mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 12:47:04 +00:00
kevinveenbirkenbachandClaude Opus 5.5
131e8ea108
CI run 40979252521 SuiteCRM#0 (swarm) picked the onion sibling and every signed-in design spec failed on "the administrator owns a SuiteCRM session" (100 times in the job log). The SAML ACS is %env(SITE_URL)%/saml/acs and SITE_URL is the single canonical URL, so the trace shows Keycloak posting the assertion to https://suite.crm.main.infinito.test/saml/acs; the session landed on clearnet and the onion host bounced back to /saml/login. Keycloak would also have refused an onion ACS, because the SAML client listed only the clearnet one. - SuiteCRM: an auto_prepend_file (site_url.php, config-mounted) sets $_ENV['SITE_URL'] to the network sibling the request arrived on, matched only against the sibling URLs rendered at deploy time; Kernel::setSiteURLEnv keeps an existing value. The canonical host and CLI runs keep the installer's site_url. The mount target is read from the volume registry. - Keycloak: the SAML client's redirectUris come from lookup('network_urls', <app>/saml/acs). Additive: clearnet stays first and a single-network node renders the same one-entry list. Executing the rendered site_url.php in PHP sets the onion URL for the onion host (with and without :80) and leaves SITE_URL unset for the clearnet host, a forged host and the CLI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>