0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

History

kevinveenbirkenbachandClaude Opus 5.5 0986957e52 fix(proxy): strip upstream headers on every proxying location fragment

proxy_hide_header is replaced, not merged, by a location that sets its own,
so upstream_strips.conf.j2 only takes effect where a location includes it.
The health locations of web-app-prometheus (/healthz/ready, /_live_probe),
which every standard vhost includes, and the extra locations of
web-app-bluesky (/config, /ipcc) and web-app-opentalk (/v1/, /signaling,
/livekit) proxied without it, so X-Powered-By and the upstream's
Strict-Transport-Security leaked on those paths.

All seven locations now include the strips. A new lint checks every role
template without a server block, i.e. every fragment the front proxy
renders into a vhost, and fails on a proxying location that lacks them.
Templates with their own server block are app-internal nginx configs
behind such a location and stay out of scope.

Closes #1124

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-22 10:33:53 +02:00

__init__.py

refactor(python): clear the open CodeQL code-quality alerts

2026-10-20 21:40:58 +02:00

README.md

…

test_compose_extra_hosts_use_lookup.py

…

test_compose_ports_use_container_ports_lookup.py

fix(lint): let the two port lints see the edge proxy as the edge

2026-09-15 17:03:18 +02:00

test_compose_service_names_no_entity_prefix.py

…

test_compose_template_file_bind_mount_swarm_fragile.py

…

test_compose_template_no_inline_mount_section.py

…

test_compose_template_no_unguarded_depends_on_condition.py

…

test_compose_template_no_unguarded_network_mode_host.py

…

test_compose_template_no_unguarded_profiles.py

…

test_compose_template_structure.py

…

test_compose_template_uses_depends_on_lookup.py

…

test_container_address_requires_service_name.py

…

test_container_healthcheck_declared_is_used.py

…

test_container_healthcheck_literal_without_variables.py

test(lint): a variable-free healthcheck belongs in meta/services.yml

2026-09-09 20:33:14 +02:00

test_container_healthcheck_requires_probe.py

…

test_container_volumes_call_shape.py

…

test_env_file_template_dotenv_syntax.py

…

test_env_file_template_no_literal_quotes.py

…

test_env_j2_no_value_whitespace.py

…

test_firewall_fragment_verdicts.py

test(lint): refuse an accept verdict in a firewall fragment

2026-09-15 21:14:10 +02:00

test_mode_incompatible_keys.py

…

test_model_backend_via_gateway.py

feat(svc-ai-litellm): bind every gateway consumer to the contract it declares

2026-08-29 00:09:56 +02:00

test_no_ansible_facts_in_templates.py

test(lint): let the host-fact rule see what its name promises

2026-08-30 14:24:32 +02:00

test_no_config_lookup_for_volumes.py

…

test_no_lookup_config_jinja_default.py

…

test_no_raw_image_in_compose_templates.py

…

test_proxy_location_strips.py

fix(proxy): strip upstream headers on every proxying location fragment

2026-10-22 10:33:53 +02:00

test_sandbox_no_host_escape.py

…

test_shell_templates_are_valid.py

fix(code-scanning): resolve the alerts that describe real code

2026-10-06 09:18:00 +02:00

test_software_identity_variables.py

feat(lint): render the software identity from its declared variables

2026-09-15 21:38:45 +02:00

README.md

Jinja Lints 🪄

Lint tests that enforce correct Jinja2 filter and lookup composition in Ansible templates and task definitions.

Tests in this directory MUST only cover Jinja2 expression composition rules. Rules that validate where dotted-path targets are declared live in the sibling ../variables/ directory.

test_no_lookup_config_jinja_default.py forbids lookup('config', application_id, 'path') | default(X). The two-term config lookup raises on a missing key, so the Jinja default(...) filter never fires; the fallback MUST be passed as the lookup's third argument instead.

For framework, directory layout, and make test-lint usage see lint.md.