Files
computer-playbook/roles/web-svc-onlyoffice/meta/secrets.yml
kevinveenbirkenbachandClaude Opus 5 6683d89470 fix(onlyoffice): validate the JWT secret against the generator that makes it
algorithm: random_hex emits secrets.token_hex(64), which is 128 lowercase hex
characters. The declared pattern demanded 64 characters from a set that
includes uppercase, so it could never match a value its own generator produced.
web-app-gitlab and web-app-bigbluebutton already spell the same algorithm as
^[a-f0-9]{128}$.

Nothing enforces the validation field today - utils/cache/schema_credentials.py
treats it as a leaf marker only - so this corrects a declaration that lied
rather than a live failure. It matters the moment anyone wires the field up.

Found while triaging the ONLYOFFICE connector in run 34294297836; the same
unsatisfiable shape sat in web-svc-coturn, where the credential has since been
replaced by a declared user.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-09 12:35:35 +02:00

7 lines
225 B
YAML

---
credentials:
onlyoffice_jwt_secret:
description: JWT secret for signing callback and document requests between Nextcloud and the ONLYOFFICE Document Server.
algorithm: random_hex
validation: ^[a-f0-9]{128}$