__postgres_*: fix forgotten edge cases in delimited identifier escape

PreOS code did not use configuration support. This fix adds support
for using cdist configuration, which takes into account cdist
configuration file, environment variables and command line options,
especially conf_dir.

It also adds support for -g, --config-file option, for specifying
custom configuration file.

.gitignore

@@ -24,6 +24,8 @@ docs/src/man1/*.1
 docs/src/man7/*.7
 docs/src/man7/cdist-type__*.rst
 docs/src/cdist-reference.rst
+docs/src/cdist-types.rst
+docs/src/cdist.cfg.skeleton
 
 # Ignore cdist cache for version control
 /cache/

.gitlab-ci.yml

@@ -3,26 +3,16 @@ stages:
 
 unit_tests:
     stage: test
-    before_script:
-        - 'apk update'
-        - 'apk add python3'
     script:
         - ./bin/build-helper version
         - ./bin/build-helper test
 
 pycodestyle:
     stage: test
-    before_script:
-        - 'apk update'
-        - 'apk add python3 py3-pycodestyle'
-        - 'ln -f -s /usr/bin/pycodestyle-3 /usr/bin/pycodestyle'
     script:
         - ./bin/build-helper pycodestyle
 
 shellcheck:
     stage: test
-    before_script:
-        - 'wget https://storage.googleapis.com/shellcheck/shellcheck-stable.linux.x86_64.tar.xz'
-        - 'tar xf shellcheck-stable.linux.x86_64.tar.xz && mv shellcheck-stable/shellcheck /usr/bin/'
     script:
         - ./bin/build-helper shellcheck

Makefile

@@ -63,6 +63,18 @@ DOCSREFSH=$(DOCS_SRC_DIR)/cdist-reference.rst.sh
 $(DOCSREF): $(DOCSREFSH)
 	$(DOCSREFSH)
 
+# Html types list with references
+DOCSTYPESREF=$(MAN7DSTDIR)/cdist-types.rst
+DOCSTYPESREFSH=$(DOCS_SRC_DIR)/cdist-types.rst.sh
+
+$(DOCSTYPESREF): $(DOCSTYPESREFSH)
+	$(DOCSTYPESREFSH)
+
+DOCSCFGSKEL=./configuration/cdist.cfg.skeleton
+
+configskel: $(DOCSCFGSKEL)
+	cp -f "$(DOCSCFGSKEL)" "$(DOCS_SRC_DIR)/"
+
 version:
 	@[ -f "cdist/version.py" ] || { \
 		printf "Missing 'cdist/version.py', please generate it first.\n" && exit 1; \
@@ -72,7 +84,7 @@ version:
 man: version $(MANTYPES) $(DOCSREF)
 	$(SPHINXM)
 
-html: version $(MANTYPES) $(DOCSREF)
+html: version configskel $(MANTYPES) $(DOCSREF) $(DOCSTYPESREF)
 	$(SPHINXH)
 
 docs: man html
@@ -114,6 +126,8 @@ speeches: $(SPEECHES)
 #
 clean: docs-clean
 	rm -f $(DOCS_SRC_DIR)/cdist-reference.rst
+	rm -f $(DOCS_SRC_DIR)/cdist-types.rst
+	rm -f $(DOCS_SRC_DIR)/cdist.cfg.skeleton
 
 	find "$(DOCS_SRC_DIR)" -mindepth 2 -type l \
 	| xargs rm -f

bin/build-helper

@@ -74,6 +74,7 @@ SHELLCHECKCMD="shellcheck -s sh -f gcc -x"
 # Skip SC2154 for variables starting with __ since such variables are cdist
 # environment variables.
 SHELLCHECK_SKIP=': __.*is referenced but not assigned.*\[SC2154\]'
+SHELLCHECKTMP=".shellcheck.tmp"
 
