kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 20:26:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
eda9474e37ee391430a86bd1ab8561859cd9263e
computer-playbook/default.env
T
kevinveenbirkenbachandClaude Opus 5 f2fedfc677 Merge branch 'main' into feature/store-i18n 
Fourteen real conflicts plus the 66 generated READMEs.

utils/cache/files.py and its test: both sides added a skip-dir rule, resolved
as a union so the root `build/` prune and the per-root walk key coexist.

plugins/lookup/database.py and postgres_libraries.py: main's added lookups kept,
with get_entity_name renamed to entity_name as this branch renamed it.

roles/web-app-{mailu,matrix}/meta/services.yml: main's `covers: [email]` and its
MAIL_PROVIDER-gated email entry, plus this branch's gitlab/jira/n8n/jitsi
consumers, which the merge base carried on neither side.

group_vars/all/17_resource.yml: this branch's lookup('resource', ...) refactor;
main's single added literal is already covered by _POSTGRES_MAX_LOCKS_PER_TRANSACTION.

docs/requirements/035-mcp-proxy-expansion.md: this branch moved the design into
ADR 0003, so the requirement keeps only the user story and the criteria. Main's
delta inside the moved block was two new roles, carried into the ADR audit:
web-app-stalwart as adapter_candidate, svc-net-tor-smtp as privileged_control_plane.
The no_surface total said 99 while its own subcategories summed to 112.

inventories/development/default.yml: biber keeps no explicit email. Both sides fixed
the same CI failure; this branch fixed it in _apply_account_defaults, which renders
biber@{{ DOMAIN_PRIMARY }} (utils/cache/users/__init__.py:68) — byte-identical to
the address main hardcoded, so the inventory line is a second copy of one fact.

roles/web-app-{gitlab,keycloak}/files/playwright/playwright.spec.js and
roles/web-app-gitlab/templates/playwright.env.j2: union of both import sets, with
requireDotenvValue kept over decodeDotenvQuotedValue for CANONICAL_DOMAIN because
an empty value must fail rather than match every substring.

The 66 role READMEs take this side: aceb5295ef moved Cosmos, Quick Setup and
Credits to the documentation build, and test_readme.py now rejects them in a
committed README. Main's prose edits inside them are carried over by hand (the
Mailu deprecation banner, Mailu -> Stalwart in erpnext and zammad), and the two
READMEs main added fresh are stripped of the three generated sections.
roles/web-app-sphinx/README.md stays deleted; 6eb9a59d14 merged that role into
web-app-docs. The root README's generated role table was regenerated from the
merged metadata.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-04 01:57:17 +02:00

424 lines
18 KiB
Bash
Raw Blame History

# Single source of truth for the project's static defaults.
#
# Every key here is copied verbatim into the generated `.env` by
# `make dotenv` (which delegates to `python -m cli.meta.env`), together
# with the dynamic runtime-resolved values (distro, GHA flags,
# df/meminfo-derived sizes, sha256 secrets, repository owner, ...).
#
# Override at generation time by exporting the variable before running
# `make dotenv` -- already-set env vars take precedence over the
# defaults below.
#
# Convention: every key is preceded by a single-line `# ...` comment
# that explains what the value is for. The generator preserves the
# comments when materialising `.env`.
# Git repository holding the operator's terminal aliases (an `aliases` file at repo root); developers override this with their own repo.
INFINITO_ALIAS_REPOSITORY=https://github.com/kevinveenbirkenbach/alias
# Requirements file scripts/install/ansible.sh tries first, `galaxy` or `git`; the other one stays the fallback.
INFINITO_ANSIBLE_COLLECTIONS_SOURCE=git
# Anthropic API key the development inventory feeds into API.anthropic.api_key; empty leaves the anthropic routes unpublished.
INFINITO_API_ANTHROPIC_KEY=""
# OpenAI API key the development inventory feeds into API.openai.api_key; empty leaves the openai routes unpublished.
INFINITO_API_OPENAI_KEY=""
# OpenRouter API key the development inventory feeds into API.openrouter.api_key; empty leaves openrouter/auto unpublished.
