kevinveenbirkenbachandClaude Opus 4.8 4313fa7375 fix(sys-svc-compose): inject CA trust into swarm deploys + use compose_file_args ...

In swarm, OmniAuth/OpenSSL (decidim OIDC discovery) and Node (bluesky-broker -> PDS) could not trust Keycloak's internal self-signed CA: docker stack deploy never received compose.ca.override.yml, and the override's $$-escaped entrypoint wrapper is swarm-incompatible (stack deploy does not un-escape it). Add a --no-wrapper override mode (env + CA mount only: SSL_CERT_FILE/CURL_CA_BUNDLE/NODE_EXTRA_CA_CERTS) generated on the stack host for self-signed apps, and build the stack-config/stack-deploy --compose-file list via compose_file_args (new --compose-file flag kwarg) instead of hardcoding compose.yml -- which also stops swarm silently dropping a role's own compose.override.yml. Compose untouched: self-signed-gated, no-wrapper is swarm-only, lookup defaults to -f.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-27 00:50:53 +02:00

..

action

feat(swarm): add stack_host_copy action wrapper and migrate compose-dir copies

2026-06-20 00:44:37 +02:00

filter

refactor: single /var/lib SPOT + swarm Playwright artifact upload

2026-06-26 17:01:09 +02:00

lookup

fix(sys-svc-compose): inject CA trust into swarm deploys + use compose_file_args

2026-06-27 00:50:53 +02:00

__init__.py

…