mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 12:47:04 +00:00
kevinveenbirkenbachandClaude Opus 5
774ff8c2d2
Three conflicts, all from main sizing memory parameters off the container limit while this branch moved container environments into one file per role. plugins/filter/memory_filters.py and its test are deleted on main, replaced by the service_memory_mb lookup. This branch only renamed the filter out of its get_ prefix and fixed the docstrings' reStructuredText, so nothing of substance is lost; the deletion is taken. Verified first that no consumer survives: jvm_max_mb, jvm_min_mb and redis_maxmemory_mb appear nowhere in roles/, group_vars/, tests/, plugins/, cli/ or utils/ once the merged tree is in place. web-app-zammad's search service is the only real conflict.37e80b957emoved discovery.type, xpack.security.enabled and ES_JAVA_OPTS from the compose template into templates/env.j2, where an inline `environment:` block is what the compose-environment-from-env-file lint rejects;a7db89ac0bchanged the heap from a literal 512m to half the container's limit. Both intents hold, so the keys stay in env.j2 and the heap now reads ZAMMAD_SEARCH_HEAP_MB, which the merged vars/main.yml already defines through the new lookup. web-app-magento and web-app-shopware keep their inline environment blocks: both carry an explicit nocheck naming the reason, that their single env.j2 is shared with containers the search daemon's keys must not reach. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Custom Filter Plugins for Infinito.Nexus
This directory contains custom Ansible filter plugins used within the Infinito.Nexus project.
When to Use a Filter Plugin
- Transform values: Use filters to transform, extract, reformat, or compute values from existing variables or facts.
- Inline data manipulation: Filters are designed for inline use in Jinja2 expressions (in templates, tasks, vars, etc.).
- No external lookups: Filters only operate on data you explicitly pass to them and cannot access external files, the Ansible inventory, or runtime context.
Examples
{{ role_name | entity_name }}
{{ my_list | unique }}
{{ user_email | regex_replace('^(.+)@.*$', '\\1') }}
When not to Use a Filter Plugin
- If you need to load data from an external source (e.g., file, environment, API), use a lookup plugin instead.
- If your logic requires access to inventory, facts, or host-level information that is not passed as a parameter.
Schema 🗺️
How csp_filters.py assembles one application's Content-Security-Policy. Scope is the header build, not the other filters in this directory.
flowchart TD
decl["meta/csp.yml<br/>whitelist, flags, hashes"]
svc["meta/services.yml<br/>services.logout.enabled"]
flags["csp_filters.py:136<br/>get_csp_flags"]
grant["csp_filters.py:354<br/>logout grant"]
wl["csp_filters.py:123<br/>get_csp_whitelist"]
inj["sys-front-inj-dashboard,<br/>-javascript, -matomo, -logout<br/>add_csp_hash"]
gate["csp_filters.py:365<br/>hash gate"]
build["csp_filters.py:203<br/>build_csp_header"]
header["set $csp<br/>nginx vhost"]
decl -->|"1. flags read by"| flags
flags -->|"2. tokens"| build
svc -->|"3. read by"| grant
grant -->|"4. adds 'unsafe-inline'<br/>to script-src-elem and -attr"| build
decl -->|"5. whitelist read by"| wl
wl -->|"6. tokens"| build
inj -->|"7. snippets"| gate
gate -->|"8. hashes, only when<br/>'unsafe-inline' is absent"| build
build -->|"9. joined string"| header
grant -.->|"TRIP-WIRE: the token it adds<br/>closes the gate below, so every<br/>registered hash is discarded"| gate
svc -.->|"TRIP-WIRE: the flag derives from<br/>group_names, so the script policy<br/>follows the round, not the app"| grant
grant -.->|"TRIP-WIRE: absent from the<br/>smart-defaults docstring, which<br/>names logout only for frame-ancestors"| build
Styles carry 'unsafe-inline' by default; scripts do not. The logout grant is the only path that puts it into a script directive.