 # Change to checkout directory
 basedir="${0%/*}/../"
@@ -369,7 +370,7 @@ eof
         cat << eof
 Manual steps post release:
     - cdist-web
-    - send mail body generated in mailinglist.tmp and inform Dmitry for deb
+    - send generated mailinglist.tmp mail
     - twitter
 eof
     ;;
@@ -431,53 +432,67 @@ eof
     ;;
 
     shellcheck-global-explorers)
-        find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-type-explorers)
-        find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-manifests)
-        find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-local-gencodes)
-        find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-remote-gencodes)
-        find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-scripts)
-        ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type || exit 0
+        # shellcheck disable=SC2086
+        ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-gencodes)
-        "$0" shellcheck-local-gencodes
+        "$0" shellcheck-local-gencodes || exit 1
-        "$0" shellcheck-remote-gencodes
+        "$0" shellcheck-remote-gencodes || exit 1
     ;;
 
     shellcheck-types)
-        "$0" shellcheck-type-explorers
+        "$0" shellcheck-type-explorers || exit 1
-        "$0" shellcheck-manifests
+        "$0" shellcheck-manifests || exit 1
-        "$0" shellcheck-gencodes
+        "$0" shellcheck-gencodes || exit 1
     ;;
 
     shellcheck)
-        "$0" shellcheck-global-explorers
+        "$0" shellcheck-global-explorers || exit 1
-        "$0" shellcheck-types
+        "$0" shellcheck-types || exit 1
-        "$0" shellcheck-scripts
+        "$0" shellcheck-scripts || exit 1
     ;;
 
     shellcheck-type-files)
-        find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-with-files)
-        "$0" shellcheck
+        "$0" shellcheck || exit 1
-        "$0" shellcheck-type-files
+        "$0" shellcheck-type-files || exit 1
     ;;
 
     shellcheck-build-helper)
@@ -535,6 +550,7 @@ eof
 
         # Temp files
         rm -f ./*.tmp
+        rm -f ./.*.tmp
     ;;
 
     distclean)

cdist/argparse.py

@@ -6,6 +6,7 @@ import collections
 import functools
 import cdist.configuration
 import cdist.preos
+import cdist.info
 
 
 # set of beta sub-commands
@@ -103,7 +104,7 @@ def get_parsers():
                                    name="log level"),
             help=('Set the specified verbosity level. '
                   'The levels, in order from the lowest to the highest, are: '
-                  'ERROR (-1), WARNING (0), INFO (1), VERBOSE (2), DEBUG (3) '
+                  'ERROR (-1), WARNING (0), INFO (1), VERBOSE (2), DEBUG (3), '
                   'TRACE (4 or higher). If used along with -v then -v '
                   'increases last set value and -l overwrites last set '
                   'value.'),
@@ -424,7 +425,7 @@ def get_parsers():
     parser['inventory'].set_defaults(
             func=cdist.inventory.Inventory.commandline)
 
-    # PreOs
+    # PreOS
     parser['preos'] = parser['sub'].add_parser('preos', add_help=False)
 
     # Shell
@@ -436,6 +437,37 @@ def get_parsers():
                   ' should be POSIX compatible shell.'))
     parser['shell'].set_defaults(func=cdist.shell.Shell.commandline)
 
+    # Info
+    parser['info'] = parser['sub'].add_parser('info')
+    parser['info'].add_argument(
+            '-a', '--all', help='Display all info. This is the default.',
+            action='store_true', default=False)
+    parser['info'].add_argument(
+            '-c', '--conf-dir',
+            help='Add configuration directory (can be repeated).',
+            action='append')
+    parser['info'].add_argument(
+            '-e', '--global-explorers',
+            help='Display info for global explorers.', action='store_true',
+            default=False)
+    parser['info'].add_argument(
+            '-F', '--fixed-string',
+            help='Interpret pattern as a fixed string.', action='store_true',
+            default=False)
+    parser['info'].add_argument(
+            '-f', '--full', help='Display full details.',
+            action='store_true', default=False)
+    parser['info'].add_argument(
+           '-g', '--config-file',
+           help='Use specified custom configuration file.',
+           dest="config_file", required=False)
+    parser['info'].add_argument(
+            '-t', '--types', help='Display info for types.',
+            action='store_true', default=False)
+    parser['info'].add_argument(
+            'pattern', nargs='?', help='Glob pattern.')
+    parser['info'].set_defaults(func=cdist.info.Info.commandline)
+
     for p in parser:
         parser[p].epilog = EPILOG
 

cdist/conf/type/__acl/gencode-remote

@@ -28,7 +28,10 @@ acl_path="/$__object_id"
 
 acl_is="$( cat "$__object/explorer/acl_is" )"
 
