Commit graph

7169 commits

Author SHA1 Message Date
fnux 44eeb4bbfc Merge branch 'scanner' into 'master'
usable cdist scan

See merge request ungleich-public/cdist!993
2021-07-05 07:44:28 +02:00
ander 30ba796d06
new type: __snakeoil_cert 2021-07-02 10:09:38 +03:00
Darko Poljak 243a4b904a ++changelog 2021-07-02 06:50:02 +02:00
poljakowski 6528fd1c77 Merge branch 'feature/type/__debconf_set_selections/state-explorer' into 'master'
__debconf set selections: Add state explorer

See merge request ungleich-public/cdist!999
2021-07-02 06:49:24 +02:00
poljakowski 99188b4822 Merge branch '__download_improvements' into 'master'
[__download] improvements

See merge request ungleich-public/cdist!1003
2021-07-02 06:38:15 +02:00
poljakowski 62ea1d2721 Merge branch 'ander/update_readme' into 'master'
update README

See merge request ungleich-public/cdist!1004
2021-07-02 06:33:53 +02:00
ander a90e642c13
update README 2021-07-01 14:50:40 +03:00
ander 60753ddfcc
fix shellcheck 2021-07-01 14:42:10 +03:00
fancsali d937d53f3d Add quotes to rsync command 2021-06-28 18:09:35 +01:00
fancsali 2db40d8d70 Use $__remote_exec and thus the ssh multiplexing 2021-06-28 12:54:20 +02:00
ander 7b3f268df2
[__download] improvements
1. post download checksum verification
2. detect hashes without prefix
3. add optional --destination
4. updated man
2021-06-22 16:36:30 +03:00
fancsali b726697e07 Add documentation 2021-06-11 15:05:33 +01:00
fancsali a3102022e1 More sensible defaults; reword debian-only error message 2021-06-11 15:05:17 +01:00
Darko Poljak c308a28969 ++changelog 2021-06-10 06:39:55 +02:00
poljakowski 02aa88463a Merge branch 'fix/type/__pyvenv/group-explorer' into 'master'
__pyvenv: Fix group explorer

See merge request ungleich-public/cdist!998
2021-06-10 06:37:21 +02:00
Dennis Camera 6ede76b08b [type/__debconf_set_selections] man.rst: Fix line break in AUTHORS 2021-06-08 16:20:55 +02:00
Dennis Camera d596986af8 [type/__pyvenv] Fix group explorer 2021-05-31 09:06:52 +02:00
Darko Poljak defa3c22ea ++changelog 2021-05-29 11:21:34 +02:00
poljakowski d2ce55ea6e Merge branch '__git_fix_group_explorer' into 'master'
[__git] fix group explorer

See merge request ungleich-public/cdist!992
2021-05-29 11:20:20 +02:00
fnux e0c52d0e1d
[scanner] remove mention of non-implemented trigger soruce script 2021-05-26 11:27:11 +02:00
fnux b8733c65f5
[scanner] fix minor CLI handling and --list bugs / typo 2021-05-26 11:26:35 +02:00
fnux ab10b453f2
[scanner] populate cdist(1) 2021-05-26 11:15:41 +02:00
fnux 75c71f69c1
[scanner] pycodestyle compliance 2021-05-26 10:18:12 +02:00
ander 503a06ed28
[__git] fix group explorer
group name from numberic id wasn't resolved correctly.

try to use getent and fallback to reading /etc/group directly.
2021-05-23 13:35:33 +03:00
evilham 6210cccb28 ++changelog 2021-05-10 12:34:04 +02:00
evilham f14623e45f ++changelog 2021-05-10 12:17:08 +02:00
evilham 81b426e4e2 [__letsencrypt_cert] Revamp explorers, add locking.
Closes #839

See merge request ungleich-public/cdist!976

This patch joins all explorers in one to avoid starting multiple remote python
processes and uses a cdist-specific lock in /tmp/certbot.cdist.lock with a
60 seconds timeout.
2021-05-10 12:10:01 +02:00
evilham a696f3cf00 [__letsencrypt_cert] Revamp explorers, add locking.
This would fix #839

Certbot uses locking [1] even for read-only operations and does not properly
use exit codes, which means that sometimes it would print:
"Another instance of Certbot is already running" and exit with success.

However, the previous explorers would take that as the certificate being absent
and would trigger code generation.

The issue was made worse by having many explorers running certbot, so for N
certificates, we'd run certbot N*4 times, potentially "in parallel".

[1]: https://certbot.eff.org/docs/using.html#id5

This patch joins all explorers in one to avoid starting multiple remote python
processes and uses a cdist-specific lock in /tmp/certbot.cdist.lock with a
60 seconds timeout.

It has been tested with certbot 0.31.0 and 0.17 that the:

    from certbot.main import main

trick works. It is somewhat well documented so it can be somewhat relied upon.
2021-05-10 12:10:00 +02:00
evilham 0b05a8f5f7 [__apt_key*] Deprecate __apt_key_uri and improve __apt_key
See: https://code.ungleich.ch/ungleich-public/cdist/-/merge_requests/994

Previously this type was falling back to using the deprecated apt-key(8) by
checking for existence of files/directories on the controller host in
gencode-remote.

