Merge branch 'main' into feature/stepup-azuremfa-federation-metadata

phavekes · web-flow · commit 6139f43f9cbc · 2025-09-15T08:05:44.000+02:00
diff --git a/.github/workflows/molecule-loadbalancer.yml b/.github/workflows/molecule-loadbalancer.yml
@@ -23,7 +23,7 @@ jobs:
   build:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python 3.8
         uses: actions/setup-python@v5
diff --git a/.github/workflows/molecule-mongo.yml b/.github/workflows/molecule-mongo.yml
@@ -17,7 +17,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Python 3.8
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/syntax.yml b/.github/workflows/syntax.yml
@@ -19,7 +19,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python 3.8
         uses: actions/setup-python@v5
diff --git a/deploy_containers_playbook.yml b/deploy_containers_playbook.yml
@@ -81,7 +81,7 @@
     - { role: oidcng, tags: ['oidcng'] }
 
 - name: Deploy oidc-playground app
-  hosts: docker_oidc-playground
+  hosts: docker_oidc_playground
   become: true
   roles:
     - { role: oidc-playground, tags: ['oidc-playground'] }
diff --git a/roles/dashboard/defaults/main.yml b/roles/dashboard/defaults/main.yml
@@ -1,2 +1,4 @@
 dashboard_organization: SURFconext
 dashboard_hide_tabs: none
+dashboard_server_restart_policy: always
+dashboard_server_restart_retries: 0
diff --git a/roles/dashboard/tasks/main.yml b/roles/dashboard/tasks/main.yml
@@ -27,7 +27,8 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-dashboard/dashboard-server:{{ dashboard_server_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ dashboard_server_restart_policy }}"
+    restart_retries: "{{ dashboard_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks:
       - name: "loadbalancer"
diff --git a/roles/invite/defaults/main.yml b/roles/invite/defaults/main.yml
@@ -18,3 +18,5 @@ invite_cronjobmaster: true
 invite_logback_json: true
 invite_docker_networks:
   - name: loadbalancer
+invite_server_restart_policy: always
+invite_server_restart_retries: 0
diff --git a/roles/invite/tasks/main.yml b/roles/invite/tasks/main.yml
@@ -63,15 +63,16 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-invite/inviteserver:{{ invite_server_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ invite_server_restart_policy }}"
+    restart_retries: "{{ invite_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks: "{{ invite_docker_networks }}"
     mounts:
       - source: /opt/openconext/invite/serverapplication.yml
         target: /application.yml
         type: bind
       - source: /opt/openconext/invite/logback.xml
-        target: /logback.yml
+        target: /logback.xml
         type: bind
       - source: /opt/openconext/invite/private_key_pkcs8.pem
         target: /private_key_pkcs8.pem
diff --git a/roles/manage/defaults/main.yml b/roles/manage/defaults/main.yml
@@ -34,3 +34,5 @@ manage_tabs_enabled:
   - organisation
 manage_docker_networks:
   - name: loadbalancer
+manage_server_restart_policy: always
+manage_server_restart_retries: 0
diff --git a/roles/manage/files/policies/allowed_attributes.json b/roles/manage/files/policies/allowed_attributes.json
@@ -25,16 +25,14 @@
   },
   {
     "value": "urn:collab:group:surfteams.nl",
-    "label": "SURFteams group name (fully qualified)"
+    "label": "SURFconext Invite (voot) role urn"
   },
   {
     "value": "urn:collab:sab:surfnet.nl",
     "label": "SAB role"
-
   },
   {
     "value": "urn:mace:dir:attribute-def:mail",
     "label": "Mail address"
-
   }
-]
+]
diff --git a/roles/manage/tasks/main.yml b/roles/manage/tasks/main.yml
@@ -100,7 +100,8 @@
     image: ghcr.io/openconext/openconext-manage/manage-server:{{ manage_server_version }}
     entrypoint: /__cacert_entrypoint.sh
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ manage_server_restart_policy }}"
+    restart_retries: "{{ manage_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks: "{{ manage_docker_networks }}"
     mounts:
diff --git a/roles/myconext/defaults/main.yml b/roles/myconext/defaults/main.yml
@@ -3,3 +3,5 @@ myconext_cronjobmaster: true
 myconext_logback_json: true
 myconext_docker_networks:
   - name: loadbalancer
+myconext_server_restart_policy: always
+myconext_server_restart_retries: 0
diff --git a/roles/myconext/tasks/main.yml b/roles/myconext/tasks/main.yml
@@ -128,7 +128,8 @@
     name: myconextserver
     image: ghcr.io/openconext/openconext-myconext/myconext-server:{{ myconext_server_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ myconext_server_restart_policy }}"
+    restart_retries: "{{ myconext_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     env:
       USE_SYSTEM_CA_CERTS: "1"
diff --git a/roles/oidc-playground/defaults/main.yml b/roles/oidc-playground/defaults/main.yml
@@ -1 +1,3 @@
 oidc_playground_dir: /opt/openconext/oidc-playground
+oidc_playground_server_restart_policy: always
+oidc_playground_server_restart_retries: 0
diff --git a/roles/oidc-playground/tasks/main.yml b/roles/oidc-playground/tasks/main.yml
