mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5.5
e203d6f7ab
lookup('service_memory_mb', application_id, service_name, share) returns
a share of a service's mem_limit in whole MiB. It resolves the limit the
way sys-svc-container resolves the container's own: the named service,
then the role's primary entity, then RESOURCE_MEM_LIMIT.
It replaces the three filters of memory_filters, each with its own unit
parser and its own idea of the limit: Redis maxmemory at 0.8 of the
limit, and the Confluence and Jira heap at 0.7 and 0.35.
The central Redis (409 MiB), Confluence (5734/2867) and Jira (4300/2150)
keep their values. A Redis sidecar without a mem_limit of its own does
not: the filter fell back to a fixed 256m, which gave 204 MiB, while the
lookup takes the limit that container really runs with, the primary
entity's. That moves 25 roles to between 409 and 3276 MiB.
The heap clamps of the old filters are gone: the 1024 MiB floor, limit
minus 1024, the 12288 cap and Xms bounded by mem_reservation.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Custom Filter Plugins for Infinito.Nexus
This directory contains custom Ansible filter plugins used within the Infinito.Nexus project.
When to Use a Filter Plugin
- Transform values: Use filters to transform, extract, reformat, or compute values from existing variables or facts.
- Inline data manipulation: Filters are designed for inline use in Jinja2 expressions (in templates, tasks, vars, etc.).
- No external lookups: Filters only operate on data you explicitly pass to them and cannot access external files, the Ansible inventory, or runtime context.
Examples
{{ role_name | get_entity_name }}
{{ my_list | unique }}
{{ user_email | regex_replace('^(.+)@.*$', '\\1') }}
When not to Use a Filter Plugin
- If you need to load data from an external source (e.g., file, environment, API), use a lookup plugin instead.
- If your logic requires access to inventory, facts, or host-level information that is not passed as a parameter.
Schema 🗺️
How csp_filters.py assembles one application's Content-Security-Policy. Scope is the header build, not the other filters in this directory.
flowchart TD
decl["meta/csp.yml<br/>whitelist, flags, hashes"]
svc["meta/services.yml<br/>services.logout.enabled"]
flags["csp_filters.py:136<br/>get_csp_flags"]
grant["csp_filters.py:354<br/>logout grant"]
wl["csp_filters.py:123<br/>get_csp_whitelist"]
inj["sys-front-inj-dashboard,<br/>-javascript, -matomo, -logout<br/>add_csp_hash"]
gate["csp_filters.py:365<br/>hash gate"]
build["csp_filters.py:203<br/>build_csp_header"]
header["set $csp<br/>nginx vhost"]
decl -->|"1. flags read by"| flags
flags -->|"2. tokens"| build
svc -->|"3. read by"| grant
grant -->|"4. adds 'unsafe-inline'<br/>to script-src-elem and -attr"| build
decl -->|"5. whitelist read by"| wl
wl -->|"6. tokens"| build
inj -->|"7. snippets"| gate
gate -->|"8. hashes, only when<br/>'unsafe-inline' is absent"| build
build -->|"9. joined string"| header
grant -.->|"TRIP-WIRE: the token it adds<br/>closes the gate below, so every<br/>registered hash is discarded"| gate
svc -.->|"TRIP-WIRE: the flag derives from<br/>group_names, so the script policy<br/>follows the round, not the app"| grant
grant -.->|"TRIP-WIRE: absent from the<br/>smart-defaults docstring, which<br/>names logout only for frame-ancestors"| build
Styles carry 'unsafe-inline' by default; scripts do not. The logout grant is the only path that puts it into a script directive.