mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
c7727a5996
The credential was baked into the image: files/Dockerfile appended xwiki.superadminpassword to WEB-INF/xwiki.cfg from a build arg. The swarm matrix rotates it between passes, so the manager rebuilds the image with the new value, but 'docker stack deploy --resolve-image never' leaves the mutable tag untouched and a worker that already holds it never re-pulls. The task keeps serving the pre-rotation password and answers 401 to every authenticated call the deploy makes next, which is where both XWiki jobs of run 33445831564 died: 03_administrator.yml:7 and 04_extensions.yml:25, after 31 attempts each. The entrypoint writes it at start instead, from the environment the role already renders into templates/env.j2 and that sys-svc-container/templates/base.yml.j2 attaches as env_file. Both copies of xwiki.cfg are written, because the stock entrypoint restores the data volume over WEB-INF on every start but the first; writing only WEB-INF would survive one boot and be reverted by the next. The keys are deleted and re-appended rather than substituted, so a generated password never reaches a sed replacement. Read from xwiki/xwiki-docker at master to settle three assumptions: other_starts() does restore xwiki.cfg, the stock entrypoint never touches the superadmin keys, and CONTEXT_PATH defaults to ROOT. The delete pattern was exercised against all four key spellings xwiki_replace accepts, and a password carrying sed metacharacters was verified to arrive byte for byte. Dropping the build arg also keeps the credential out of the image history. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
43 lines
2.3 KiB
Django/Jinja
43 lines
2.3 KiB
Django/Jinja
{% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
|
|
{% set service_name = 'xwiki' %}
|
|
{{ service_name }}:
|
|
{{ lookup('template', 'roles/sys-svc-container/templates/build.yml.j2') | indent(4) }}
|
|
args:
|
|
XWIKI_IMAGE: "{{ XWIKI_IMAGE }}"
|
|
XWIKI_VERSION: "{{ XWIKI_VERSION }}"
|
|
{{ lookup('container_image', application_id, 'xwiki') }}
|
|
{{ lookup('compose_only', 'container_name', XWIKI_CONTAINER) }}
|
|
hostname: '{{ XWIKI_HOSTNAME}}'
|
|
{{ lookup('container_ports', ['xwiki', 'http', DOCKER_BIND_HOST]) | indent(4) }}
|
|
environment:
|
|
JAVA_OPTS: >-
|
|
{% if xwiki_oidc_enabled_switch| bool %}
|
|
-Dxwiki.authentication.authservice=oidc
|
|
-Dxwiki.authentication.authclass=org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl
|
|
{% elif xwiki_ldap_enabled_switch | bool %}
|
|
-Dxwiki.authentication.authclass=org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl
|
|
-Dxwiki.authentication.authservice=ldap
|
|
-Dxwiki.authentication.ldap=1
|
|
-Dxwiki.authentication.ldap.trylocal={{ (XWIKI_LDAP_TRYLOCAL | bool) | ternary(1, 0) }}
|
|
-Dxwiki.authentication.ldap.group_mapping=XWiki.{{ XWIKI_ADMIN_GROUP_PAGE }}={{ XWIKI_LDAP_ADMIN_GROUP_DN }}
|
|
-Dxwiki.authentication.ldap.mode_group_sync=always
|
|
-Dxwiki.authentication.ldap.server={{ XWIKI_LDAP_SERVER }}
|
|
-Dxwiki.authentication.ldap.port={{ XWIKI_LDAP_PORT }}
|
|
-Dxwiki.authentication.ldap.base_DN={{ XWIKI_LDAP_BASE_DN }}
|
|
-Dxwiki.authentication.ldap.bind_DN={{ XWIKI_LDAP_BIND_DN }}
|
|
-Dxwiki.authentication.ldap.bind_pass={{ XWIKI_LDAP_BIND_PASS }}
|
|
-Dxwiki.authentication.ldap.fields_mapping={{ XWIKI_LDAP_FIELDS_MAPPING }}
|
|
-Dxwiki.authentication.ldap.update_user=1
|
|
{% else %}
|
|
-Dxwiki.authentication.authservice=standard
|
|
-Dxwiki.authentication.authclass=com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl
|
|
{% endif %}
|
|
{{ lookup('container_volumes', service_name) | indent(4) }}
|
|
{{ lookup('container_healthcheck', service_name) | indent(4) }}
|
|
{% include 'roles/sys-svc-container/templates/base.yml.j2' %}
|
|
{{ lookup('container_depends_on', application_id) | indent(4) }}
|
|
{{ lookup('container_networks') | indent(4) }}
|
|
|
|
{{ lookup('compose_volumes') }}
|
|
{{ lookup('compose_networks') }}
|