mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 13:17:07 +00:00
kevinveenbirkenbachandClaude Opus 5
996ddafd1e
Loopback identity has three spellings a client may send, and six places wrote their own list of them. Each list carried two forms and omitted the third, so the exemption or allowlist it built stopped at whichever form the client actually used: no_proxy=localhost,127.0.0.1 is how an S3 write went through a SOCKS proxy while appearing to exempt loopback. NETWORK_LOOPBACK_HOSTS is now the list, beside the loopback CIDR that was already there, with the three forms also named individually for the consumer that wants only the literals. Migrated: NETWORK_TRUSTED_PROXY_CIDRS, LITELLM_LOOPBACK_HOSTS, the no_proxy of web-app-espocrm and web-app-pixelfed, the ALLOWED_HOSTS of web-app-pretix and web-app-bookwyrm, and the lab playbook's lab_no_proxy. Rendered deltas: lab_no_proxy keeps its exact set, nothing dropped or added, only the order no_proxy ignores. LITELLM_LOOPBACK_HOSTS | first stays 127.0.0.1, so LITELLM_BASE_LOOPBACK_URL is unchanged. The other four gain ::1, which widens an exemption or an allowlist and therefore cannot block a host that worked before; for the two Django allowlists a bare ::1 may be inert rather than effective, since Django matches a bracketed IPv6 Host, but an entry that never matches costs nothing. The lint governs assignments whose key names a proxy exemption or a host allowlist, and it strips a trailing comment first: DOCKER_REACH_HOST names localhost only in its comment, svc-dns-unbound passes a resolver to drill, and flowise's HTTP_DENY_LIST is a blocklist of CIDRs. None of those is a loopback host list. The form patterns are anchored because 127.0.0.11 is the docker resolver and infinito.localhost is a domain. Its second rule keeps the list referencing all three forms, so no one can narrow every consumer at once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Compose Configuration 🧩
This directory holds the static configuration assets consumed by the top-level compose.yml of the local development and CI testing stack.
Scope 📋
- The directory MUST contain only files that are bind-mounted into a
service defined in
compose.yml. - The directory MUST NOT host application configuration that belongs to
an Ansible role. Per-role compose payloads live under
roles/<role>/templates/. - The directory MUST NOT host workflow scripts, test fixtures, or
build helpers. Those belong under
scripts/ortests/.
Layout 🗂️
Each compose service that needs static configuration owns a
sub-directory whose name matches the service. New service-specific
config MUST go into the matching sub-directory rather than at the
compose/ root.
For the rules that govern compose.yml itself (env-variable contract,
profile gating, resource caps), see
compose.yml.md.