|
|
KEYCLOAK_REALM_NAME={{ OIDC.CLIENT.REALM | dotenv_quote }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
|
|
|
|
# nocheck: persona-block-rationale with sso off the dashboard only accepts the internal admin/kibanaserver HTTP basic accounts, and the persona helper drives Keycloak login only.
|
|
PERSONA_ADMINISTRATOR_BLOCKED={{ (not (WAZUH_OIDC_ENABLED | bool)) | string | lower }}
|
|
|
|
RBAC_GROUP_PATH_PREFIX={{ ('/' ~ (RBAC.GROUP.NAME | trim('/')) ~ '/' ~ application_id ~ '/') | dotenv_quote }}
|
|
|
|
SSO_SERVICE_ENABLED={{ WAZUH_OIDC_ENABLED | string | lower }}
|
|
|
|
SUPER_ADMIN_PASSWORD={{ (lookup('config', 'web-app-keycloak', 'secrets.credentials.administrator_password') | dotenv_quote) if (WAZUH_OIDC_ENABLED | bool) else '""' }}
|
|
|
|
SUPER_ADMIN_USERNAME={{ (lookup('config', 'web-app-keycloak', 'services.keycloak.accounts.system.username') | dotenv_quote) if (WAZUH_OIDC_ENABLED | bool) else '""' }}
|