8.0.0 (2026-05-27)

[8.0.0] - 2026-05-27

  • This release lands the matrix-deploy hardening pass, an interactive console for the CLI, the bundles workflow, a per-consumer Postgres builder, a shared Playwright persona library across every web role, a SPOT env pipeline under the INFINITO_ namespace, and a new education-suite bundle (openwebui + mailu) alongside the KIX Service Management role.

Major Changes

  • Promoted matrix-deploy to a full purge + full redeploy between rounds, taught the inventory validator to honour variants.yml keys, and split the variant runner into auth-isolated rounds so OIDC, LDAP, and native personas never share residual state

  • Replaced inline SQL task templates with a first-class database_query Ansible module that takes a caller-controlled mask_values parameter, and migrated every role to call it instead of templating ad-hoc psql/mysql commands

  • Rebuilt the env pipeline around a SPOT default.env at the repository root, retired the env/ subtree and the env.development marker, folded ci.env into default.env, and put every runtime knob under the INFINITO_ namespace (BUILDKIT_ENABLED, OUTER_NETWORK_MTU auto-detected from the host route, CONTAINER_CA_ENABLED, and the path/image overrides)

  • Reworked the Make surface into domain prefixes (compose-, network-, clean-, container-), added comment-derived make help, parallel test/lint wrappers with per-target wall-clock, a default help target, a single make deploy router, a make console REPL, make compose-playwright, a test-signed pre-push gate, and a clean-container-owned target

  • Routed every role image reference through lookup(config, …) so the GHCR mirror takes effect uniformly, and introduced a per-consumer Postgres image builder so shared:false rdbms consumers get the extensions and libraries they need via initdb.d

Added

  • Added web-app-kix (KIX Service Management, req-015), the education-suite bundle wiring web-app-openwebui and web-app-mailu, the bundles deploy-bundles / redeploy-bundles flow, and a deploy verifier that walks required_by for every non-invokable role

  • Added an interactive CLI console with stateful navigation, ls, and modular subcommands; a meta roles applications complexity command with reverse direction, level filter, total column, ordering, and cli/json output; and a meta roles services called verifier hooked into dev-deploy

  • Added a shared Playwright persona library that now drives every web role, parameterized matomo tracker checks, web-svc-logout injection specs via roles_with_service, dashboard dropdown handling, iframe-aware deny checks, keycloak auth-provider exemption, the PERSONA_*_BLOCKED contract, a PLAYWRIGHT_KEEP_ALL artefact toggle, persisted artefacts per variant and pass, and a Time column in the summary table

  • Added lint guards: auth-isolation across variants.yml, variants-services-match with a nocheck opt-out, required_by on non-invokable roles (Bundle C), lint-playwright per-role spec parse, a raw-image ban in compose templates (and the eight existing violations fixed), expanded required_by[web] for the webserver and CSP infra, and a Python-ized lint installer with host/docker dispatch

  • Added a requirements archive CLI with a completeness lint, a live registry-reachability probe for pinned images, top-N Ansible role runtimes in the deploy job summary, Playwright JUnit reports rendered as a workflow step summary, an affected-roles filter that skips .md/.rst outside roles, and an update open-pr deduper that supersedes stale class siblings

  • Added native admin login for web-app-bluesky when oauth2 is disabled, native + LDAP + OIDC persona tests for web-app-openwebui, a multi-auth dispatcher for web-app-matrix (OIDC plus native/LDAP password), web-app-lam registered as a service provider with moodle v0/v1 opt-in, web-app-prometheus navbar logout injection, SMTP wiring for web-app-pgadmin, dynamic LDAP and Playwright LDAP coverage for web-app-opencloud, version-incompatible plugin tolerance for web-app-nextcloud, gated enable_local_logins for web-app-discourse, and biber+admin persona blocks for web-app-akaunting, web-app-bookwyrm, web-app-bluesky, and web-app-postmarks

Removed and Renamed

  • Renamed deploy to compose-deploy across Make, container-* purges and refresh to compose-*, the legacy backup roles to svc-bkp-* with container/local-2-remote invokable entrypoints, lookup status to deployment with a runtime-aware deployed flag, dmbs_*/dbms_base templates to a container_depends_on lookup, INFINITO_CMD to a plain cmd parameter, and web-opt-rdr-www canonical to w3redirect with lookup-based mappings

  • Dropped the ci compose profile and its –profile ci arg, the run-once guard on web-opt-rdr-domains, the slim pkgmgr base image variant, requirement-file references from runtime code, and the inline XML payload duplication in web-app-xwiki

Contributors