-if [ -f "$__object/parameter/acl" ]
+if [ -f "$__object/parameter/entry" ]
+then
+    acl_should="$( cat "$__object/parameter/entry" )"
+elif [ -f "$__object/parameter/acl" ]
 then
     acl_should="$( cat "$__object/parameter/acl" )"
 elif

cdist/conf/type/__acl/man.rst

@@ -15,7 +15,7 @@ See ``setfacl`` and ``acl`` manpages for more details.
 
 REQUIRED MULTIPLE PARAMETERS
 ----------------------------
-acl
+entry
    Set ACL entry following ``getfacl`` output syntax.
 
 
@@ -36,8 +36,8 @@ remove
 
 DEPRECATED PARAMETERS
 ---------------------
-Parameters ``user``, ``group``, ``mask`` and ``other`` are deprecated and they
+Parameters ``acl``, ``user``, ``group``, ``mask`` and ``other`` are deprecated and they
-will be removed in future versions. Please use ``acl`` parameter instead.
+will be removed in future versions. Please use ``entry`` parameter instead.
 
 
 EXAMPLES
@@ -49,27 +49,27 @@ EXAMPLES
         --default \
         --recursive \
         --remove \
-        --acl user:alice:rwx \
+        --entry user:alice:rwx \
-        --acl user:bob:r-x \
+        --entry user:bob:r-x \
-        --acl group:project-group:rwx \
+        --entry group:project-group:rwx \
-        --acl group:some-other-group:r-x \
+        --entry group:some-other-group:r-x \
-        --acl mask::r-x \
+        --entry mask::r-x \
-        --acl other::r-x
+        --entry other::r-x
 
     # give Alice read-only access to subdir,
     # but don't allow her to see parent content.
 
     __acl /srv/project2 \
         --remove \
-        --acl default:group:secret-project:rwx \
+        --entry default:group:secret-project:rwx \
-        --acl group:secret-project:rwx \
+        --entry group:secret-project:rwx \
-        --acl user:alice:--x
+        --entry user:alice:--x
 
     __acl /srv/project2/subdir \
         --default \
         --remove \
-        --acl group:secret-project:rwx \
+        --entry group:secret-project:rwx \
-        --acl user:alice:r-x
+        --entry user:alice:r-x
 
 
 AUTHORS

cdist/conf/type/__acl/parameter/deprecated/acl

@@ -0,0 +1 @@
+see manual for details

cdist/conf/type/__acl/parameter/optional_multiple

@@ -1,3 +1,4 @@
+entry
 acl
 user
 group

cdist/conf/type/__consul_agent/manifest

@@ -181,7 +181,7 @@ init_upstart()
 
 # Install init script to start on boot
 case "$os" in
-    alpine|devuan)
+    devuan)
         init_sysvinit debian
         ;;
     centos|redhat)

