vptechops
a4a54f553e
App credentials now flow for every agent: shared handle_oidc_interaction
helper fills the per-app OIDC login form/TOTP/consent (the panel session
is not shared across app clients -- each may demand fresh credentials),
and the Discourse signup clears the prefilled username field before
typing (prefill+typed concatenation exceeded the 20-char cap and failed
validation silently).
BW helper hardened against the sync races observed across concurrent
containers: get_item_id re-syncs stale caches, create/edit retry with
backoff and post-write sync. This class of failure was mine -- the
login-path fix from session 3 left read paths on stale caches.
Final validated matrix (validate-all-logins.py, fresh-context logins
plus live API checks): 9/10 fully green; vp-compliance blocked on a
corrupt stored password (Cloudron admin reset needed). Redmine access
still Cloudron-denied for vp-secops, svp-knel, vp-techcompliance,
vp-facilities ("You do not have access" at the OIDC interaction).
32 lines
1.5 KiB
YAML
32 lines
1.5 KiB
YAML
services:
|
|
provision:
|
|
build: .
|
|
container_name: tsys-agent-provisioner
|
|
env_file:
|
|
- ${BW_ENV_FILE:-${HOME}/.config/bw/env}
|
|
user: "provision"
|
|
volumes:
|
|
- ./agents.yaml:/app/agents.yaml:ro
|
|
- ./state:/app/state
|
|
- ./bw-state:/home/provision/.config/Bitwarden CLI
|
|
- ./bw_helper.py:/app/bw_helper.py:ro
|
|
- ./provision-agent.py:/app/provision-agent.py:ro
|
|
- ./test_bw_helper.py:/app/test_bw_helper.py:ro
|
|
- ./test_bw_persistence.py:/app/test_bw_persistence.py:ro
|
|
- ./dump-cloudron-dom.py:/app/dump-cloudron-dom.py:ro
|
|
- ./enable-cloudron-2fa.py:/app/enable-cloudron-2fa.py:ro
|
|
- ./verify-cloudron-2fa.py:/app/verify-cloudron-2fa.py:ro
|
|
- ./investigate-2fa-login.py:/app/investigate-2fa-login.py:ro
|
|
- ./dump-sso-flows.py:/app/dump-sso-flows.py:ro
|
|
- ./provision-discourse.py:/app/provision-discourse.py:ro
|
|
- ./provision-discourse-apikey.py:/app/provision-discourse-apikey.py:ro
|
|
- ./provision-redmine.py:/app/provision-redmine.py:ro
|
|
- ./merge-invites.py:/app/merge-invites.py:ro
|
|
- ./dump-invite-page.py:/app/dump-invite-page.py:ro
|
|
- ./validate-all-logins.py:/app/validate-all-logins.py:ro
|
|
- ./diagnose-vp-compliance.py:/app/diagnose-vp-compliance.py:ro
|
|
- ./validate-coo.py:/app/validate-coo.py:ro
|
|
- ./diagnose-sso-chain.py:/app/diagnose-sso-chain.py:ro
|
|
- ./probe-redmine-access.py:/app/probe-redmine-access.py:ro
|
|
- ./probe-discourse-signup.py:/app/probe-discourse-signup.py:ro
|