Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
Unit Tests
This directory contains unit tests for various custom components in the project, such as the custom lookup plugin docker_cards used in the web-app-desktop role.
Overview
The unit tests are written using Python’s built-in unittest framework. They are designed to verify that your custom logic works as expected—such as extracting metadata from role files—without needing to run the entire playbook.
Running the Tests
You can run the tests using one of the following methods:
-
Using Unittest Discovery:
From the project's root directory, run:
python -m unittest discover -s tests/unitThis command will discover and execute all test files within the
tests/unitdirectory. -
Running a Specific Test File:
If you want to run only the Docker cards test, execute:
python tests/unit/test_docker_cards.py
How It Works
-
Setup:
The test script creates a temporary directory to simulate your roles folder. It then creates a sample role (web-app-desktop) with aREADME.mdfile (containing a header for the title) and ameta/main.ymlfile (with the required metadata). -
Execution:
Dummy variable values fordomainsandapplicationsare provided (these are the variables the lookup plugin expects). The lookup plugin is then run, which processes the sample role and returns the card information. -
Verification:
The test uses assertions to ensure that the output contains the expected title, description, icon information, constructed URL, and the correct iframe flag. -
Cleanup:
After the test completes, the temporary directory is removed, ensuring that no test artifacts remain.
Requirements
- Python 3.6 or newer is recommended.
- All necessary dependencies for your project should be installed.
These tests help ensure that your custom code is reliable and behaves as expected, and they can be easily integrated into a Continuous Integration (CI) pipeline.
Happy testing!