cdist/conf/type/__install_chroot_umount/manifest

@@ -0,0 +1 @@
+../__chroot_umount/manifest

cdist/conf/type/__install_directory/man.rst

@@ -1 +0,0 @@
-../__directory/man.rst

cdist/conf/type/__install_directory/man.rst

@@ -0,0 +1,101 @@
+cdist-type__install_directory(7)
+================================
+
+NAME
+----
+cdist-type__install_directory - Manage a directory with install command
+
+
+DESCRIPTION
+-----------
+This cdist type allows you to create or remove directories on the target.
+
+
+REQUIRED PARAMETERS
+-------------------
+None.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+   'present' or 'absent', defaults to 'present'
+
+group
+   Group to chgrp to.
+
+mode
+   Unix permissions, suitable for chmod.
+
+owner
+   User to chown to.
+
+
+BOOLEAN PARAMETERS
+------------------
+parents
+   Whether to create parents as well (mkdir -p behaviour).
+   Warning: all intermediate directory permissions default
+   to whatever mkdir -p does. 
+
+   Usually this means root:root, 0700.
+
+recursive
+   If supplied the chgrp and chown call will run recursively.
+   This does *not* influence the behaviour of chmod.
+
+MESSAGES
+--------
+chgrp <group>
+    Changed group membership
+chown <owner>
+    Changed owner
+chmod <mode>
+    Changed mode
+create
+    Empty directory was created
+remove
+    Directory exists, but state is absent, directory will be removed by generated code.
+remove non directory
+    Something other than a directory with the same name exists and was removed prior to create.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # A silly example
+    __install_directory /tmp/foobar
+
+    # Remove a directory
+    __install_directory /tmp/foobar --state absent
+
+    # Ensure /etc exists correctly
+    __install_directory /etc --owner root --group root --mode 0755
+
+    # Create nfs service directory, including parents
+    __install_directory /home/services/nfs --parents
+
+    # Change permissions recursively
+    __install_directory /home/services --recursive --owner root --group root
+
+    # Setup a temp directory
+    __install_directory /local --mode 1777
+
+    # Take it all
+    __install_directory /home/services/kvm --recursive --parents \
+        --owner root --group root --mode 0755 --state present
+
+
+AUTHORS
+-------
+Nico Schottelius <nico-cdist--@--schottelius.org>
+
+
+COPYING
+-------
+Copyright \(C) 2011 Nico Schottelius. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.

cdist/conf/type/__install_file/man.rst

@@ -23,6 +23,10 @@ symlink
 directory
   replace it with the source file
 
+One exception is that when state is pre-exists, an error is raised if
+the file would have been created otherwise (e.g. it is not present or
+not a regular file).
+
 In any case, make sure that the file attributes are as specified.
 
 
@@ -33,7 +37,7 @@ None.
 OPTIONAL PARAMETERS
 -------------------
 state
-   'present', 'absent' or 'exists', defaults to 'present' where:
+   'present', 'absent', 'exists' or 'pre-exists', defaults to 'present' where:
 
    present
       the file is exactly the one from source
@@ -41,6 +45,9 @@ state
       the file does not exist
    exists
       the file from source but only if it doesn't already exist
+   pre-exists
+      check that the file exists and is a regular file, but do not
+      create or modify it
 
 group
    Group to chgrp to.
@@ -56,6 +63,9 @@ source
    If not supplied, an empty file or directory will be created.
    If source is '-' (dash), take what was written to stdin as the file content.
 
+onchange
+   The code to run if file is modified.
+
 MESSAGES
 --------
 chgrp <group>
@@ -93,6 +103,8 @@ EXAMPLES
     __install_file /home/frodo/.bashrc --source "/etc/skel/.bashrc" \
        --state exists \
        --owner frodo --mode 0600
+    # Check that the file is present, show an error when it is not
+    __install_file /etc/somefile --state pre-exists
     # Take file content from stdin
     __install_file /tmp/whatever --owner root --group root --mode 644 --source - << DONE
         Here goes the content for /tmp/whatever

cdist/conf/type/__mysql_database/explorer/state

@@ -0,0 +1,33 @@
+#!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
+fi
+
+if [ -n "$( mysql -B -N -e "show databases like '$name'" )" ]
+then
+    echo 'present'
+else
+    echo 'absent'
+fi

cdist/conf/type/__mysql_database/gencode-remote

@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# 2012 Benedikt Koeppel (code@benediktkoeppel.ch)
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
 #
 # This file is part of cdist.
 #
@@ -17,38 +17,30 @@
 # You should have received a copy of the GNU General Public License
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
-#
 
-# if --database was specified
+state_is="$( cat "$__object/explorer/state" )"
-if [ -f "$__object/parameter/name" ]; then
+
-   database="$(cat "$__object/parameter/name")"
+state_should="$( cat "$__object/parameter/state" )"
-else # otherwise use the object id as database name
+
-   database="$__object_id"
+if [ "$state_is" = "$state_should" ]
+then
+    exit 0
 fi
 
