kevinveenbirkenbachandClaude Opus 4.7
0effa1670a
`web-opt-rdr-www` generates a redirect vhost
`<NGINX_DIR>/conf.d/servers/{http,https}/www.<domain>.conf` for every
deployed app's canonical and alias domains. Those redirect vhosts are
not part of any app's `server.domains.{canonical,aliases}` list, so the
entity-keyed purge primitive in `utils/cleanup/nginx_vhosts.py` did
not yield them and `iter_vhost_files_for_entity` left them on disk.
Between matrix-deploy rounds this leaked the redirect vhosts of the
previous round's broader app set into the next round's narrower one.
On run 26451828677 job 77879571696 (web-opt-rdr-www on debian) the
round 1 -> round 2 transition
round 1/2 inv=github-0 apps=[15 apps incl. web-svc-cdn,
web-svc-simpleicons, web-svc-css, ...]
round 2/2 inv=github-1 apps=[web-opt-rdr-www]
dropped the bare `cdn.infinito.example.conf` etc. via the existing
purge but kept the matching `www.cdn.infinito.example.conf`,
`www.icon.infinito.example.conf`, ... behind. Round 2 only redeploys
web-opt-rdr-www, whose `www_redirect_domains` lookup now only emits
its own `www.w3redirect.<primary>` redirect, so nothing reissues the
stale www-prefixed vhosts.
`sys-ctl-hlth-csp` discovers domains by scanning .conf filenames in
the nginx servers dir, so it still probed the stale `www.<x>.conf`
hosts. nginx served them with a cert whose SAN no longer covered the
hostname (the per-domain cert path baked into the conf had been
removed alongside the bare vhost), the TLS handshake returned
`net::ERR_SSL_UNRECOGNIZED_NAME_ALERT`, the CSP probe exited 11, and
`sys-service-terminator : Apply state` failed after 10 retries.
Extend `iter_vhost_files_for_entity` to also yield the
`www.<domain>.conf` variant for every domain it already yields,
skipping domains that already begin with `www.` so a role that
declares its canonical with a leading `www.` (web-opt-rdr-www's own
`www.w3redirect.<primary>`) does not produce `www.www.<x>.conf`. The
existing two- and three-step purge primitives (db / compose / dir /
nginx) and the orchestrator in `scripts/container/purge/apps.sh` keep
their entity-keyed contract; only the per-entity yield set widens.
Coverage:
- test_yields_www_redirect_variant: per-app www-prefixed file is
yielded alongside the bare vhost.
- test_www_prefixed_domain_not_double_prefixed: a www-prefixed
canonical does not synthesize `www.www.<x>` even when such a file
exists on disk (defense in depth against a future regression that
prepends unconditionally).
- test_removes_www_redirect_variant: end-to-end purge removes both
bare and www variant, leaves an unrelated www-prefixed file alone.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Infinito.Nexus 🚀
🔐 One login. ♾️ Infinite applications
What is Infinito.Nexus? 📌
Infinito.Nexus is an automated, modular infrastructure framework built on Docker, Linux, and Ansible, equally suited for cloud services, local server management, and desktop workstations. At its core lies a web-based desktop with single sign-on, backed by an LDAP directory and OIDC, granting seamless access to an almost limitless portfolio of self-hosted applications. It fully supports ActivityPub applications and is Fediverse-compatible, while integrated monitoring, alerting, cleanup, self-healing, automated updates, and backup solutions provide everything an organization needs to run at scale.
| 📚 | 🔗 |
|---|---|
| 🌐 Try It Live |  |
| 🔧 Request Your Setup |  |
| 📖 About This Project |   |
| ☕️ Support Us |     |
Key Features 🎯
-
Automated Deployment 📦 Turn up servers and workstations in minutes with ready-made Ansible roles.
-
Enterprise-Grade Security 🔒 Centralized user management via LDAP & OIDC (Keycloak), plus optional 2FA and encrypted storage.
-
Modular Scalability 📈 Grow from small teams to global enterprises by composing only the services you need.
-
Fediverse & ActivityPub Support 🌐 Seamlessly integrate Mastodon, Peertube, Matrix and other ActivityPub apps out of the box.
-
Self-Healing & Maintenance ⚙️ Automated cleanup, container healing, and auto-updates keep infrastructure healthy without human intervention.
-
Monitoring, Alerting & Analytics 📊 Built-in system, application, and security monitoring with multi-channel notifications.
-
Backup & Disaster Recovery 💾 Scheduled backups and scripted recovery processes to safeguard your data.
-
Continuous Updates 🔄 Automatic patching and version upgrades across the stack.
-
Application Ecosystem 🚀 A curated suite of self-hosted apps, from project management, version control, and CI/CD to chat, video conferencing, CMS, e-learning, social networking, and e-commerce, all seamlessly integrated.
Get Started 🚀
Use it online 🌐
Try Infinito.Nexus – sign up in seconds, explore the platform, and discover what our solution can do for you! 🚀🔧✨
Guides 📚
- Installation Guide for local CLI installation, Docker execution, and source builds.
- Deploy Guide for inventory creation, full deploys, and redeploy flows.
Contributing 🔨
For the full development setup, contribution workflow, testing, and coding standards, see CONTRIBUTING.md.
Invest 💹
We are actively looking for investors to help scale Infinito.Nexus and bring open, self-hosted infrastructure to more organizations worldwide. If you are interested in investing or partnering with us, please reach out via our Investor Relations contact.
Code of Conduct 🕊️
We are committed to fostering an open and welcoming environment. Please read our CODE_OF_CONDUCT.md to understand the standards we expect from all participants in our community.
Security 🛡️
For security reporting and disclosure, see SECURITY.md.
Support and Contact 💼
For expert installation, contact details, and project participation, see SUPPORT.md.
License ⚖️
Infinito.Nexus is distributed under the Infinito.Nexus Community License (Non-Commercial). Please see LICENSE.md for full terms.