mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.7
91c57e0471
Promote akaunting, baserow, bluesky, bookwyrm, bridgy-fed, flowise, fusiondirectory, jenkins, joomla, minio, postmarks, libretranslate, xmpp from `lifecycle: alpha` to `lifecycle: beta` per requirement 013. socialhome stays alpha (operator-excluded). SSO/LDAP integration per role: - minio + jenkins + joomla + fusiondirectory: native first-party paths (MINIO_IDENTITY_OPENID/_LDAP, oic-auth + ldap + role-strategy JCasC, plg_system_keycloak, LDAP-as-storage). All V0+V1 verified. - akaunting, baserow, bookwyrm, flowise, postmarks, libretranslate: oauth2-proxy perimeter gate as universal glue path. Native in-app OIDC integrations deferred to follow-up issues #219 (Baserow), #220 (BookWyrm), #221 (Akaunting). - bluesky: variant A+ login-broker (oauth2-proxy → broker → social-app) with AES-256-GCM-encrypted PDS app-passwords cached in-process (Keycloak user-attribute storage caused LDAP federation conflicts that broke other realm-clients' OIDC logins). - xmpp: native ejabberd LDAP backend for both variants (mod_oauth2_client is contrib-only and deferred). - bridgy-fed: documented SSO/LDAP/RBAC exception (federated source- platform auth, no local user table). Project-wide bugfixes: - web-app-oauth2-proxy: propagate X-Forwarded-User / -Preferred-Username / -Email / -Groups via auth_request_set bridge (set_xauthrequest + pass_user_headers in cfg + nginx headers in following_directives.conf). Benefits all 8 oauth2-proxy consumers. - scripts/tests/deploy/local/deploy/fresh-kept-app.sh: bake `RUNTIME=dev` into the matrix-init host vars so the Playwright E2E gate fires (was silently skipped on kept-deploys). From-scratch role implementations: jenkins (JCasC + plugin pre-bake + JVM cacerts CA-trust entrypoint), fusiondirectory (LDAP-as-storage compose), xmpp (ejabberd LDAP backend ejabberd.yml). Verification: - Per-role baseline: each in-scope role passed standalone V0/V1 Playwright suites green. - Multi-app fresh-purged-apps over all 13 in-scope roles (FULL_CYCLE=true): Pass 1 sync + Pass 2 async both `failed=0`, every role's Playwright suite green. Doc 013 acceptance section reflects the divergences (oauth2-proxy glue path, in-memory bluesky cache, deferred contrib modules) with explicit follow-up issue references. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>