mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.7
cd7d0e29f2
In variant 1, sys-stk-front-base loads web-opt-rdr-domains for the
redirect set; its `include_tasks` loop sets `domain` from each
`item.source`. Ansible's include_tasks vars precedence (22) outranks the
task-level `vars:` block (17) on the subsequent "Deploy NGINX config"
task in sys-stk-front-proxy, so role-specific proxy.conf.j2 templates
that reference `{{ domain }}` directly render with the leaked redirect
source instead of the deployed app's domain. nginx then has no server
block for the intended SNI → sys-ctl-hlth-webserver fails with
TLSV1_UNRECOGNIZED_NAME and the deploy aborts at sys-service-terminator.
The generic vhost template `sys-svc-proxy/templates/vhost/basic.conf.j2`
already carries the canonical workaround (lines 1-2):
{% set application_id = front_proxy_application_id | default(application_id) %}
{% set domain = front_proxy_domain | default(domain) %}
Apply the same rebind to the role-specific proxy.conf.j2 of web-svc-html
(both rebinds missing) and web-svc-file (application_id rebind already
present, domain rebind missing). `front_proxy_domain` is set_fact-frozen
at the start of sys-stk-front-proxy from the outer load_app context and
verified correct in the run log (line 390447, html job in variant 1).
Unblocks 4/5 cluster-2 jobs on run 26362676803:
* web-svc-html (77602110571) — direct
* web-svc-file (77602110558) — direct
* web-svc-asset (77602110556) — variant-1 bundle [asset, file]
* web-svc-legal (77602110552) — variant-1 bundle [legal, html]
web-svc-xmpp (77602110559) has a separate failure mode (HTTP 404, not
SNI mismatch) and is not addressed here.
Static check only (per operator request).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
31 lines
847 B
Django/Jinja
31 lines
847 B
Django/Jinja
{% set application_id = front_proxy_application_id | default(application_id) %}
|
|
{% set domain = front_proxy_domain | default(domain) %}
|
|
server
|
|
{
|
|
server_name {{ domain }};
|
|
|
|
{% include 'roles/sys-front-tls/templates/nginx_ssl_header.j2' %}
|
|
|
|
{% include 'roles/sys-front-inj-all/templates/server.conf.j2'%}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/headers/content_security_policy.conf.j2' %}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/headers/access_control_allow.conf.j2' %}
|
|
|
|
charset utf-8;
|
|
|
|
location /
|
|
{
|
|
root {{lookup('nginx','directories.data.html')}};
|
|
index index.html index.htm;
|
|
{% include 'roles/sys-front-inj-all/templates/location.lua.j2' %}
|
|
}
|
|
|
|
location /.well-known/ {
|
|
alias {{ lookup('nginx','directories.data.well_known') }};
|
|
allow all;
|
|
default_type "text/plain";
|
|
autoindex on;
|
|
}
|
|
}
|