mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
a05071fe78
The entity name keys a role's instance directory, its compose project and its container name, and was derived only by stripping the longest matching category prefix. Two roles under different categories whose names share a suffix therefore collapse onto one entity and overwrite each other's rendered stack, which no provides: can repair. A literal entity_name in vars/main.yml now wins over the derivation. web-app-seaweedfs-console takes its shorter name back and declares the entity seaweedfs-console, which frees the seaweedfs key in its own services map for the engine consumer and removes the provides:, covers: and alias entries that stood in for it. A new lint pairs the declaration with the primary key it has to match, because a drift between them would drop the role from the provider set in silence. Compared across all 288 roles, exactly one entity changes, and it restores what main already keeps on disk, so no instance directory moves. The function and the filter lose their get_ prefix. Two lints read that prefix as the discriminator between the variable and the filter that fills it; both discriminate on the pipe now. Ansible's templar resolves a filter and a same-named variable independently, verified against ansible-core 2.20.2. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.8 KiB
2.8 KiB
Custom Filter Plugins for Infinito.Nexus
This directory contains custom Ansible filter plugins used within the Infinito.Nexus project.
When to Use a Filter Plugin
- Transform values: Use filters to transform, extract, reformat, or compute values from existing variables or facts.
- Inline data manipulation: Filters are designed for inline use in Jinja2 expressions (in templates, tasks, vars, etc.).
- No external lookups: Filters only operate on data you explicitly pass to them and cannot access external files, the Ansible inventory, or runtime context.
Examples
{{ role_name | entity_name }}
{{ my_list | unique }}
{{ user_email | regex_replace('^(.+)@.*$', '\\1') }}
When not to Use a Filter Plugin
- If you need to load data from an external source (e.g., file, environment, API), use a lookup plugin instead.
- If your logic requires access to inventory, facts, or host-level information that is not passed as a parameter.
Schema 🗺️
How csp_filters.py assembles one application's Content-Security-Policy. Scope is the header build, not the other filters in this directory.
flowchart TD
decl["meta/csp.yml<br/>whitelist, flags, hashes"]
svc["meta/services.yml<br/>services.logout.enabled"]
flags["csp_filters.py:136<br/>get_csp_flags"]
grant["csp_filters.py:354<br/>logout grant"]
wl["csp_filters.py:123<br/>get_csp_whitelist"]
inj["sys-front-inj-dashboard,<br/>-javascript, -matomo, -logout<br/>add_csp_hash"]
gate["csp_filters.py:365<br/>hash gate"]
build["csp_filters.py:203<br/>build_csp_header"]
header["set $csp<br/>nginx vhost"]
decl -->|"1. flags read by"| flags
flags -->|"2. tokens"| build
svc -->|"3. read by"| grant
grant -->|"4. adds 'unsafe-inline'<br/>to script-src-elem and -attr"| build
decl -->|"5. whitelist read by"| wl
wl -->|"6. tokens"| build
inj -->|"7. snippets"| gate
gate -->|"8. hashes, only when<br/>'unsafe-inline' is absent"| build
build -->|"9. joined string"| header
grant -.->|"TRIP-WIRE: the token it adds<br/>closes the gate below, so every<br/>registered hash is discarded"| gate
svc -.->|"TRIP-WIRE: the flag derives from<br/>group_names, so the script policy<br/>follows the round, not the app"| grant
grant -.->|"TRIP-WIRE: absent from the<br/>smart-defaults docstring, which<br/>names logout only for frame-ancestors"| build
Styles carry 'unsafe-inline' by default; scripts do not. The logout grant is the only path that puts it into a script directive.