0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-11 13:17:07 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 9763cd8a4a fix(web-app-friendica): patch upstream ldapauth autocreate + variant-aware playwright

Root cause: upstream friendica-addons/ldapauth's `ldap_createaccount`
returns the raw `User::create()` result (`['user' => UserRow, 'password' => '']`),
but the `authenticate` hook only sets `authenticated = 1` when
`$user['uid']` is non-empty — never true for the autocreate path. First-
login LDAP users (e.g. biber) were inserted into `friendica.user` but
the session was never started, so /network kept serving the login form.

Encoded as an idempotent in-container patch task in `tasks/02_ldap.yml`
+ `files/patch_ldapauth_autocreate.sh` (reports PATCHED on first run,
ALREADY on subsequent runs). Runs whenever LDAP is wired, gated by
FRIENDICA_LDAP_ENABLED.

Other changes in the same stack:
- meta/services.yml: drop keycloakpassword addon (oauth2-proxy in front
  owns SSO); ldap.enabled now follows svc-db-openldap group presence so
  the variant matrix can disable it without a static override.
- tasks/01_core.yml + tasks/06_user_bootstrap.yml: pre-create the
  administrator only in LDAP-disabled variants — when LDAP is wired,
  ldapauth materialises the row on first admin login.
- files/playwright.spec.js: variant-aware spec replacing the parked
  test.skip cases. Three tests now run: guest flow (always), admin
  native login (picks double-login vs direct based on
  OAUTH2_SERVICE_ENABLED), biber + admin side-by-side in isolated
  contexts. PERSONA_* still blocked — friendica has no header-trusted
  autocreate path.
- templates/playwright.env.j2: expose BIBER_* + service-gate flags.
- inventories/development/default.yml: biber email aligned with the
  oauth2-proxy `email_domains = infinito.example` filter so biber's
  Keycloak login isn't 403'd at the proxy.
- TODO.md: SAML migration outlined as the long-term replacement for
  the double-login (currently second hop silently bypasses Keycloak 2FA).

Drive-by: trim double-space before `# nocheck` in
roles/sys-aur/meta/services.yml.

Verified on VARIANT=0 (oauth2 + ldap + oidc all enabled): three
playwright tests green, failed=0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-16 18:39:52 +02:00

defaults

…

README.md

System AUR Helper

Description

This role ensures that the AUR helper yay is installed on the system. It installs yay via pacman and creates a dedicated aur_builder user to facilitate building AUR packages.

Overview

The role performs the following tasks:

Installs the AUR helper yay using pacman.
Creates an aur_builder user with a home directory and adds the user to the wheel group.
Grants the aur_builder user passwordless sudo rights for running pacman.

Purpose

The primary purpose of this role is to streamline AUR package management on Arch Linux systems by ensuring that the required AUR helper is installed and properly configured.

Features

Yay Installation: Installs the AUR helper yay on Arch Linux.
User Creation: Creates a dedicated aur_builder user.
Sudo Configuration: Grants passwordless sudo rights to aur_builder for pacman.

Further Resources

ansible-aur

Credits

Developed and maintained by Kevin Veen-Birkenbach. Learn more at veen.world. Part of the Infinito.Nexus Project. Licensed under the Infinito.Nexus Community License (Non-Commercial).