mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
2383311b7c
xwiki was listed in requirement 036 as an unverified candidate. Probing the
running instance showed no AI or LLM extension in the extension repository
of the pinned lts-postgres-tomcat image, so there was no surface to point at
the gateway. Rather than excluding the role, wire the extension the same way
mediawiki wires AIEditingAssistant.
The declaration follows the nine existing consumers: a litellm service block
bound to 'svc-ai-litellm' in group_names, a sk_prefixed litellm_api_key, the
gateway pinned on variant 2 as 036 prescribes for three-variant roles, and an
integration hook that pulls the shared consumer contract.
meta/addons/ai-llm.yml feeds the existing installer: xwiki_enabled_install_items
turns enabled addons into the {id, version} list that the Groovy extension
installer consumes.
Two limits, deliberately not papered over. The maven coordinate
org.xwiki.contrib.llm:application-ai-llm-ui at 0.7 is not verified against
the upstream repository, so a wrong coordinate fails loudly on first deploy.
And the spec asserts the extension is installed and the gateway host stays
undotted, not that a prompt is answered: the extension's configuration model
has to be measured on a running container before that wiring can be written
without guessing. xwiki therefore does not yet satisfy criterion 6.
This role has never been deployed; only the gate has run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
41 lines
2.5 KiB
Bash
41 lines
2.5 KiB
Bash
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
AI_GATEWAY_BASE_URL={{ LITELLM_OPENAI_BASE_LOCAL_URL | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — gated by the ldap-authenticator addon spec, not the main persona spec
|
|
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — gated by the ai-llm addon spec, whose addon flag is itself bound to services.litellm.enabled
|
|
LITELLM_SERVICE_ENABLED={{ lookup('config', application_id, 'services.litellm.enabled') | string | lower }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
NODE_TLS_REJECT_UNAUTHORIZED=0
|
|
|
|
# nocheck: persona-block-rationale — the administrator is provisioned as an XWiki.XWikiUsers object carrying no password property (templates/xml/user/xwikiusers_object.xml.j2:3-8), and every privileged call of the role authenticates as the built-in superadmin with credentials.superadminpassword (vars/main.yml:28-29); neither is the Keycloak secret the persona helpers submit. The Keycloak coupling is proven through XWiki's own login action in files/playwright/addons/oidc-authenticator.spec.js:35-51.
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above; biber has no XWiki user page at all (tasks/03_administrator.yml provisions the administrator only) and the OIDC group mapping stays commented out (templates/xwiki.properties.j2:23-25), so an auto-provisioned biber would land without rights.
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|
|
{{ lookup('addon_env_flags', application_id) }}
|