@@ -27,8 +27,8 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-oidc-playground/oidc-playground-server:{{ oidc_playground_server_version }}
     pull: true
-    restart_policy: "always"
-    state: started
+    restart_policy: "{{ oidc_playground_server_restart_policy }}"
+    restart_retries: "{{ oidc_playground_server_restart_retries }}" # Only for restart policy on-failure
     networks:
       - name: "loadbalancer"
     mounts:
diff --git a/roles/oidcng/defaults/main.yml b/roles/oidcng/defaults/main.yml
@@ -21,3 +21,5 @@ oidcng_manage_provision_samlsp_sign: "True"
 oidcng_manage_provision_samlsp_trusted_proxy: "True"
 oidcng_docker_networks:
   - name: loadbalancer
+oidcng_server_restart_policy: always
+oidcng_server_restart_retries: 0
diff --git a/roles/oidcng/tasks/main.yml b/roles/oidcng/tasks/main.yml
@@ -101,7 +101,8 @@
     image: ghcr.io/openconext/openconext-oidcng/oidcng:{{ oidcng_version }}
     entrypoint: /__cacert_entrypoint.sh
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ oidcng_server_restart_policy }}"
+    restart_retries: "{{ oidcng_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks: "{{ oidcng_docker_networks }}"
     mounts:
diff --git a/roles/openaccess/defaults/main.yml b/roles/openaccess/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+openaccess_server_restart_policy: always
+openaccess_server_restart_retries: 0
diff --git a/roles/openaccess/tasks/main.yml b/roles/openaccess/tasks/main.yml
@@ -33,7 +33,8 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-access/accessserver:{{ openconextaccess_server_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ openaccess_server_restart_policy }}"
+    restart_retries: "{{ openaccess_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks:
       - name: "loadbalancer"
diff --git a/roles/pdp/defaults/main.yml b/roles/pdp/defaults/main.yml
@@ -23,3 +23,5 @@ pdp_spring_flyway_enabled: true
 pdp_manage_push_testmode: true
 pdp_docker_networks:
   - name: loadbalancer
+pdp_server_restart_policy: always
+pdp_server_restart_retries: 0
diff --git a/roles/pdp/tasks/main.yml b/roles/pdp/tasks/main.yml
@@ -34,7 +34,8 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-pdp/pdp-server:{{ pdp_server_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ pdp_server_restart_policy }}"
+    restart_retries: "{{ pdp_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks: "{{ pdp_docker_networks }}"
     mounts:
diff --git a/roles/teams/defaults/main.yml b/roles/teams/defaults/main.yml
@@ -29,3 +29,5 @@ teams_manage_provision_samlsp_sign: false
 teams_spring_flyway_enabled: true
 teams_docker_networks: 
   - name: "loadbalancer"
+teams_server_restart_policy: always
+teams_server_restart_retries: 0
diff --git a/roles/teams/tasks/main.yml b/roles/teams/tasks/main.yml
@@ -33,7 +33,8 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-teams-ng/teams-server:{{ teams_server_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ teams_server_restart_policy }}"
+    restart_retries: "{{ teams_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks: "{{ teams_docker_networks }}"
     mounts:
diff --git a/roles/voot/defaults/main.yml b/roles/voot/defaults/main.yml
@@ -4,3 +4,5 @@ voot_manage_provision_oauth_rs_rp_secret: "{{ voot.oidcng_checkToken_secret }}"
 voot_manage_provision_oauth_rs_name_en: "{{ instance_name }} VOOT Resource Server"
 voot_manage_provision_oauth_rs_description_en: "The VOOT API is for group membership information"
 voot_manage_provision_oauth_rs_scopes: "groups"
+voot_server_restart_policy: always
+voot_server_restart_retries: 0
diff --git a/roles/voot/tasks/main.yml b/roles/voot/tasks/main.yml
@@ -27,7 +27,8 @@
       TZ: "{{ timezone }}"
     image: ghcr.io/openconext/openconext-voot/voot:{{ voot_version }}
     pull: true
-    restart_policy: "always"
+    restart_policy: "{{ voot_server_restart_policy }}"
+    restart_retries: "{{ voot_server_restart_retries }}" # Only for restart policy on-failure
     state: started
     networks:
       - name: "loadbalancer"
diff --git a/test_containers_playbook.yml b/test_containers_playbook.yml
@@ -163,7 +163,7 @@
         - oidcngserver
 
 - name: Test oidc-playground containers
-  hosts: docker_oidc-playground
+  hosts: docker_oidc_playground
   become: true
   tasks:
     - name: Check playground containers state

Original file line number	Diff line number	Diff line change
`@@ -25,16 +25,14 @@`
`25`	`25`	`},`
`26`	`26`	`{`
`27`	`27`	`"value": "urn:collab:group:surfteams.nl",`
`28`		`- "label": "SURFteams group name (fully qualified)"`
	`28`	`+ "label": "SURFconext Invite (voot) role urn"`
`29`	`29`	`},`
`30`	`30`	`{`
`31`	`31`	`"value": "urn:collab:sab:surfnet.nl",`
`32`	`32`	`"label": "SAB role"`
`33`		`-`
`34`	`33`	`},`
`35`	`34`	`{`
`36`	`35`	`"value": "urn:mace:dir:attribute-def:mail",`
`37`	`36`	`"label": "Mail address"`
`38`		`-`
`39`	`37`	`}`
`40`		`-]`
	`38`	`+]`