kevinveenbirkenbachandClaude Opus 5
53ddbb00c2
On an onion deployment the OIDC endpoints handed to an application are public onion authorities. That is right for the browser, which reaches them through Tor, and unroutable for the calls the application makes itself: the code-to-token exchange, JWKS and userinfo leave the container directly. lookup(container_extra_hosts) pins the provider to an address the container can reach, sending those calls over the local network to the proxy that already serves the vhost. Around fifty role templates carry that pin. Six did not. web-app-jellyfin reached a release with the gap and failed in CI the first time a round put its SSO variant on an onion row. confluence, jira, openbao, semaphore, xwiki and opentalk are the same shape; none of them is red today, so the gap there is derived from the class rather than measured. For opentalk the pin goes on the controller, because controller.toml.j2:16 sets authority to the issuer and that is where discovery is loaded. The new rule sso-backchannel-pin closes the class rather than the six instances: a role that reads OIDC.CLIENT.ISSUER_URL must emit the lookup from one of its templates. Two kinds are out of scope, both for a stated reason. A role declaring sso.flavor: oauth2 never calls the provider itself, because the reverse proxy performs the exchange. A role naming the issuer only in a Playwright env template hands it to the test harness rather than to a container; without that second exemption the rule named 13 roles, of which 8 were test-only. A role that genuinely makes no server-side call opts out with a marker naming the reason. The lookup renders an empty block where there is no onion to pin, so none of the six changes anything on clearnet. 76 checks and 276 subtests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Confluence
End of life. Infinito.Nexus neither maintains nor tests this role, and the default
INFINITO_LIFECYCLESenvelope keeps it out of every CI round. Deploy it at your own risk and take support from Atlassian Confluence.
Description
Confluence is Atlassian’s enterprise wiki and collaboration platform. This role deploys Confluence via Docker Compose, wires it to PostgreSQL, and integrates proxy awareness, optional OIDC SSO, health checks, and production-friendly defaults for Infinito.Nexus.
Overview
The role builds a minimal custom image on top of the official Confluence image, prepares persistent volumes, and exposes the app behind your reverse proxy. Configuration is driven by variables (image, version, volumes, domains, OIDC). JVM heap sizing follows the container's mem_limit: JVM_MAXIMUM_MEMORY is 70 % of it and JVM_MINIMUM_MEMORY 35 %.
Features
- Fully Dockerized: Compose stack with a dedicated data volume (
confluence_data) and a slim overlay image for future add-ons. - Reverse-Proxy Ready: Sets
ATL_PROXY_NAME/PORT/SCHEME/SECUREso Confluence generates correct external URLs behind HTTPS. - OIDC SSO (Optional): Pre-templated vars for issuer, client, scopes, JWKS; compatible with Atlassian DC SSO/OIDC marketplace apps.
- Central Database: PostgreSQL integration (local or central DB) with bootstrap credentials from role vars.
- JVM Auto-Tuning:
JVM_MINIMUM_MEMORY/JVM_MAXIMUM_MEMORYare 35 % and 70 % of the servicemem_limit. - Health Checks: Curl-based container healthcheck for early failure detection.
- CSP & Canonical Domains: Hooks into platform CSP/SSL/domain management to keep policies strict and URLs stable.
- Backup Friendly: Data isolated under
{{ CONFLUENCE_HOME }}.
Further Resources
- Product page: Atlassian Confluence
- Docker Hub (official image): atlassian/confluence
Persona contract opt-outs
meta/services.yml pins sso.enabled to false and tasks/main.yml provisions no Confluence account — account creation belongs to the licensed first-run setup wizard. Neither the biber nor the administrator persona has credentials to sign in with, so templates/playwright.env.j2 declares PERSONA_BIBER_BLOCKED=true and PERSONA_ADMINISTRATOR_BLOCKED=true. The guest persona and the baseline reachability assertions run unconditionally.