-cat <<-EOFF
+if [ -f "$__object/parameter/name" ]
-mysql -u root <<-EOF
+then
-	CREATE DATABASE IF NOT EXISTS $database
+    name="$( cat "$__object/parameter/name" )"
-EOF
+else
-EOFF
+    name="$__object_id"
-
-# if --user was specified
-if [ -f "$__object/parameter/user" ]; then
-   user="$(cat "$__object/parameter/user")"
-
-   # if --password was specified
-   if [ -f "$__object/parameter/password" ]; then
-      password="$(cat "$__object/parameter/password")"
-      cat <<-EOFF
-      mysql -u root <<-EOF
-      	GRANT ALL PRIVILEGES ON $database.* to '$user'@'localhost' IDENTIFIED BY '$password';
-EOF
-EOFF
-   else
-      cat <<-EOFF
-      mysql -u root <<-EOF
-      	GRANT ALL PRIVILEGES ON $database.* to '$user'@'localhost';
-EOF
-EOFF
-   fi
 fi
+
+case "$state_should" in
+    present)
+        echo "mysql -e 'create database \`$name\`'"
+        echo "create database $name" >> "$__messages_out"
+    ;;
+    absent)
+        echo "mysql -e 'drop database \`$name\`'"
+        echo "drop database $name" >> "$__messages_out"
+    ;;
+esac

cdist/conf/type/__mysql_database/man.rst

@@ -8,24 +8,24 @@ cdist-type__mysql_database - Manage a MySQL database
 
 DESCRIPTION
 -----------
-This cdist type allows you to install a MySQL database.
 
+Create MySQL database and optionally user with all privileges.
 
-REQUIRED PARAMETERS
--------------------
-None.
 
 OPTIONAL PARAMETERS
 -------------------
 name
-   The name of the database to install
+   Name of database. Defaults to object id.
-   defaults to the object id
 
 user
-   A user that should have access to the database
+   Create user and give all privileges to database.
 
 password
-   The password for the user who manages the database
+   Password for user.
+
+state
+   Defaults to present.
+   If absent and user is also set, both will be removed (with privileges).
 
 
 EXAMPLES
@@ -33,17 +33,23 @@ EXAMPLES
 
 .. code-block:: sh
 
-    __mysql_database "cdist" --name "cdist" --user "myuser" --password "mypwd"
+    # just create database
+    __mysql_database foo
+
+    # create database with respective user with all privileges to database
+    __mysql_database bar \
+        --user name \
+        --password secret
 
 
 AUTHORS
 -------
-Benedikt Koeppel <code@benediktkoeppel.ch>
+Ander Punnar <ander-at-kvlt-dot-ee>
 
 
 COPYING
 -------
-Copyright \(C) 2012 Benedikt Koeppel. You can redistribute it
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
-and/or modify it under the terms of the GNU General Public License as
+under the terms of the GNU General Public License as published by the Free
-published by the Free Software Foundation, either version 3 of the
+Software Foundation, either version 3 of the License, or (at your option) any
-License, or (at your option) any later version.
+later version.

cdist/conf/type/__mysql_database/manifest

@@ -0,0 +1,52 @@
+#!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+if [ -f "$__object/parameter/user" ]
+then
+    user="$( cat "$__object/parameter/user" )"
+fi
+
+if [ -f "$__object/parameter/password" ]
+then
+    password="$( cat "$__object/parameter/password" )"
+fi
+
+if [ -n "$user" ] && [ -n "$password" ]
+then
+    if [ -f "$__object/parameter/name" ]
+    then
+        database="$( cat "$__object/parameter/name" )"
+    else
+        database="$__object_id"
+    fi
+
+    state_should="$( cat "$__object/parameter/state" )"
+
+    __mysql_user "$user" \
+        --password "$password" \
+        --state "$state_should"
+
+    # removing user should remove all user's privileges
+    require="__mysql_user/$user" \
+        __mysql_privileges "$database/$user" \
+            --database "$database" \
+            --user "$user" \
+            --state "$state_should"
+fi

