0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 20:26:33 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 ff734fe728 feat(licensing): declare the deployed software's licence per role

The project licence governs this repository's code and says nothing about the application a role installs, which is where a restriction on commercial use usually sits: a deployment cleared to use Infinito.Nexus commercially is still barred from NLLB-200's CC BY-NC weights.

Each invokable role names its licence in meta/<role>/license.yml with the url it was read from. The rights of a named licence live once in meta/licenses.yml, fifteen fields following the taxonomy choosealicense publishes. AND folds to the strictest combination, OR keeps the most favourable whole licence, and the seven contexts are derived from the rights rather than declared, so a heading cannot contradict the matrix under it.

The generated page renders one matrix per context, a lint refuses a role that declares nothing, and a Playwright spec asserts the page against the deployed docs. 21 of 22 deprecated SPDX ids were resolved against the upstream text; EPSON's remains unread because its AUR page blocks automated access.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-20 23:35:00 +02:00

files

refactor(design): compose the per-app sheet and script from one SPOT

2026-10-18 22:36:32 +02:00

README.md

OpenProject

Description

Transform your project management with OpenProject, a vibrant and collaborative tool that brings clarity and energy to your planning, tracking, and team communication. Experience streamlined workflows and an innovative platform that propels your projects forward.

Overview

Designed for simplicity, this role automates everything needed to run OpenProject in a containerized environment. It configures essential services such as the application itself, a PostgreSQL database, reverse proxy, and optional LDAP integration for identity management.

Purpose

The purpose of this role is to reduce the complexity of setting up OpenProject with modern production-ready defaults. By combining Docker Compose and Ansible automation, it enables a hands-off setup for both small teams and larger internal infrastructures.

Features

Work Package Management: Create, assign, track, and prioritize tasks and issues with customizable workflows that keep your project organized and on schedule.
Gantt Charts & Timelines: Visualize project schedules and dependencies using intuitive Gantt charts and timeline views, enabling effective planning and resource allocation.
Agile Boards & Scrum/Kanban Integration: Manage agile projects using Scrum or Kanban boards, track progress through sprints, and maintain a clear overview of work in progress.
Time Tracking & Cost Management: Record time spent on tasks to monitor productivity and generate detailed cost reports to manage budgets effectively.
Collaboration & Document Management: Facilitate team collaboration with built-in discussion forums, document sharing, and version control, ensuring all project documentation remains up to date.
Robust Reporting & Dashboards: Gain insights through comprehensive reporting features and customizable dashboards that help monitor project performance and key metrics.
Custom Plugins & Extensibility: Extend functionality with a wide variety of plugins and integrations, or create your own to tailor OpenProject to your unique workflow.
Role-Based Access Control & Security: Manage user permissions precisely to ensure that sensitive information and critical functions remain secure.

Addons

OpenProject's cross-role integrations are declared in meta/addons/, one file per addon:

Addon	Mechanism	Default state	Bridges
`gitlab_integration`	`module`	enabled whenever the `gitlab` service is present (`web-app-gitlab` co-deployed)	`gitlab` → `web-app-gitlab`
`storages`	`module`	enabled whenever the `nextcloud` service is present (`web-app-nextcloud` co-deployed)	`nextcloud` → `web-app-nextcloud`
`openid_connect`	`module`	disabled	`sso` → `web-app-keycloak`

All three modules ship with the OpenProject image, and tasks/05_addons.yml runs the hook of every addon whose gate resolves true.

gitlab_integration is provisioned here: files/ruby/addons/gitlab/ensure_gitlab_webhook.rb creates the bot account declared in meta/users.yml, issues its API token, and writes gitlab_user_id plus the webhook secret into the plugin setting. The token is published to the token store; the webhook on the partner GitLab is not created by this role and the hook prints the URL to register it against.

storages is provisioned entirely from the other side: web-app-nextcloud container-execs into this role's web container and creates the Storages::NextcloudStorage, its OAuth application and the matching Nextcloud client. The deploy order places this role before web-app-nextcloud, so nothing of that exists while this role runs and its hook stays empty.

openid_connect is gated behind OpenProject's Enterprise tier, so this deployment reaches Keycloak through the oauth2-proxy front door declared by the sso service instead, and the addon stays off.

Each addon's spec lives under files/playwright/addons/.

Developer Notes

To inspect and modify live settings inside the container, open a shell and use the Rails console for full LDAP and SMTP configuration.

Further Resources

Persona contract opt-outs

The administrator persona is not blocked: tasks/04_admin.yml seeds a native OpenProject account whose password is the Keycloak administrator secret, so the journey runs in every variant. The biber persona is blocked only in the sso: false variants — OpenProject is seeded with the administrator alone, and biber is auto-provisioned exclusively through the oauth2-proxy trusted-header bridge onto the LDAP auth source, which those variants remove. Both flags are declared explicitly in templates/playwright.env.j2.