fix(celilo): drop idp_dmz_ip + the /etc/hosts pin (ISS-0156 supersedes ISS-0095) #17

Merged

forgejo-admin merged 1 commit from fix/drop-idp-dmz-ip into main

2026-07-31 07:48:50 +00:00

forgejo-admin commented

2026-07-31 07:31:03 +00:00

Owner

lunacycle is currently undeployable. celilo module deploy lunacycle fails at generation:

Cannot generate 'lunacycle': 1 capability-derived variable(s) won't resolve:
  - lunacycle.idp_dmz_ip derives from $capability:idp.dmz_ip, but the
    provider's 'idp' data has no value there — redeploy the provider so it re-registers

Why

celilo cda7d722 (2026-06-28, ISS-0156) removed idp.dmz_ip + caddy_dmz_ip from authentik, public_web.dmz_ip from caddy, forge_dmz_ip from forgejo/runner/builder, and every per-consumer /etc/hosts pin. caddy now registers its fronted hostnames with zoneRoutableValue, so the resolver's per-zone views answer app-zone clients with caddy's DMZ ingress directly — explicitly superseding ISS-0095, which is what this module was built against.

That refactor updated the modules living in the celilo repo. lunacycle lives in its own repo and was missed, leaving it the last consumer of a field no provider supplies. Redeploying authentik does not help: the installed and newest-published 1.2.0+22 has no dmz_ip in its provides block at all.

Verified before removing the pin

From inside the app-zone container (10.0.20.11), dig (which bypasses /etc/hosts):

dig +short auth.lunacycle.net  →  10.0.10.10     # caddy's DMZ ingress ✓

Not natIp, not the public 71.36.112.98. So the server-side createRemoteJWKSet fetch resolves correctly with no pinning.

Changes

manifest.yml — drop the idp_dmz_ip variable
celilo/types.d.ts — drop idp_dmz_ip?: string
celilo/ansible/playbook.yml.tpl — drop the pass-through var
celilo/ansible/roles/lunacycle/tasks/main.yml.tpl — drop the set_fact + lineinfile pin tasks

No state: absent cleanup task, matching cda7d722's own precedent — the now-inert 10.0.10.10 auth.lunacycle.net line on existing hosts agrees with what DNS returns anyway.

celilo module check . → 10 ok, 0 fail. tsc -b --noEmit clean.

Unblocks the deploy of the Start Cycle fix (#15), which is published as 1.0.2+2 but stranded in the module store.

🤖 Generated with Claude Code

lunacycle is currently **undeployable**. `celilo module deploy lunacycle` fails at generation: ``` Cannot generate 'lunacycle': 1 capability-derived variable(s) won't resolve: - lunacycle.idp_dmz_ip derives from $capability:idp.dmz_ip, but the provider's 'idp' data has no value there — redeploy the provider so it re-registers ``` ## Why celilo `cda7d722` (2026-06-28, ISS-0156) removed `idp.dmz_ip` + `caddy_dmz_ip` from authentik, `public_web.dmz_ip` from caddy, `forge_dmz_ip` from forgejo/runner/builder, and every per-consumer `/etc/hosts` pin. caddy now registers its fronted hostnames with `zoneRoutableValue`, so the resolver's per-zone views answer app-zone clients with caddy's DMZ ingress directly — explicitly superseding ISS-0095, which is what this module was built against. That refactor updated the modules living in the celilo repo. lunacycle lives in its own repo and was missed, leaving it the last consumer of a field no provider supplies. Redeploying authentik does not help: the installed *and* newest-published `1.2.0+22` has no `dmz_ip` in its `provides` block at all. ## Verified before removing the pin From inside the app-zone container (`10.0.20.11`), `dig` (which bypasses `/etc/hosts`): ``` dig +short auth.lunacycle.net → 10.0.10.10 # caddy's DMZ ingress ✓ ``` Not natIp, not the public `71.36.112.98`. So the server-side `createRemoteJWKSet` fetch resolves correctly with no pinning. ## Changes - `manifest.yml` — drop the `idp_dmz_ip` variable - `celilo/types.d.ts` — drop `idp_dmz_ip?: string` - `celilo/ansible/playbook.yml.tpl` — drop the pass-through var - `celilo/ansible/roles/lunacycle/tasks/main.yml.tpl` — drop the `set_fact` + `lineinfile` pin tasks No `state: absent` cleanup task, matching `cda7d722`'s own precedent — the now-inert `10.0.10.10 auth.lunacycle.net` line on existing hosts agrees with what DNS returns anyway. `celilo module check .` → 10 ok, 0 fail. `tsc -b --noEmit` clean. Unblocks the deploy of the Start Cycle fix (#15), which is published as `1.0.2+2` but stranded in the module store. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

forgejo-admin added 1 commit

2026-07-31 07:31:03 +00:00

fix(celilo): drop idp_dmz_ip + the /etc/hosts pin (ISS-0156 supersedes ISS-0095)

pr-validate / validate (pull_request) Successful in 15s

Details

release / version (pull_request) Successful in 8s

Details

release / e2e (pull_request) Successful in 2m20s

Details

release / publish (pull_request) Has been skipped

Details

e309619517

celilo cda7d722 removed idp.dmz_ip from authentik's idp capability, caddy_dmz_ip,
public_web.dmz_ip and the per-consumer /etc/hosts pins fleet-wide: caddy now
registers its fronted hostnames with zoneRoutableValue, so the resolver's
per-zone views answer app-zone clients with caddy's DMZ ingress directly.

That refactor updated forgejo/runner/builder in-repo but not lunacycle, which
lives in its own repo — leaving us the last consumer of a field no provider
supplies. Deploy failed at generation:

  Cannot generate 'lunacycle': 1 capability-derived variable(s) won't resolve:
    - lunacycle.idp_dmz_ip derives from $capability:idp.dmz_ip, but the
      provider's 'idp' data has no value there

Verified from inside the app-zone container before removing the pin:
`dig +short auth.lunacycle.net` -> 10.0.10.10 (caddy's DMZ ingress), not natIp,
so createRemoteJWKSet resolves without it.

No state:absent cleanup task, matching cda7d722's own precedent — the now-inert
/etc/hosts line on existing hosts agrees with what DNS returns.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

forgejo-admin merged commit d3af6484f4 into main

2026-07-31 07:48:50 +00:00

forgejo-admin referenced this pull request from a commit

2026-07-31 07:48:51 +00:00

Merge pull request 'fix(celilo): drop idp_dmz_ip + the /etc/hosts pin (ISS-0156 supersedes ISS-0095)' (#17) from fix/drop-idp-dmz-ip into main