0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-12 13:47:01 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.8 fb1414bb56 chore(web-app): bump image versions; gate Nextcloud OIDC plugins as mandatory

Bump:
- web-app-seaweedfs: chrislusf/seaweedfs 3.80 -> 4.33; nginx proxy 1.29 -> 1.31-alpine
- web-app-peertube: chocobozzz/peertube v8.2.0 -> v8.2.1
- web-app-prometheus: prom/alertmanager v0.32.2 -> v0.33.0

Hold Nextcloud at 33-fpm-alpine: NC 34 breaks the OIDC+LDAP login flavor
because pulsejet/nextcloud-oidc-login (app id oidc_login) caps at NC
max-version 33 with no NC 34 release, leaving the hidden native login
form with no OIDC button -> lockout (root cause of the PR #312 deploy
failure, surfaced only as a Playwright login timeout).

Mark the OIDC login plugins (oidc_login, sociallogin, user_oidc)
mandatory: true and fail the deploy at install time when a mandatory,
enabled plugin is not runnable (incompatible/unavailable), instead of
silently provisioning a login-broken instance. This makes a future NC
bump that outpaces the OIDC app fail fast with a clear cause.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-17 11:30:35 +02:00

hooks

…

01_install.yml

chore(web-app): bump image versions; gate Nextcloud OIDC plugins as mandatory

2026-06-17 11:30:35 +02:00

02_enable.yml

…

03_configure.yml

…

README.md

chore(web-app): bump image versions; gate Nextcloud OIDC plugins as mandatory

2026-06-17 11:30:35 +02:00

README.md

Nextcloud plugin pipeline

This directory holds the per-plugin install + enable + configure pipeline that runs once for every entry under services.nextcloud.plugins in roles/web-app-nextcloud/meta/services.yml.

Scope

The pipeline owns three responsibilities for one Nextcloud plugin (app):

Install the plugin into the running Nextcloud container.
Enable the plugin so the in-app code paths are active.
Apply plugin-specific configuration keys and run any role-local hook.

When a plugin is marked enabled: false, 06_plugin.yml runs occ app:disable for that plugin instead of entering the pipeline.

Pipeline stages

Each tasks/plugin/<step>.yml file owns exactly one OCC stage and one decision about whether to continue.

File	Stage	OCC command	Continues to next stage when
01_install.yml	install	`occ app:install`	install result is `runnable` (success or already installed)
02_enable.yml	enable	`occ app:enable`	enable result is not flagged `incompatible`
03_configure.yml	configure	`occ config:app:set` plus optional hook	(terminal stage)

The classification of "runnable" and "incompatible" is computed by the Jinja filter nextcloud_install_status defined in roles/web-app-nextcloud/filter_plugins/nextcloud_install.py. The filter inspects rc, stdout, and stderr from the OCC call and returns flags that drive until, failed_when, and when.

Version-compatibility tolerance

A plugin MAY ship an appstore release that lags the pinned Nextcloud server major. In that case OCC emits the marker string is not compatible with this version of the server and exits non-zero. The pipeline MUST treat this as a non-fatal condition:

01_install.yml accepts the install as terminal so the retry loop ends immediately.
01_install.yml and 02_enable.yml each emit a debug warning that the plugin will be skipped for this run.
The next stage in the pipeline MUST NOT execute when the previous stage classified the plugin as incompatible.

Once a compatible release ships, the next deploy run will install + enable + configure the plugin automatically without operator intervention.

Mandatory plugins

A plugin entry MAY set mandatory: true. This inverts the tolerance above: when the plugin is enabled for the current deployment but its install result is not runnable (incompatible with the pinned server major, or unavailable on the appstore), 01_install.yml aborts the deployment with ansible.builtin.fail instead of emitting the skip warning.

The OIDC login entry points (oidc_login, sociallogin, user_oidc) are mandatory because they gate SSO login: when one of them is the selected flavor and the system hides the native login form, an un-installed OIDC app leaves the instance with no usable login path. Failing at install time surfaces the version-pin mismatch immediately rather than as a downstream login timeout in the Playwright e2e suite.

Adding configuration for a plugin

Per-plugin configuration is keyed by the plugin name and rendered by 03_configure.yml. A new plugin requires no changes here when the plugin's vars and hook files are present at the conventional paths.

Configuration keys (optional). Create vars/plugins/<plugin_key>.yml and define a plugin_configuration list. Each list item MUST contain appid, configkey, and configvalue. 03_configure.yml invokes occ config:app:set for every entry.
Custom logic (optional). Create tasks/plugin/hooks/<plugin_key>.yml. The hook runs after config:app:set and MAY perform plugin-specific provisioning such as LDAP wiring or REST calls against the live container.

Both files are looked up via the path constants NEXTCLOUD_CNODE_PLUGIN_VARS_PATH and NEXTCLOUD_CNODE_PLUGIN_TASKS_PATH defined in vars/main.yml. Missing files MUST be tolerated; the corresponding step skips cleanly.

Mutually exclusive plugins

A plugin entry under services.nextcloud.plugins MAY declare an incompatible_plugins list. 01_install.yml runs occ app:disable for every listed plugin before the install attempt. This guarantees that mutually exclusive integrations such as the OIDC entry points (oidc_login, sociallogin, user_oidc) and the document-editing surfaces (onlyoffice, richdocuments, fileslibreofficeedit) cannot accidentally coexist on the same instance.

Entry point

The pipeline is invoked from 06_plugin.yml, which in turn runs once per iteration of the NEXTCLOUD_PLUGIN_ITEMS loop in main.yml. The loop variable plugin_item is unpacked into plugin_key (the OCC app name) and plugin_value (its meta entry).