kevinveenbirkenbachandClaude Opus 5 b6e0ccb0b1 fix(sso): render DOMAIN_PRIMARY before it scopes an oauth2-proxy redirect ...

The lookup read DOMAIN_PRIMARY straight from the templar's available
variables, which hold it unrendered. The generated inventory defines it as
"{{ lookup('env', 'INFINITO_DOMAIN') }}", so whitelist_domains was written as
the literal ".{{ lookup(...) }}" and matched no host at all: oauth2-proxy
answered every absolute redirect with "domain / port not in whitelist", which
left pihole's sign_out unable to reach the Keycloak end-session endpoint.

utils/cache/domains.py already renders the raw value through
render_ansible_strict; do the same here, guarded on the value carrying a Jinja
marker so a literal domain is untouched. render_ansible_strict also refuses
output that still holds "{{", so an unresolvable primary domain now fails loud
instead of becoming a junk scope.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-07 17:26:48 +02:00

..

action

refactor(dsk): rename the desktop tier and give its agents a category

2026-09-24 22:15:41 +02:00

filter

Merge branch 'main' into feature/store-i18n

2026-10-07 00:57:07 +02:00

lookup

fix(sso): render DOMAIN_PRIMARY before it scopes an oauth2-proxy redirect

2026-10-07 17:26:48 +02:00

__init__.py

…