cdist/conf/type/__mysql_database/parameter/default/state

@@ -0,0 +1 @@
+present

cdist/conf/type/__mysql_database/parameter/optional

@@ -1,3 +1,4 @@
 name
 user
 password
+state

cdist/conf/type/__mysql_privileges/explorer/state

@@ -0,0 +1,40 @@
+#!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+privileges="$( cat "$__object/parameter/privileges" )"
+
+database="$( cat "$__object/parameter/database" )"
+
+table="$( cat "$__object/parameter/table" )"
+
+user="$( cat "$__object/parameter/user" )"
+
+host="$( cat "$__object/parameter/host" )"
+
+check_privileges="$( 
+    mysql -B -N -e "show grants for '$user'@'$host'" \
+        | grep -Ei "^grant $privileges on .$database.\..$table. to " || true )"
+
+if [ -n "$check_privileges" ]
+then
+    echo 'present'
+else
+    echo 'absent'
+fi

cdist/conf/type/__mysql_privileges/gencode-remote

@@ -0,0 +1,49 @@
+#!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+state_is="$( cat "$__object/explorer/state" )"
+
+state_should="$( cat "$__object/parameter/state" )"
+
+if [ "$state_is" = "$state_should" ]
+then
+    exit 0
+fi
+
+privileges="$( cat "$__object/parameter/privileges" )"
+
+database="$( cat "$__object/parameter/database" )"
+
+table="$( cat "$__object/parameter/table" )"
+
+user="$( cat "$__object/parameter/user" )"
+
+host="$( cat "$__object/parameter/host" )"
+
+case "$state_should" in
+    present)
+        echo "mysql -e 'grant $privileges on \`$database\`.\`$table\` to \`$user\`@\`$host\`'"
+        echo "grant $privileges on $database.$table to $user@$host" >> "$__messages_out"
+    ;;
+    absent)
+        echo "mysql -e 'revoke $privileges on \`$database\`.\`$table\` from \`$user\`@\`$host\`'"
+        echo "revoke $privileges on $database.$table from $user@$host" >> "$__messages_out"
+    ;;
+esac

cdist/conf/type/__mysql_privileges/man.rst

@@ -0,0 +1,57 @@
+cdist-type__mysql_privileges(7)
+===============================
+
+NAME
+----
+cdist-type__mysql_privileges - Manage MySQL privileges
+
+
+DESCRIPTION
+-----------
+
+Grant and revoke privileges of MySQL user.
+
+
+REQUIRED PARAMETERS
+-------------------
+database
+   Name of database.
+
+User
+   Name of user.
+
+
+OPTIONAL PARAMETERS
+-------------------
+privileges
+   Defaults to "all".
+
+table
+   Defaults to "*".
+
+host
+   Defaults to localhost.
+
+state
+   "present" grants and "absent" revokes. Defaults to present.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __mysql_privileges user-to-db --database db --user user
+
+
+AUTHORS
+-------
+Ander Punnar <ander-at-kvlt-dot-ee>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.

cdist/conf/type/__mysql_privileges/parameter/default/host

@@ -0,0 +1 @@
+localhost

cdist/conf/type/__mysql_privileges/parameter/default/privileges

@@ -0,0 +1 @@
+all privileges

cdist/conf/type/__mysql_privileges/parameter/default/state

@@ -0,0 +1 @@
+present

cdist/conf/type/__mysql_privileges/parameter/default/table

@@ -0,0 +1 @@
+*

cdist/conf/type/__mysql_privileges/parameter/optional

@@ -0,0 +1,4 @@
+privileges
+table
+host
+state

cdist/conf/type/__mysql_privileges/parameter/required

@@ -0,0 +1,2 @@
+database
+user

cdist/conf/type/__mysql_user/explorer/state

@@ -0,0 +1,54 @@
+#!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
+fi
+
+if [ -f "$__object/parameter/password" ]
+then
+    password="$( cat "$__object/parameter/password" )"
+else
+    password=''
+fi
+
+host="$( cat "$__object/parameter/host" )"
+
+check_user="$( mysql -B -N -e "select user from mysql.user where user = '$name' and host = '$host'" )"
+
+if [ -n "$check_user" ]
+then
+    if [ -n "$password" ]
+    then
+        check_password="$( mysql -B -N -e "select user from mysql.user where user = '$name' and host = '$host' and password = password( '$password' )" )"
+    fi
+
+    if [ -n "$password" ] && [ -z "$check_password" ]
+    then
+        echo 'change-password'
+    else
+        echo 'present'
+    fi
+else
+    echo 'absent'
+fi

