0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 11:46:35 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 91c57e0471 feat(req-013): alpha-to-beta promotion for 13 in-scope roles

Promote akaunting, baserow, bluesky, bookwyrm, bridgy-fed, flowise,
fusiondirectory, jenkins, joomla, minio, postmarks, libretranslate, xmpp
from `lifecycle: alpha` to `lifecycle: beta` per requirement 013.
socialhome stays alpha (operator-excluded).

SSO/LDAP integration per role:
- minio + jenkins + joomla + fusiondirectory: native first-party paths
  (MINIO_IDENTITY_OPENID/_LDAP, oic-auth + ldap + role-strategy JCasC,
  plg_system_keycloak, LDAP-as-storage). All V0+V1 verified.
- akaunting, baserow, bookwyrm, flowise, postmarks, libretranslate:
  oauth2-proxy perimeter gate as universal glue path. Native in-app
  OIDC integrations deferred to follow-up issues #219 (Baserow),
  #220 (BookWyrm), #221 (Akaunting).
- bluesky: variant A+ login-broker (oauth2-proxy → broker → social-app)
  with AES-256-GCM-encrypted PDS app-passwords cached in-process
  (Keycloak user-attribute storage caused LDAP federation conflicts
  that broke other realm-clients' OIDC logins).
- xmpp: native ejabberd LDAP backend for both variants
  (mod_oauth2_client is contrib-only and deferred).
- bridgy-fed: documented SSO/LDAP/RBAC exception (federated source-
  platform auth, no local user table).

Project-wide bugfixes:
- web-app-oauth2-proxy: propagate X-Forwarded-User /
  -Preferred-Username / -Email / -Groups via auth_request_set bridge
  (set_xauthrequest + pass_user_headers in cfg + nginx headers in
  following_directives.conf). Benefits all 8 oauth2-proxy consumers.
- scripts/tests/deploy/local/deploy/fresh-kept-app.sh: bake
  `RUNTIME=dev` into the matrix-init host vars so the Playwright
  E2E gate fires (was silently skipped on kept-deploys).

From-scratch role implementations: jenkins (JCasC + plugin pre-bake +
JVM cacerts CA-trust entrypoint), fusiondirectory (LDAP-as-storage
compose), xmpp (ejabberd LDAP backend ejabberd.yml).

Verification:
- Per-role baseline: each in-scope role passed standalone V0/V1
  Playwright suites green.
- Multi-app fresh-purged-apps over all 13 in-scope roles
  (FULL_CYCLE=true): Pass 1 sync + Pass 2 async both `failed=0`,
  every role's Playwright suite green.

Doc 013 acceptance section reflects the divergences (oauth2-proxy
glue path, in-memory bluesky cache, deferred contrib modules) with
explicit follow-up issue references.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-02 12:47:01 +02:00

container

docs(tools): restructure security and framework docs, add cleanup workflow

2026-04-10 16:31:22 +02:00

docker

feat(cache): inner-build override + TTL env-var + SPOT docs

2026-04-30 01:08:41 +02:00

git

chore: adopt git-maintainer-tools as dev dependency for git ops

2026-04-25 09:38:26 +02:00

github

Fix enlarge_swap.sh starving deploys of disk space (#162 )

2026-04-20 16:54:03 +02:00

image

fix(deploy): resolve SERVICES_DISABLED service names to app IDs and verify inventory

2026-03-30 01:26:44 +02:00

install

fix(skills): mirror .agents/skills to .claude/skills instead of symlink

2026-04-18 18:32:20 +02:00

inventory

…

lint

test(suppression): unify # noqa / # nocheck marker grammar

2026-04-30 12:51:50 +02:00

README.md

Script Collection

This directory contains automation scripts used across the project.

system/ contains host and system-facing helpers.
container/ contains helpers that run inside the local container.
github/ contains GitHub workflow helper scripts.
For the canonical Make target index, see make.md.
🛠️ Organize operational helpers for development, CI, release, and maintenance
🧭 Separate responsibilities into focused subdirectories with clear scope
📚 Keep script-based workflows discoverable and easier to navigate

The scope of this folder is script organization at the repository level. Detailed responsibilities belong in the README files of the respective subdirectories.