mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5.5
86cefeff26
web-svc-css becomes web-svc-design and owns the configuration that lived in group_vars/all/13_design.yml. Consumers switch their css service key to design, and sys-front-inj-css becomes sys-front-inj-design. javascript stays an independent key; a role's optional design.js.j2 is injected together with the design and CSP-hashed like the functional script. An in-repo OKLCH lookup replaces colorscheme_generator. From design.colors.base alone it derives surfaces, text, borders, the primary and status fills with their on-colors, hover and active states and a dedicated dark palette; a unit test proves WCAG AA, and AAA for body text, across six base colors in both modes. Semantic --design-* tokens replace --color-NN-SS in every role stylesheet. The shared element styles sit in the cascade layer infinito-design, so an app's own design system always wins and takes the palette through a variable mapping in its role stylesheet or through its own theming mechanism. design.logo and design.title resolve globally from web-svc-design or per role from its design entry, and false or 0 disables the replacement. The design_assets action renders the logo lockup per slot as SVG, PNG and ICO, and the legacy title keys move into the design entries. Three roles carry the design end to end. The dashboard takes logo, favicon and title from the generator and replaces the hard-coded port-ui colors. Gitea maps its theme variables onto the tokens and mounts the generated logo and a branded start page. Nextcloud receives primary color, logo, name and slogan through occ theming and ships no stylesheet. make design-sync re-renders the static design files of a deployed app, make design-gallery captures before and after screenshots in light, dark, desktop and mobile, and make design-queue orders the roles that are due for a design pass. The i8-designer skill and docs/agents/action/design.md describe that loop. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
76 lines
2.6 KiB
YAML
76 lines
2.6 KiB
YAML
---
|
|
- name: 🔀 Merge networks definitions
|
|
ansible.builtin.set_fact:
|
|
networks: "{{ defaults_networks | combine(networks | default({}, true), recursive=True) }}"
|
|
|
|
- name: 🧊 Render the applications SPOT once for the merge block
|
|
applications_carrier: {}
|
|
|
|
- name: "✅ Sanity check: all group_names must exist in applications"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- group_name in lookup('applications')
|
|
fail_msg: "Group '{{ group_name }}' has no entry in 'applications'"
|
|
success_msg: "Group '{{ group_name }}' is defined in 'applications'"
|
|
loop: "{{ group_names }}"
|
|
loop_control:
|
|
loop_var: group_name
|
|
when: MODE_ASSERT | bool
|
|
|
|
- name: 🔀 Merge current play applications
|
|
ansible.builtin.set_fact:
|
|
CURRENT_PLAY_APPLICATIONS: "{{ lookup('applications_current_play') }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: 🔀 Merge current play domain definitions
|
|
ansible.builtin.set_fact:
|
|
CURRENT_PLAY_DOMAINS: >-
|
|
{{
|
|
lookup('applications')
|
|
| canonical_domains_map(
|
|
DOMAIN_PRIMARY,
|
|
recursive=True,
|
|
roles_base_dir=(lookup('path_absolute', 'roles')),
|
|
seed=(CURRENT_PLAY_APPLICATIONS | dict2items | map(attribute='key') | list)
|
|
)
|
|
}}
|
|
|
|
- name: 🔧 Set CURRENT_PLAY_REDIRECT_DOMAINS
|
|
ansible.builtin.set_fact:
|
|
CURRENT_PLAY_REDIRECT_DOMAINS: "{{ lookup('current_play_redirect_domains') }}"
|
|
|
|
- name: 🔧 Set current play all domains incl. www redirect if enabled
|
|
ansible.builtin.set_fact:
|
|
CURRENT_PLAY_DOMAINS_ALL: >-
|
|
{{
|
|
(
|
|
CURRENT_PLAY_DOMAINS
|
|
| combine(
|
|
CURRENT_PLAY_REDIRECT_DOMAINS | default([])
|
|
| items2dict(key_name='source', value_name='source'),
|
|
recursive=True
|
|
)
|
|
)
|
|
| generate_all_domains(WWW_REDIRECT_ENABLED | bool)
|
|
}}
|
|
|
|
- name: ✅ Assert OIDC resolves lazily (inventory overrides live in OIDC_OVERRIDE)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- OIDC.CLIENT.DISCOVERY_DOCUMENT is defined
|
|
fail_msg: >-
|
|
OIDC does not resolve to the full defaults tree. An inventory most
|
|
likely still defines 'OIDC:' at host level, shadowing the lazy
|
|
group_var — migrate that block to 'OIDC_OVERRIDE:' so the issuer can
|
|
family-align to each consuming role.
|
|
quiet: true
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: 🔀 Merge service_provider configuration
|
|
ansible.builtin.set_fact:
|
|
service_provider: "{{ defaults_service_provider | combine(service_provider | default({}, true), recursive=True) }}"
|
|
|
|
- name: 🧊 Drop the merge-block carrier so later stages re-render
|
|
applications_carrier:
|
|
clear: true
|