kevinveenbirkenbachandClaude Opus 5
ed6e7a15fa
services.tor.enabled pinned to a literal false on a role was the only incapacity the rule knew, and it is role-wide. web-app-opencloud serves the onion with Keycloak and cannot serve it without, because the built-in IDP it falls back to refuses a non-https issuer, and no service pin expresses a distinction that holds per variant.
A variant now marks its own tor pin '# nocheck: variant-tor-off <why>', the placement test_variant_tor_collateral already uses. The two helpers that locate that line, variant_spans and pin_line, move into the package beside role_dirs and load_role_meta rather than being copied a fourth time; the sibling reads them from there.
OpenCloud's SSO-less variants take the escape. libregraph/lico rejects a non-https iss unconditionally in bootstrap/bootstrap.go, IDP_INSECURE only relaxes outbound TLS, and IDP_ISS cannot point anywhere valid because an onion-only deployment has no https address, so those rounds crash-looped and answered 502. tor_capable reads the literal false and stops scheduling them behind the onion.
The variants-coverage marker on the role's tor service goes with it: it existed because the false polarity had nowhere to live, and test_coverage passes without it now. This supersedes the workaround 24d0308995 applied to this role, which pinned the onion back on for want of an escape, and restores what the file's own comment claimed throughout: variant 0 carries the onion.
Negative control: with the marker removed the rule reports both variants, with it eleven tests pass, covering the five tor lints, coverage, bond baseline and both budget checks.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
OpenCloud
Description
OpenCloud is a sovereign self-hosted file sync, share, and collaboration platform maintained by the Heinlein Group. It is a fork of the OpenCloud Infinite Scale codebase and is published as the opencloudeu/opencloud container image.
Overview
This role deploys OpenCloud using Docker Compose in single-binary mode and exposes it under open.cloud.{{ DOMAIN_PRIMARY }} through the central reverse proxy. It wires the deployment to the shared Keycloak realm via OIDC, sources users and groups from the central svc-db-openldap directory, and runs side by side with web-app-nextcloud so both file platforms can coexist on the same host. For identity wiring details see IAM.md and LDAP.md.
Features
- Sovereign File Sync and Share: Self-host file sync, shares, and collaborative spaces under your own domain.
- Single Sign-On: Users authenticate once via Keycloak and reuse the session across the platform.
- Central User Directory: Users and groups are read from a shared OpenLDAP backend, so accounts stay consistent across apps.
- Auto-Provisioning: New OIDC users are created on first login with username equal to the LDAP
uid, and group claims drive role assignment. - OpenTalk Cross-Launch: Start a video meeting in OpenTalk from a file context without re-authenticating when
web-app-opentalkis deployed alongside. - Coexists with Nextcloud: Runs in parallel with
web-app-nextcloudon a distinct canonical hostname.
Developer Notes
See IAM.md for OIDC discovery and verification commands, and LDAP.md for the directory binding and schema mapping. Open follow-up items are tracked in TODO.md.
Further Resources
- opencloud.eu
- OpenCloud documentation
- opencloudeu/opencloud on Docker Hub
- Corporate design review: before/after screenshots in light, dark, desktop and mobile
Persona contract opt-outs
The shared biber and administrator persona helpers are declared blocked in templates/playwright.env.j2. OpenCloud Web answers Playwright's headless Chromium user agent with a "browser not supported" splash unless forceAllowOldBrowser is seeded into localStorage before the first navigation, and its OIDC callback runs through OpenCloud's own /oidc-callback → /web-oidc-callback routes instead of the oauth2-proxy pattern the shared helper detects. Both personas' Keycloak round trip is covered by files/playwright/test-sso-login.js, which does that priming in files/playwright/_shared.js.