mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-03 07:59:42 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
108 lines
4.7 KiB
YAML
108 lines
4.7 KiB
YAML
SOFTWARE_NAME: "Infinito.Nexus" # Name of the software
|
|
|
|
# Deployment
|
|
ENVIRONMENT: "production" # Possible values: production, development
|
|
DEPLOYMENT_MODE: "single" # Use single, if you deploy on one server. Use cluster if you setup in cluster mode.
|
|
|
|
# If true, sensitive credentials will be masked or hidden from all Ansible task logs
|
|
# Recommendet to set to true
|
|
# @todo needs to be implemented everywhere
|
|
MASK_CREDENTIALS_IN_LOGS: true
|
|
|
|
HOST_CURRENCY: "EUR"
|
|
HOST_TIMEZONE: "UTC"
|
|
|
|
# https://en.wikipedia.org/wiki/ISO_639
|
|
HOST_LL: "en" # Some applications are case sensitive
|
|
HOST_LL_CC: "{{HOST_LL}}_GB"
|
|
|
|
HOST_DATE_FORMAT: "YYYY-MM-DD"
|
|
HOST_TIME_FORMAT: "HH:mm"
|
|
|
|
HOST_THOUSAND_SEPARATOR: "."
|
|
HOST_DECIMAL_MARK: ","
|
|
|
|
# Web
|
|
WEB_PROTOCOL: "https" # Web protocol type. Use https or http. If you run local you need to change it to http
|
|
WEB_PORT: "{{ 443 if WEB_PROTOCOL == 'https' else 80 }}" # Default port web applications will listen to
|
|
|
|
# Websocket
|
|
WEBSOCKET_PROTOCOL: "{{ 'wss' if WEB_PROTOCOL == 'https' else 'ws' }}"
|
|
|
|
# WWW-Redirect to None WWW-Domains enabled
|
|
WWW_REDIRECT_ENABLED: "{{ ('web-opt-rdr-www' in group_names) | bool }}"
|
|
|
|
AUTO_BUILD_ALIASES: False # If enabled it creates an alias domain for each web application by the entity name, recommended to set to false to safge domain space
|
|
|
|
# Domain
|
|
PRIMARY_DOMAIN: "localhost" # Primary Domain of the server
|
|
|
|
DNS_PROVIDER: cloudflare # The DNS Provider\Registrar for the domain
|
|
|
|
HOSTING_PROVIDER: hetzner # Provider which hosts the server
|
|
|
|
# Which ACME method to use: webroot, cloudflare, or hetzner
|
|
CERTBOT_ACME_CHALLENGE_METHOD: "cloudflare"
|
|
CERTBOT_CREDENTIALS_DIR: /etc/certbot
|
|
CERTBOT_CREDENTIALS_FILE: "{{ CERTBOT_CREDENTIALS_DIR }}/{{ CERTBOT_ACME_CHALLENGE_METHOD }}.ini"
|
|
CERTBOT_DNS_PROPAGATION_WAIT_SECONDS: 300 # How long should the script wait for DNS propagation before continuing
|
|
CERTBOT_FLAVOR: san # Possible options: san (recommended, with a dns flavor like cloudflare, or hetzner), wildcard(doesn't function with www redirect), dedicated
|
|
|
|
# Letsencrypt
|
|
LETSENCRYPT_WEBROOT_PATH: "/var/lib/letsencrypt/" # Path where Certbot stores challenge webroot files
|
|
LETSENCRYPT_BASE_PATH: "/etc/letsencrypt/" # Base directory containing Certbot configuration, account data, and archives
|
|
LETSENCRYPT_LIVE_PATH: "{{ LETSENCRYPT_BASE_PATH }}live/" # Symlink directory for the current active certificate and private key
|
|
|
|
## Docker
|
|
DOCKER_RESTART_POLICY: "unless-stopped" # Default restart parameter for docker containers
|
|
DOCKER_VARS_FILE: "{{ playbook_dir }}/roles/docker-compose/vars/docker-compose.yml" # File containing docker compose variables used by other services
|
|
DOCKER_WHITELISTET_ANON_VOLUMES: [] # Volumes which should be ignored during docker anonymous health check
|
|
|
|
# Asyn Confitguration
|
|
ASYNC_ENABLED: "{{ not MODE_DEBUG | bool }}" # Activate async, deactivated for debugging
|
|
ASYNC_TIME: "{{ 300 if ASYNC_ENABLED | bool else omit }}" # Run for max 5min
|
|
ASYNC_POLL: "{{ 0 if ASYNC_ENABLED | bool else 10 }}" # Don't wait for task
|
|
|
|
# default value if not set via CLI (-e) or in playbook vars
|
|
allowed_applications: []
|
|
|
|
# helper
|
|
_applications_nextcloud_oidc_flavor: >-
|
|
{{
|
|
applications
|
|
| get_app_conf(
|
|
'web-app-nextcloud',
|
|
'oidc.flavor',
|
|
False,
|
|
'oidc_login'
|
|
if applications
|
|
| get_app_conf('web-app-nextcloud','features.ldap',False, True, True)
|
|
else 'sociallogin',
|
|
True
|
|
)
|
|
}}
|
|
|
|
# Role-based access control
|
|
# @See https://en.wikipedia.org/wiki/Role-based_access_control
|
|
RBAC:
|
|
GROUP:
|
|
NAME: "/roles" # Name of the group which holds the RBAC roles
|
|
CLAIM: "groups" # Name of the claim containing the RBAC groups
|
|
|
|
# You need to set both keys to enable them
|
|
CAPTCHA:
|
|
RECAPTCHA:
|
|
KEY: ""
|
|
SECRET: ""
|
|
HCAPTCHA:
|
|
KEY: ""
|
|
SECRET: ""
|
|
|
|
RECAPTCHA_ENABLED: "{{ (CAPTCHA.RECAPTCHA.KEY | default('') | length > 0)
|
|
and
|
|
(CAPTCHA.RECAPTCHA.SECRET | default('') | length > 0) }}"
|
|
|
|
HCAPTCHA_ENABLED: "{{ (CAPTCHA.HCAPTCHA.KEY | default('') | length > 0)
|
|
and
|
|
(CAPTCHA.HCAPTCHA.SECRET | default('') | length > 0) }}"
|