mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5.5
34be0afdf7
Four roles rendered a credential into a container's command or healthcheck, where `docker inspect` and the host's `ps` show it: - svc-db-redis: `redis-server --requirepass <password>`, the healthcheck's `redis-cli -a <password>`, `REDIS_CLI` with `-a` and the ACL password on the `container exec` line. The CLI, ACL and healthcheck changes are the ones feature/store-i18n made for #1213 (54dde281a0,772e3e70e0): REDISCLI_AUTH from the container's REDIS_PASSWORD, the ACL password on stdin through `redis-cli -x`, and the healthcheck declared through the container_healthcheck SPOT. New here: redis-server reads `--requirepass "$$REDIS_PASSWORD"` from its environment at runtime, which needs the CA override to keep the `$$` (e53a8c7d75). - svc-db-elasticsearch: the healthcheck's `curl -u elastic:<password>` now reads the credential as a curl config on stdin, written by the printf builtin from ELASTIC_PASSWORD. - svc-db-typesense: the server reads TYPESENSE_API_KEY from its env file, so `--api-key <key>` is gone. - web-app-funkwhale: its Typesense sidecar gets the key through that service's `environment:` instead of `--api-key`; the shared env file would hand it to the API as well. The exec argv lints check Ansible commands only, so none of this was caught. test_compose_argv_no_secret refuses a credential variable in the command, entrypoint, healthcheck or test of a role template; it failed on these five lines before the fix. Checked: the local redis answers the authenticated ping on the first attempt and its Cmd and healthcheck carry only `$REDIS_PASSWORD`; typesense 0.25.2 accepts the key from the environment (200 with it, 401 without, refuses to start with none); curl sends the expected Authorization header from `-K -`. Refs #1213 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Tests 🧪
All automated tests for Infinito.Nexus live here.
| Directory | Type | Guide |
|---|---|---|
unit/ |
Unit tests (isolated, no I/O) | unit.md |
integration/ |
Integration tests (real component boundaries) | integration.md |
external/ |
Opt-in live third-party checks, excluded from make test |
external.md |
e2e/ |
End-to-end Playwright tests | playwright.md |
regression/ |
Regression guard rules | regression.md |
lint/ |
Structural lint checks | lint.md |
fuzz/ |
Coverage-guided atheris harnesses, run weekly in CI, excluded from make test |
workflows.md |
Run each suite via the make targets documented in the linked guides.