mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-30 08:06:47 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
---
|
|
- name: "Load meta"
|
|
include_tasks: 01_meta.yml
|
|
when: not KEYCLOAK_LOAD_DEPENDENCIES | bool
|
|
|
|
- name: "Load cleanup routine for '{{ application_id }}'"
|
|
include_tasks: 02_cleanup.yml
|
|
when: MODE_CLEANUP | bool
|
|
|
|
- name: "Load init routine for '{{ application_id }}'"
|
|
include_tasks: 03_init.yml
|
|
|
|
- name: "Load the depdendencies required by '{{ application_id }}'"
|
|
include_tasks: 04_dependencies.yml
|
|
when: KEYCLOAK_LOAD_DEPENDENCIES | bool
|
|
|
|
- name: "Load Login routines for '{{ application_id }}'"
|
|
include_tasks: 05_login.yml
|
|
|
|
- name: "Load Client Update routines for '{{ application_id }}'"
|
|
include_tasks: update/01_client.yml
|
|
|
|
- name: "Load Mail Update routines for '{{ application_id }} - {{ KEYCLOAK_REALM }}'"
|
|
include_tasks: update/02_mail_realm.yml
|
|
|
|
- name: "Load Mail Update routines for '{{ application_id }} - master'"
|
|
include_tasks: update/03_mail_master.yml
|
|
|
|
- name: "Load RBAC Update routines for '{{ application_id }}'"
|
|
include_tasks: update/04_rbac_client_scope.yml
|
|
|
|
- name: "Load LDAP Update routines for '{{ application_id }}'"
|
|
include_tasks: update/05_ldap.yml
|
|
when: KEYCLOAK_LDAP_ENABLED | bool
|
|
|
|
- name: "Load reCAPTCHA Update routines for '{{ application_id }}'"
|
|
include_tasks: update/06_recaptcha.yml
|
|
when: KEYCLOAK_RECAPTCHA_ENABLED | bool
|
|
|