INFINITO_API_OPENROUTER_KEY=""
# Where scripts/meta/resolve/apps.sh runs the meta-CLI: host | docker.
INFINITO_APP_DISCOVERY_RUNNER=docker
# Per-app variant index map for credential generation, set per round by the swarm matrix orchestrator; empty elsewhere.
INFINITO_APP_VARIANTS=
# Ubuntu mirrors in failover order for image apt; the package-cache takes the first as primary, the second as fallback.
INFINITO_APT_UBUNTU_MIRRORS="http://de.archive.ubuntu.com/ubuntu/ http://ftp.fau.de/ubuntu/ http://ftp.halifax.rwth-aachen.de/ubuntu/ http://archive.ubuntu.com/ubuntu/"
# The CPU architecture the deploy matrix assigned one row; empty draws from INFINITO_ARCHITECTURES.
INFINITO_ARCHITECTURE=
# Space-separated subset of amd64/arm64 CI rows are spread over; empty draws from both.
INFINITO_ARCHITECTURES=
# Host interface(s) the compose stack binds published ports to.
INFINITO_BIND_IP=127.0.0.1
# Optional app-discovery exclusion filter consumed by scripts/meta/resolve/apps.sh and the GHA workflows.
INFINITO_BLACKLIST=
# `1` builds the local image; `0` skips the build and pulls the published image (CI overrides via -e INFINITO_BUILD=0).
INFINITO_BUILD=1
# `1` keeps BuildKit on (default); `0` forces the compose wrapper to use the legacy builder.
INFINITO_BUILDKIT_ENABLED=1
# External docker network carrying the shared cache stack; empty on the primary instance, which owns the stack itself.
INFINITO_CACHE_NETWORK=
# Name of the Nexus container; the bootstrap reaches it by this name.
INFINITO_CACHE_PACKAGE_CONTAINER=infinito-package-cache
# Host directory holding the package-cache frontend CA materials; derived from DIR_CACHE.
INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR=
# CA certificate file produced under INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR.
INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE=
# Host directory holding the package-cache frontend TLS certificates; derived from DIR_CACHE.
INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR=
# Init image used by the package-cache frontend cert-gen wrapper to run cert-gen.sh.
INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE=alpine:latest
# Static IPv4 address the package-cache frontend takes on the docker bridge.
INFINITO_CACHE_PACKAGE_FRONTEND_IP=172.30.0.4
# Host directory backing the Nexus 3 package-cache blobstore; derived from DIR_CACHE.
INFINITO_CACHE_PACKAGE_HOST_PATH=
# Static IPv4 address the Nexus package-cache takes on the docker bridge.
INFINITO_CACHE_PACKAGE_IP=172.30.0.5
# Content freshness window (minutes) for immutable cached artifacts (wheels, debs, rpms). 8640 = 6 days.
INFINITO_CACHE_PACKAGE_MAX_AGE_MIN=8640
# Metadata + negative-cache window (minutes) for indexes / not-found lookups. 0 = always revalidate so new versions show at once.