Adding `--use-deprecated-apt-key` as an explicit boolean serves two purposes:
1. It prevents fallbacks that might end up doing the wrong thing
   (as was the case)
2. It allows for a simple way to remove keys from the keyring that were
   previously added with apt-key(8) to /etc/apt/trusted.gpg

This parameter is added marked as deprecated as is only intended use is to
migrate to directory-based keyrings as recommended by Debian for a few releases.
It will be removed when Debian 11 stops being supported.

During the review process of this merge request, it was noted that the state of
PGP Key Servers is somewhat suboptimal, that the examples encouraged bad
practise (it is trivial to produce collisions for short key IDs), and that 
this use does not require the Web of Trust, but instead only the public key
that is signing the repository.

That is why this also adds `--source` as an argument allowing for in-type or
in-manifest provision of such public keys by the type/manifest maintainer and
the use of Key Servers is still supported, but discouraged.
2021-05-10 12:08:23 +02:00
evilham c00c8c2012 [__apt_key*] Deprecate __apt_key_uri and improve __apt_key
Previously this type was falling back to using the deprecated apt-key(8) by
checking for existence of files/directories on the controller host in
gencode-remote.

Adding `--use-deprecated-apt-key` as an explicit boolean serves two purposes:
1. It prevents fallbacks that might end up doing the wrong thing
   (as was the case)
2. It allows for a simple way to remove keys from the keyring that were
   previously added with apt-key(8) to /etc/apt/trusted.gpg

This parameter is added marked as deprecated as is only intended use is to
migrate to directory-based keyrings as recommended by Debian for a few releases.
It will be removed when Debian 11 stops being supported.

During the review process of this merge request, it was noted that the state of
PGP Key Servers is somewhat suboptimal, that the examples encouraged bad
practise (it is trivial to produce collisions for short key IDs), and that
this use does not require the Web of Trust, but instead only the public key
that is signing the repository.

That is why this also adds `--source` as an argument allowing for in-type or
in-manifest provision of such public keys by the type/manifest maintainer and
the use of Key Servers is still supported, but discouraged.
2021-05-10 12:08:22 +02:00
Dennis Camera a42ebc7a78 [type/__debconf_set_selections] Synchronise objects
Works around locking error:

	debconf: DbDriver "config": /var/cache/debconf/config.dat is locked by another process: Resource temporarily unavailable
2021-04-27 19:46:07 +02:00
Darko Poljak 3a25b80466 ++changelog 2021-04-26 21:27:15 +02:00
poljakowski 3e190c3481 Merge branch 'feature/type/__postgres/postgres_user-explorer' into 'master'
__postgres_*: Improve OS support and some cleanup

See merge request ungleich-public/cdist!990
2021-04-26 21:26:38 +02:00
Dennis Camera 9cf19388ab [type/__debconf_set_selections] Send message about each debconf setting that is changed 2021-04-26 16:47:44 +02:00
Dennis Camera a4122882f2 [type/__debconf_set_selections] Add state explorer
…and to make it work, replace --file with --line.

--file is deprecated because it does not work with the state explorer as the
contents of the file are not available on the target.
2021-04-26 16:39:51 +02:00
fnux 2232435c22
[scanner] initial documentation
Note: still needs to patch main cdist(1) manpage
2021-04-26 14:39:26 +02:00
fnux 3a9dd5b166
[scanner] add minimal (non-configurable) config mode 2021-04-26 12:09:55 +02:00
fnux 92fff7cb77
[scanner] fix crash on --list with name mapper provided 2021-04-26 12:09:44 +02:00
Dennis Camera 0f05f38384 [type/__postgres_role] Treat --password '' like no --password 2021-04-25 20:01:36 +02:00
Dennis Camera 0d33407b18 [type/__postgres_database] Proper quoting in state explorer 2021-04-25 20:01:36 +02:00
Dennis Camera 8296051653 [type/__postgres_extension] Add state explorer 2021-04-25 20:01:36 +02:00
Dennis Camera 3cf93249c3 [type/__postgres_extension] Include postgres_user explorer from __postgres_conf 2021-04-25 20:01:36 +02:00
Dennis Camera beb8da6d5f [type/__postgres_role] Include postgres_user explorer from __postgres_conf 2021-04-25 20:01:36 +02:00
Dennis Camera 58b279a8d0 [type/__postgres_database] Improve quoting 2021-04-25 20:01:36 +02:00
Dennis Camera 6ac8cbf98f [type/__postgres_database] Include postgres_user explorer from __postgres_conf 2021-04-25 20:01:36 +02:00
Darko Poljak 512e9b23c0 ++changelog 2021-04-25 15:53:40 +02:00
poljakowski 71d79ed6ee Merge branch 'feature/type/__postgres_conf' into 'master'
__postgres_conf: new type

See merge request ungleich-public/cdist!972
2021-04-25 15:49:19 +02:00
fnux 13e2ad175f
[scanner] add host class, name mapper and pre-config logic 2021-04-25 12:45:34 +02:00
fnux bb24d632d6
[scanner] implement the --list flag 2021-04-22 10:20:49 +02:00
fnux a4464209b6
[scanner] add minimal error handling, consolidate CLI args processing 2021-04-22 09:31:06 +02:00