cdist/conf/type/__mysql_user/gencode-remote

@@ -0,0 +1,68 @@
+#!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+state_is="$( cat "$__object/explorer/state" )"
+
+state_should="$( cat "$__object/parameter/state" )"
+
+if [ "$state_is" = "$state_should" ]
+then
+    exit 0
+fi
+
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
+fi
+
+host="$( cat "$__object/parameter/host" )"
+
+if [ -f "$__object/parameter/password" ]
+then
+    password="$( cat "$__object/parameter/password" )"
+else
+    if [ "$state_should" = 'present' ]
+    then
+        echo '--password needed' >&2
+        exit 1
+    else
+        password=''
+    fi
+fi
+
+if [ "$state_is" = 'absent' ] && [ "$state_should" = 'present' ]
+then
+    echo "mysql -e 'create user \`$name\`@\`$host\` identified by \"$password\"'"
+    echo "create user $name@$host" >> "$__messages_out"
+
+elif [ "$state_is" != 'absent' ] && [ "$state_should" = 'absent' ]
+then
+    echo "mysql -e 'drop user \`$name\`@\`$host\`'"
+    echo "drop user $name@$host" >> "$__messages_out"
+
+elif [ "$state_is" = 'change-password' ]
+then
+    # this only works with MySQL 5.7.6 and later or MariaDB 10.1.20 and later
+    echo "mysql -e 'alter user \`$name\`@\`$host\` identified by \"$password\"'"
+    echo "mysql -e 'flush privileges'"
+    echo "change password $name@$host" >> "$__messages_out"
+fi

cdist/conf/type/__mysql_user/man.rst

@@ -0,0 +1,48 @@
+cdist-type__mysql_user(7)
+=========================
+
+NAME
+----
+cdist-type__mysql_user - Manage a MySQL user
+
+
+DESCRIPTION
+-----------
+
+Create MySQL user or change password for the user.
+
+
+OPTIONAL PARAMETERS
+-------------------
+name
+   Name of user. Defaults to object id.
+
+host
+   Host of user. Defaults to localhost.
+
+password
+   Password of user.
+
+state
+   Defaults to present.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __mysql_user user --password secret
+
+
+AUTHORS
+-------
+Ander Punnar <ander-at-kvlt-dot-ee>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.

cdist/conf/type/__mysql_user/parameter/default/host

@@ -0,0 +1 @@
+localhost

cdist/conf/type/__mysql_user/parameter/default/state

@@ -0,0 +1 @@
+present

cdist/conf/type/__mysql_user/parameter/optional

@@ -0,0 +1,4 @@
+name
+host
+password
+state

cdist/conf/type/__openldap_server/gencode-remote

@@ -0,0 +1,44 @@
+#!/bin/sh
+
+manager_dn=$(cat "${__object}/parameter/manager-dn")
+manager_password=$(cat "${__object}/parameter/manager-password")
+description=$(cat "${__object}/parameter/description")
+suffix=$(cat "${__object}/parameter/suffix")
+suffix_dc=$(printf "%s" "${suffix}" | awk -F',' '{print $1}' | awk -F'=' '{print $2}')
+
+SLAPD_IPC=$(tr '\n' ' ' < "${__object}/parameter/slapd-url" | awk '{ print $1}')
+
+cat <<DONE # | tee /dev/stderr
+# Restart service
+service slapd restart
+# It can sometimes take a tiny bit to bind
+sleep 1
+# Create or update base object
+if ldapsearch -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' -b '${suffix}' -s base 2>&1 > /dev/null; then
+    # Already exists, use ldapmodify
+    ldapmodify -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' <<EOF
+dn: ${suffix}
+changetype: modify
+replace: objectClass
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+-
+replace: o
+o: ${description}
+-
+replace: dc
+dc: ${suffix_dc}
+EOF
+else
+    # Does not exist, use ldapadd
+    ldapadd -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' <<EOF
+dn: ${suffix}
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+o: ${description}
+dc: ${suffix_dc}
+EOF
+fi
+DONE