INFINITO_CACHE_PACKAGE_METADATA_MAX_AGE_MIN=0
# Bind-mounted .npmrc fragment for the package-cache frontend.
INFINITO_CACHE_PACKAGE_NPMRC=./compose/package-cache/npmrc
# Bind-mounted pip.conf fragment for the package-cache frontend.
INFINITO_CACHE_PACKAGE_PIP_CONF=./compose/package-cache/pip.conf
# Host port the Nexus 3 package cache binds to on BIND_IP.
INFINITO_CACHE_PACKAGE_PORT=8081
# Host directory holding the registry-cache proxy CA; derived from DIR_CACHE.
INFINITO_CACHE_REGISTRY_CA_HOST_PATH=
# Host directory backing the registry-cache image mirror; derived from DIR_CACHE.
INFINITO_CACHE_REGISTRY_HOST_PATH=
# Static IPv4 of the registry-cache; resolved via extra_hosts since coredns can't resolve the container name.
INFINITO_CACHE_REGISTRY_IP=172.30.0.6
# Bind-mounted registry-cache proxy configuration consumed by the cache container.
INFINITO_CACHE_REGISTRY_PROXY_CONF=./compose/registry-cache/proxy.conf
# True where a persistent pull-through cache stack pays off (local dev).
INFINITO_CACHE_STACK=true
# Index of the deploy chunk the discovery emits; each chunk block of call-orchestrator.yml passes its own.
INFINITO_CI_CHUNK=0
# Rows one deploy chunk holds, overriding the concurrency-times-waves derivation; 0 derives it.
INFINITO_CI_CHUNK_SIZE=0
# Runner slots a deploy chunk may assume are free; with the job timeout it sizes a chunk in cli.meta.ci.slots.
INFINITO_CI_CONCURRENCY=20
# Budget distros.sh spends before skipping the rest; stays under the 350-min step cap, which stays under the 355-min job cap.
INFINITO_CI_DISTRO_BUDGET_SECONDS=20400
# Job budget per workflow run cli.meta.ci.slots spends on the deploy chunks (GitHub matrix cap: 256).
INFINITO_CI_JOB_LIMIT=256
# Chunk job blocks call-orchestrator.yml declares; one above what the budget fills, so a short priority chunk strands no row.
INFINITO_CI_MAX_CHUNKS=4
# Regular rows a run skips before filling its chunks; a count or a selection token, 0 starts at the head of the ranking.
INFINITO_CI_OFFSET=0
# Hours a job may sit queued before GitHub cancels it; the ceiling a single chunk's waves must start within.
INFINITO_CI_QUEUE_HOURS=24
# Sweep number driving the deploy mode/tor rotation; CI passes the run number.
INFINITO_CI_SWEEP=0
# Compose service container name; generator overrides as infinito_nexus_${INFINITO_DISTRO}.
INFINITO_CONTAINER=infinito_nexus_debian
# `1` (default) keeps CA injection on in the container wrapper; `0` skips it.
INFINITO_CONTAINER_CA_ENABLED=1
# cpus cap applied to the infinito container; 0 means "unlimited".
INFINITO_CPUS=0
# Truthy enables debug behavior in the local deploy flows.
INFINITO_DEBUG=true
# Deploy mode the discovery matrix targets (compose|swarm) for per-mode services.yml skip; empty disables it.
INFINITO_DEPLOY_MODE=
# Seed the discovery sort's tie-breaker derives from; empty draws it per process, so the rendered plan can differ from the deploy.
INFINITO_DISCOVERY_SEED=
# Sort spec the CI app-discovery (scripts/meta/resolve/apps.sh) orders roles by; the order decides which rows a chunk takes first.
INFINITO_DISCOVERY_SORT="asc clone,asc covered_by,desc integrated,desc embeds,desc consumers,asc variant,asc random"
# Distro the build/test matrix is currently iterating over (generator may override).
INFINITO_DISTRO=debian
# Domain the host-side DNS-fallback / dnsmasq config wires up (consumed by scripts/system/network/dns/).
INFINITO_DNS_DOMAIN=infinito.test
# Path to the hosts file the DNS-fallback installer writes the BEGIN/END block into.
INFINITO_DNS_HOSTS_FILE=/etc/hosts
# IPv4 of the CoreDNS sidecar inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
INFINITO_DNS_IP=172.30.0.53
# Repo-relative path of the docker CLI install script.
INFINITO_DOCKER_CLI_INSTALL_SCRIPT=roles/sys-svc-container/files/shell/install-cli.sh
# Filesystem the docker data root runs on; empty until scripts/tests/deploy/utils/filesystem/resolve.sh settles the row's kind.
INFINITO_DOCKER_FILESYSTEM=
# Space-separated subset of ext4/btrfs/zfs the pick may use; empty draws from all three.
INFINITO_DOCKER_FILESYSTEM_ALLOWED=
# `true` when a human named the pick, so it binds: a host that cannot deliver it fails instead of falling back.
INFINITO_DOCKER_FILESYSTEM_ENFORCED=
# The filesystem the deploy matrix assigned one row; empty draws from INFINITO_DOCKER_FILESYSTEM_ALLOWED.
INFINITO_DOCKER_FILESYSTEM_PICK=
# `true` when the pick binds, because a human named it or nothing permitted is servable; the applying step then fails instead of declining.
