mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 21:26:44 +00:00
kevinveenbirkenbachandClaude Opus 5
e355bbdb8b
Eight server roles declare an `mcp` RBAC role, so the platform mints roles/<app>/mcp and the administrator joins it. Open WebUI now honours those groups instead of flattening them to user/admin, and each MCP tool server is restricted to the group of the role that serves it. The grant cannot be rendered: Open WebUI matches it against a group id that insert_new_group mints as a fresh UUID, so tasks/01_mcp.yml resolves the group after the container is up and writes the grant through the admin API, the way every instance-minted credential in this repository is provisioned. Entries render disabled. An empty access_grants is not 'nobody', Open WebUI reads it as every administrator, and ENABLE_PERSISTENT_CONFIG=false makes the env authoritative again on every start. Enabling only together with the grant keeps the fallback at no access rather than too much. The provisioning account is the role-internal openwebui-api-bot, never a platform identity: OAUTH_MERGE_ACCOUNTS_BY_EMAIL ships disabled and an OIDC login whose email a local account already holds is refused, so seeding a person's address would lock them out. Known limits are documented rather than claimed away: a bare restart leaves MCP off until the next deploy, a user's roles list carries no application context so roles: [mcp] grants every deployed mcp group at once, and Open WebUI drops a stale membership only while the groups claim is non-empty. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Custom Filter Plugins for Infinito.Nexus
This directory contains custom Ansible filter plugins used within the Infinito.Nexus project.
When to Use a Filter Plugin
- Transform values: Use filters to transform, extract, reformat, or compute values from existing variables or facts.
- Inline data manipulation: Filters are designed for inline use in Jinja2 expressions (in templates, tasks, vars, etc.).
- No external lookups: Filters only operate on data you explicitly pass to them and cannot access external files, the Ansible inventory, or runtime context.
Examples
{{ role_name | get_entity_name }}
{{ my_list | unique }}
{{ user_email | regex_replace('^(.+)@.*$', '\\1') }}
When not to Use a Filter Plugin
- If you need to load data from an external source (e.g., file, environment, API), use a lookup plugin instead.
- If your logic requires access to inventory, facts, or host-level information that is not passed as a parameter.