mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-30 08:06:47 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
86 lines
2.5 KiB
Makefile
86 lines
2.5 KiB
Makefile
ROLES_DIR := ./roles
|
|
APPLICATIONS_OUT := ./group_vars/all/04_applications.yml
|
|
APPLICATIONS_SCRIPT := ./cli/build/defaults/applications.py
|
|
USERS_OUT := ./group_vars/all/03_users.yml
|
|
USERS_SCRIPT := ./cli/build/defaults/users.py
|
|
INCLUDES_SCRIPT := ./cli/build/role_include.py
|
|
|
|
INCLUDE_GROUPS := $(shell python3 main.py meta categories invokable -s "-" --no-signal | tr '\n' ' ')
|
|
|
|
# Directory where these include-files will be written
|
|
INCLUDES_OUT_DIR := ./tasks/groups
|
|
|
|
# Compute extra users as before
|
|
RESERVED_USERNAMES := $(shell \
|
|
find $(ROLES_DIR) -maxdepth 1 -type d -printf '%f\n' \
|
|
| sed -E 's/.*-//' \
|
|
| grep -E -x '[a-z0-9]+' \
|
|
| sort -u \
|
|
| paste -sd, - \
|
|
)
|
|
|
|
.PHONY: build install test
|
|
|
|
clean-keep-logs:
|
|
@echo "🧹 Cleaning ignored files but keeping logs/…"
|
|
git clean -fdX -- ':!logs' ':!logs/**'
|
|
|
|
clean:
|
|
@echo "Removing ignored git files"
|
|
git clean -fdX
|
|
|
|
list:
|
|
@echo Generating the roles list
|
|
python3 main.py build roles_list
|
|
|
|
tree:
|
|
@echo Generating Tree
|
|
python3 main.py build tree -D 2 --no-signal
|
|
|
|
mig: list tree
|
|
@echo Creating meta data for meta infinity graph
|
|
|
|
dockerignore:
|
|
@echo Create dockerignore
|
|
cat .gitignore > .dockerignore
|
|
echo ".git" >> .dockerignore
|
|
|
|
messy-build: dockerignore
|
|
@echo "🔧 Generating users defaults → $(USERS_OUT)…"
|
|
python3 $(USERS_SCRIPT) \
|
|
--roles-dir $(ROLES_DIR) \
|
|
--output $(USERS_OUT) \
|
|
--reserved-usernames "$(RESERVED_USERNAMES)"
|
|
@echo "✅ Users defaults written to $(USERS_OUT)\n"
|
|
|
|
@echo "🔧 Generating applications defaults → $(APPLICATIONS_OUT)…"
|
|
python3 $(APPLICATIONS_SCRIPT) \
|
|
--roles-dir $(ROLES_DIR) \
|
|
--output-file $(APPLICATIONS_OUT)
|
|
@echo "✅ Applications defaults written to $(APPLICATIONS_OUT)\n"
|
|
|
|
@echo "🔧 Generating role-include files for each group…"
|
|
@mkdir -p $(INCLUDES_OUT_DIR)
|
|
@$(foreach grp,$(INCLUDE_GROUPS), \
|
|
out=$(INCLUDES_OUT_DIR)/$(grp)roles.yml; \
|
|
echo "→ Building $$out (pattern: '$(grp)')…"; \
|
|
python3 $(INCLUDES_SCRIPT) $(ROLES_DIR) \
|
|
-p $(grp) -o $$out; \
|
|
echo " ✅ $$out"; \
|
|
)
|
|
|
|
messy-test:
|
|
@echo "🧪 Running Python tests…"
|
|
PYTHONPATH=. python -m unittest discover -s tests
|
|
@echo "📑 Checking Ansible syntax…"
|
|
ansible-playbook -i localhost, -c local $(foreach f,$(wildcard group_vars/all/*.yml),-e @$(f)) playbook.yml --syntax-check
|
|
|
|
install: build
|
|
@echo "⚙️ Install complete."
|
|
|
|
build: clean messy-build
|
|
@echo "Full build with cleanup before was executed."
|
|
|
|
test: build messy-test
|
|
@echo "Full test with build before was executed."
|