INFINITO_DOCKER_FILESYSTEM_REQUIRED=
# Mount point inside the infinito container where INFINITO_DOCKER_VOLUME lands.
INFINITO_DOCKER_MOUNT=/var/lib/docker
# Docker volume backing /var/lib/docker; generator overrides to /mnt/docker on GHA.
INFINITO_DOCKER_VOLUME=docker
# Stack domain for vhosts, certs and fixtures; a CI/dev default a real deploy overrides; a worktree gets <branch>.INFINITO_DNS_DOMAIN.
INFINITO_DOMAIN=main.infinito.test
# Repo-relative path of the filesystem userland install script (ext4, btrfs, zfs).
INFINITO_FILESYSTEM_INSTALL_SCRIPT=scripts/install/filesystem.sh
# Repository name of the operator's fork; composed into INFINITO_FORK_REPOSITORY_URL by utils/env/handlers/infinito/fork_repository_url.py.
INFINITO_FORK_REPOSITORY_NAME=infinito-nexus-core
# IPv4 of the bridge gateway inside INFINITO_SUBNET.
INFINITO_GATEWAY=172.30.0.1
# Prefix path under which GHCR mirror lookups search for cached images.
INFINITO_GHCR_MIRROR_PREFIX=mirror
# Shared .git directory a worktree checkout points at; empty on the primary instance, which carries its own.
INFINITO_GIT_COMMON_DIR=
# Image tag used to address the published infinito image (CI publishes 'latest' on push).
INFINITO_IMAGE_TAG=latest
# Slot index isolating a parallel checkout: 0 owns the cache stack, 1..255 shift subnet, bind IP and container names.
INFINITO_INSTANCE=0
# Repo-relative path of the PHP/Ruby unit-suite toolchain install script.
INFINITO_INTERPRETERS_INSTALL_SCRIPT=scripts/install/interpreters.sh
# Optional JSON object merged into the generated dev-inventory vars.
INFINITO_INVENTORY_EXTRA_VARS=
# Repo-relative path to the Ansible vars file `infinito administration inventory provision --vars-file <...>` consumes.
INFINITO_INVENTORY_VARS_FILE=inventories/development/default.yml
# IPv4 of the infinito application container inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
INFINITO_IP4=172.30.0.10
# IPv6 loopback / public address the playbook's `internet` network defaults to when no host_var pin is set.
INFINITO_IP6=::1
# True when /proc/version identifies the host as WSL2; generator overrides via runtime detection.
INFINITO_IS_WSL2=false
# Keep act-swarm test cluster alive after the workflow for post-mortem inspection.
INFINITO_KEEP_SWARM_NODES=false
# Lifecycle envelope the CI test-deploy discovery exercises (scripts/meta/resolve/apps.sh --lifecycles); comma/space-separated.
INFINITO_LIFECYCLES="alpha beta rc stable maintenance"
# Ansible limit pattern for local deploys.
INFINITO_LIMIT_HOST=localhost
# Where scripts/lint/wrapper.sh executes 'make lint*' / 'make autoformat': host | docker.
INFINITO_LINT_RUNNER=docker
# Public FQDN of a reachable mail server; when set, the provider asserts its live DNS/TLS/SMTP hard facts. Empty disables the check.
