services.tor.enabled is Jinja in 99 of the 105 roles that declare it. A lookup('tls') or lookup('domains') inside a meta/*.yml value runs while the applications render is in flight, the re-entry guard hands it the unrendered tree, and _as_bool read the flag's own source text as False. The onion injection then did nothing for any app and the clearnet domain was returned.
fa3797540a already described this and quarantined it: the render state joined the domains cache key so the poisoned map answers no later read. The value stayed wrong, which is enough until a call site bakes it into applications. roles/web-svc-asset/meta/services.yml:15 is the only one in the repo that does, and in run 34922994823 it froze https://file.infinito.test/assets into the payload while every vhost of that round was published under the node onion. web-app-dashboard then waited 60 times on a host openresty answers with ssl_reject_handshake, and the deploy died on TLSV1_UNRECOGNIZED_NAME.
_resolved_flag renders enabled, exclusive and primary and raises when template text survives, the shape plugins/lookup/proxy_pass.py already uses. plugins/lookup/config.py and plugins/lookup/email.py render before coercing for the same reason; this module was the one that did not.
Measured across the whole map: 44 of 12819 leaves change, none added, none removed, 17 roles. 42 are clearnet to onion. The two others are repairs as well: keycloak's csp frame-ancestors moves from https to http, which is what an onion node serves, and the nextcloud sociallogin provider name stops being a hostname and becomes the bounded name that test_sociallogin_provider_name.py documents.
The new tests drive the same function with Jinja instead of the literal booleans the existing ones pass, which is why those never saw this. Three of the four fail without the fix.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Cache Helpers 💾
This package contains the in-process cache layers Infinito.Nexus uses to keep CLI tools, lookup plugins, and Ansible filters fast without re-reading or re-merging the same data multiple times per Python process.
Modules 🧭
| Module | Caches |
|---|---|
| yaml.py | A single YAML file's parsed root, keyed by absolute path. Every other module routes its YAML reads through here so each file is parsed at most once per process. |
| files.py | The project tree's full path list (one walk per process) and per-file UTF-8 contents (read_text). Used by lint/integration tests and CLI tools that scan the repo. |
| base.py | Cross-cutting helpers: filesystem constants (PROJECT_ROOT, ROLES_DIR, DEFAULT_TOKENS_FILE), _deep_merge, cache-key + content-fingerprint signatures, the cross-domain re-entry guard, and the templar-render machinery. The only ansible-coupled symbol is _render_with_templar, which lazy-imports its dependency. |
| applications.py | Per-app variants + defaults + get_merged_applications. Strictly ansible-free at import time so the GitHub Actions runner-host CLI path (cli.administration.deploy.development.init → plan_dev_inventory_matrix → get_variants) keeps working without ansible installed. |
| carrier.py | The play-scoped carrier of the rendered applications payload: the fact name _INFINITO_APPLICATIONS_RENDERED, merged_applications_cache_key, and the reader get_merged_applications consults before it renders. |
| users/ | User definitions, token store hydration, alias materialization, get_user_defaults, get_merged_users (package; users/placeholders.py substitutes DOMAIN_PRIMARY / ORGANIZATION / SOFTWARE_NAME ahead of the templar render pass). |
| domains.py | Canonical-domains map derived from the merged applications view: get_merged_domains. A read issued while the applications render is in progress (the re-entry guard is set) sees the unrendered view, so it is cached under its own key and never answers a later read. |
__init__.py |
Owns the package-level _reset_cache_for_tests() orchestrator that clears every cache plus the shared fingerprint memo in one call. |
When To Use Which 🎯
- Use
utils.cache.yaml.load_yaml(path)(orload_yaml_any(path)when the YAML root is a list or scalar) whenever a CLI tool, filter, or library reads individual YAML files where the same path MAY be touched repeatedly within a single invocation. - Import the cached getters directly from the domain module that owns them:
utils.cache.applicationsforget_application_defaults/get_variants/get_merged_applications,utils.cache.usersforget_user_defaults/get_merged_users, andutils.cache.domainsforget_merged_domains. The package's_reset_cache_for_testsis exposed atfrom utils.cache import _reset_cache_for_tests.
The layers are orthogonal: yaml.py caches "this file's parsed root", the applications/users/domains modules cache "this aggregated, rendered payload". They do not invalidate each other and MAY both be active at the same time.
Lifetime 🕒
Both layers are process-wide in-process caches. They intentionally do NOT track on-disk file mtimes; CLI tools are short-lived and the assumption "the on-disk file does not change while my process runs" holds. The single exception is utils.cache.yaml.dump_yaml, which writes through and evicts the cached entry for the path it just wrote so a tool that edits a file mid-run sees the new content on the next read.
Inside a play the process boundary is the task: Ansible forks a fresh worker per task, so _MERGED_APPLICATIONS_CACHE starts empty in every worker. get_merged_applications therefore also accepts the play-scoped carrier fact _INFINITO_APPLICATIONS_RENDERED (payload plus cache key, parked once by the constructor stage) and serves it when the key matches. See applications.md for the contract.
Test-Only Helpers 🧪
Each module owns a private _reset() that clears its own cache dicts. The package-level utils.cache._reset_cache_for_tests() orchestrates all six (base, applications, users, domains, yaml, files) plus the shared fingerprint memo. Unit tests that exercise the cached paths MUST call it in setUp to guarantee clean state across test cases.
Design Guidelines 📐
- You MUST NOT introduce a third parallel cache for the same concern. If you need to cache a derived shape, add a getter to the appropriate domain module (
applications,users, ordomains) that builds on the existing primitives. - You SHOULD prefer the explicit cached getter over re-implementing the same memoisation in a calling module.
- You MUST NOT mutate values returned by
utils.cache.yaml.load_yaml. The same dict instance is returned to every caller; callers that need to mutate MUSTcopy.deepcopy()the result first. Each domain getter documents whether it returns a fresh deep copy or the cached instance; respect that contract. - You MUST keep dependencies inside this package minimal. Cache primitives MUST remain importable from filter plugins, lookup plugins, and CLI tools without dragging in heavy dependencies. Specifically:
applications.pyMUST stay ansible-free at import time. See CI runs 24934007615 / 24935979190 for the regression that motivated the split. Tests intests/unit/python/utils/cache/test_data.py::TestImportableWithoutAnsiblepin both the import-time and call-time invariants.
Example Imports ✍️
from utils.cache.yaml import load_yaml, load_yaml_any
from utils.cache.applications import (
get_application_defaults,
get_merged_applications,
get_variants,
)
from utils.cache.users import get_merged_users, get_user_defaults
from utils.cache.domains import get_merged_domains
# Tests
from utils.cache import _reset_cache_for_tests