mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-30 08:06:47 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
87 lines
2.3 KiB
YAML
87 lines
2.3 KiB
YAML
---
|
|
|
|
- name: "include docker-compose role"
|
|
include_role:
|
|
name: docker-compose
|
|
|
|
- name: Create {{ domains | get_domain(application_id) }}.conf if LDAP is exposed to internet
|
|
template:
|
|
src: "nginx.stream.conf.j2"
|
|
dest: "{{ NGINX.DIRECTORIES.STREAMS }}{{ domains | get_domain(application_id) }}.conf"
|
|
notify: restart openresty
|
|
when: OPENLDAP_NETWORK_SWITCH_PUBLIC | bool
|
|
|
|
- name: Remove {{ domains | get_domain(application_id) }}.conf if LDAP is not exposed to internet
|
|
file:
|
|
path: "{{ NGINX.DIRECTORIES.STREAMS }}{{ domains | get_domain(application_id) }}.conf"
|
|
state: absent
|
|
when: not OPENLDAP_NETWORK_SWITCH_PUBLIC | bool
|
|
|
|
- name: create docker network for LDAP, so that other applications can access it
|
|
community.docker.docker_network:
|
|
name: "{{ OPENLDAP_NETWORK }}"
|
|
state: present
|
|
ipam_config:
|
|
- subnet: "{{ networks.local[application_id].subnet }}"
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: "Wait for LDAP to be available"
|
|
wait_for:
|
|
host: "127.0.0.1"
|
|
port: "{{ ports.localhost.ldap[application_id] }}"
|
|
delay: 5
|
|
timeout: 120
|
|
state: started
|
|
|
|
- name: "Reset LDAP Credentials"
|
|
include_tasks: 01_credentials.yml
|
|
when:
|
|
- OPENLDAP_NETWORK_SWITCH_LOCAL | bool
|
|
- OPENLDAP_PROVISION_CREDENTIALS | bool
|
|
|
|
- name: "create directory {{ OPENLDAP_LDIF_PATH_HOST }}{{ item }}"
|
|
file:
|
|
path: "{{ OPENLDAP_LDIF_PATH_HOST }}{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop: "{{ OPENLDAP_LDIF_TYPES }}"
|
|
|
|
- name: "Import LDIF Configuration"
|
|
include_tasks: _ldifs_creation.yml
|
|
loop:
|
|
- configuration
|
|
loop_control:
|
|
loop_var: folder
|
|
when: OPENLDAP_PROVISION_CONFIGURATION | bool
|
|
|
|
- name: flush LDIF handlers
|
|
meta: flush_handlers
|
|
|
|
- name: install python-ldap
|
|
community.general.pacman:
|
|
name:
|
|
- python-ldap
|
|
state: present
|
|
|
|
- name: "Include Schemas (if enabled)"
|
|
include_tasks: 02_schemas.yml
|
|
when: OPENLDAP_PROVISION_SCHEMAS | bool
|
|
|
|
- name: "Import LDAP Entries (if enabled)"
|
|
include_tasks: 03_users.yml
|
|
when: OPENLDAP_PROVISION_USERS | bool
|
|
|
|
- name: "Import LDIF Data (if enabled)"
|
|
include_tasks: _ldifs_creation.yml
|
|
loop:
|
|
- groups
|
|
loop_control:
|
|
loop_var: folder
|
|
when: OPENLDAP_PROVISION_GROUPS | bool
|
|
|
|
- meta: flush_handlers
|
|
|
|
- name: "Add Objects to all users"
|
|
include_tasks: 04_update.yml
|
|
when: OPENLDAP_PROVISION_UPDATE | bool |