INFINITO_MAIL_PRODUCTION_HOST=
# Resolver the production mail-facts check queries (e.g. 1.1.1.1 for the public view); empty uses /etc/resolv.conf.
INFINITO_MAIL_PRODUCTION_RESOLVER=
# memswap_limit cap applied to the infinito container; 0 means "unlimited".
INFINITO_MEMSWAP_LIMIT=0
# mem_limit cap applied to the infinito container; 0 means "unlimited".
INFINITO_MEM_LIMIT=0
# Deploy modes CI rows may be drawn from: 'auto' for every mode a role offers, or a subset of 'host compose swarm'.
INFINITO_MODES=auto
# Repo checkout path on act-swarm DinD test nodes.
INFINITO_NODE_SRC_DIR=/opt/infinito-nexus
# MTU of the compose stack's bridge network; 1500 matches most hosts.
INFINITO_OUTER_NETWORK_MTU=1500
# Repo-relative path of the package build/install script.
INFINITO_PACKAGE_INSTALL_SCRIPT=scripts/install/package.sh
# GHCR owner of the distribution base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito/parent_image.py.
INFINITO_PARENT_IMAGE_OWNER=kevinveenbirkenbach
# Tag of the distribution base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito/parent_image.py.
INFINITO_PARENT_IMAGE_TAG=latest
# `true` keeps Playwright trace, screenshot, and video for every test; default `false` retains them only on failure.
INFINITO_PLAYWRIGHT_KEEP=false
# When `true`, the CI down-handler skips wiping the Docker volume so layer cache survives across jobs.
INFINITO_PRESERVE_DOCKER_CACHE=false
# App ids leading the CI deploy list; they get chunks of their own ahead of the regular rows.
INFINITO_PRIORITY=
# When `false`, the dev-stack container publishes no host ports (nested runner deploys share the outer daemon via DooD).
INFINITO_PUBLISH_PORTS=true
# Docker pull policy compose applies; generator overrides to `always` on GHA.
INFINITO_PULL_POLICY=never
# Repo-relative path of the system python install script.
INFINITO_PYTHON_INSTALL_SCRIPT=roles/dev-python/files/shell/install.sh
# The compose deploy runs the recover drill between PASS 1 and PASS 2 (backup/recover verification); set `false` to skip.
INFINITO_RECOVER_DRILL=true
# Absolute path of the repository root on the runner host; passed through to nested Ansible invocations.
INFINITO_REPO_ROOT=
# Per-runner CI storage budget; roles needing more are dropped from the matrix (scripts/meta/resolve/apps.sh).
INFINITO_REQUIRED_STORAGE=60GB
# Runner-side collection root for CI rescue diagnostics; uploaded as artifact (in-container snapshots use INFINITO_RESCUE_DIAGNOSTICS_DIR).
INFINITO_RESCUE_DIAGNOSTICS_BASE=/tmp/rescue-diagnostics
# Prefix applied to per-runner Docker Compose project names and container labels; empty in non-runner contexts.
INFINITO_RUNNER_PREFIX=infinito
# True when running under nektos/act locally; generator overrides via runtime detection.
INFINITO_RUNNING_ON_ACT=false
# True when running on real GitHub Actions; generator overrides via runtime detection.
INFINITO_RUNNING_ON_GITHUB=false
# Extra flags forwarded verbatim to 'docker run' by 'make run'.
INFINITO_RUN_FLAGS=
# Git repository holding the agent skills (skills-lock.json + make project target); developers override this with their own repo.
INFINITO_SKILLS_REPOSITORY=https://github.com/kevinveenbirkenbach/skills
# Skip the in-container entry.sh recompile during local deploys (venv prebuilt).
INFINITO_SKIP_COMPILE=false
# Absolute path to the bind-mounted repo root inside the dev container.
INFINITO_SRC_DIR=/opt/src/infinito
# CIDR of the internal docker bridge used by the compose stack.
INFINITO_SUBNET=172.30.0.0/24
# Fixed lab IP of the DR-drill backup host.
INFINITO_SWARM_BACKUP_IP=192.168.244.14
# Private-key path for the DR-drill backup user; write_extras generates the pair, the drill installs it on the backup host.
INFINITO_SWARM_BACKUP_KEY=/tmp/swarm-nfs-backup.key
# Pull-only backup-host base name in the act-swarm-test cluster; a non-swarm systemd node that mirrors the schema's arch-server2.
INFINITO_SWARM_BACKUP_NAME=swarm-bkp-01
# Lab bridge-network base name linking the act-swarm-test containers.
INFINITO_SWARM_LAB_NET_NAME=swarm-lab
# Lab bridge-network subnet of the act-swarm-test cluster; the node IPs must live inside it.
INFINITO_SWARM_LAB_SUBNET=192.168.244.0/24
# Fixed lab IP of the manager node (pinned via extra_hosts on every node so multi-network DNS stays deterministic).
INFINITO_SWARM_MGR_IP=192.168.244.10
# Manager-node base name in the act-swarm-test cluster (prefixed with the cluster id at runtime).
INFINITO_SWARM_MGR_NAME=swarm-mgr-01
# Fixed lab IP of the NFS-server sidecar.
INFINITO_SWARM_NFS_IP=192.168.244.13
# NFSv4 minor versions the swarm-lab ganesha offers; pin to "0" on hosts whose kernel NFS client breaks ganesha 4.1+ sessions.
INFINITO_SWARM_NFS_MINOR_VERSIONS="0, 1, 2"
# NFS-server sidecar base name in the act-swarm-test cluster.
INFINITO_SWARM_NFS_NAME=nfs-server
# Process ceiling per DinD node.
INFINITO_SWARM_NODE_PIDS_LIMIT=8192
# Ceiling in minutes for one distro's swarm matrix deploy in scripts/tests/deploy/swarm/routine/00_one.sh; swarm's step level.
INFINITO_SWARM_STEP_TIMEOUT_MINUTES=350
# Wall clock 00_one.sh leaves collect_and_teardown under the sweep budget; measured worst case 12m44s on the swarm moodle#1 rescue path.
INFINITO_SWARM_TEARDOWN_RESERVE_SECONDS=900
# Docker label stamped on every act-swarm-test container (DinD + NFS sidecar) so cleanup selects by label, not a guessed name.
INFINITO_SWARM_TEST_LABEL=infinito.swarm-test
# Fixed lab IP of worker node 1.
INFINITO_SWARM_WRK1_IP=192.168.244.11
# Worker-node-1 base name in the act-swarm-test cluster.
INFINITO_SWARM_WRK1_NAME=swarm-wrk-01
# Fixed lab IP of worker node 2.
INFINITO_SWARM_WRK2_IP=192.168.244.12
# Worker-node-2 base name in the act-swarm-test cluster.
INFINITO_SWARM_WRK2_NAME=swarm-wrk-02
# Glob `unittest discover -p` applies when running the test suites.
INFINITO_TEST_PATTERN=test*.py
# Where scripts/tests/code/wrapper.sh executes the test run: docker | host.
INFINITO_TEST_RUNNER=docker
# Integer multiplier applied to Ansible retry/delay values on slow self-hosted hardware; 1 = no scaling.
INFINITO_TIMEOUT_MULTIPLIER=1
# Tor axis of the CI deploy matrix: auto | enforced | exclusive | disabled. exclusive also drops the variants that cannot take an onion.
INFINITO_TOR=auto
# Node Tor SOCKS port; set by the env handler from svc-net-tor services.tor.ports.local.socks (SPOT).
INFINITO_TOR_SOCKS_PORT=
# Variant overlay (applications.<app> services/credentials) baked per round by the swarm matrix orchestrator; empty elsewhere.
INFINITO_VARS_PAYLOAD=
# Absolute path of the project virtualenv inside the dev container (and on the host when /opt is writable).
INFINITO_VENV_DIR=/opt/venvs/infinito
# Seconds 'make up' waits for the infinito container healthcheck before failing.
INFINITO_WAIT_HEALTH_TIMEOUT_S=600
# Optional app-discovery filter consumed by scripts/meta/resolve/apps.sh and the GHA workflow.
INFINITO_WHITELIST=
# Master toggle for the worker SPOT chain (INFINITO_WORKER_CPU / _FETCH); falsy values: 0/false/no/off.
INFINITO_WORKER_ENABLED=true
# Track directories scripts/tests/workspace/00_orchestrator.sh runs, in the order given.
INFINITO_WORKSPACE_TRACKS=base compose swarm
Reference in new issue View Git Blame Copy Permalink