cdist/conf/type/__openldap_server/man.rst

@@ -0,0 +1,212 @@
+cdist-type__openldap_server(7)
+==============================
+
+NAME
+----
+cdist-type__openldap_server - Setup an openldap(4) server instance
+
+
+DESCRIPTION
+-----------
+This type can be used to bootstrap an LDAP environment using openldap as slapd.
+
+It bootstraps the LDAP server with sane defaults and creates and manages the
+base DN defined by `suffix`.
+
+
+REQUIRED PARAMETERS
+-------------------
+manager-dn
+    The rootdn to set up in the directory.
+    E.g. `cn=manager,dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+manager-password
+    The password for `manager-dn` in the directory.
+    This will be used to connect to the LDAP server on the first `slapd-url`
+    with the given `manager-dn`.
+
+manager-password-hash
+    The password for `manager-dn` in the directory.
+    This should be valid for `slapd.conf` like `{SSHA}qV+mCs3u8Q2sCmUXT4Ybw7MebHTASMyr`.
+    Generate e.g. with: `slappasswd -s weneedgoodsecurity`.
+    See `slappasswd(8C)`, `slapd.conf(5)`.
+    TODO: implement this: http://blog.adamsbros.org/2015/06/09/openldap-ssha-salted-hashes-by-hand/
+      to derive from the manager-password parameter and ensure idempotency (care with salts).
+      At that point, manager-password-hash should be deprecated and ignored.
+
+serverid
+    The server for the directory.
+    E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+suffix
+    The suffix for the directory.
+    E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+
+REQUIRED MULTIPLE PARAMETERS
+----------------------------
+slapd-url
+    A URL for slapd to listen on.
+    Pass once for each URL you want to support,
+    e.g.: `--slapd-url ldaps://my.fqdn/ --slapd-url ldap://my.fqdn/`.
+    The first instance that is passed will be used as the main URL to
+    connect to this LDAP server
+    See the `-h` flag in `slapd(8C)`.
+
+
+OPTIONAL PARAMETERS
+-------------------
+syncrepl-credentials
+    Only has an effect if `replicate` is set; required in that case.
+    This secret is shared amongst the hosts that will replicate the directory.
+    Note that each replication server needs this secret and it is saved in
+    plain text in the directory.
+
+syncrepl-searchbase
+    Only has an effect if `replicate` is set; required in that case.
+    The searchbase to use for replication.
+    E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+admin-email
+    Passed to `cdist-type__letsencrypt_cert`; has otherwise no use.
+    Required if using `__letsencrypt_cert`.
+    Where to send Let's Encrypt emails like "certificate needs renewal".
+
+tls-cipher-suite
+    Setting for TLSCipherSuite.
+    Defaults to `NORMAL` in a Debian-like OS and `HIGH:MEDIUM:+SSLv2` on FreeBSD.
+    See `slapd.conf(5)`.
+
+tls-cert
+    If defined, `__letsencrypt_cert` is not used and this must be the path in
+    the remote hosts to the PEM-encoded TLS certificate.
+    Requires: `tls-privkey` and `tls-ca`.
+    Permissions, existence and renewal of these files are left up to the
+    type's user.
+
+tls-privkey
+    Required if `tls-cert` is defined.
+    Path in the remote hosts to the PEM-encoded private key file.
+
+tls-ca
+    Required if `tls-cert` is defined.
+    Path in the remote hosts to the PEM-encoded CA certificate file.
+
+
+OPTIONAL MULTIPLE PARAMETERS
+----------------------------
+syncrepl-host
+    Only has an effect if `replicate` is set; required in that case.
+    Set once per host that will replicate the directory.
+
+module
+    LDAP module to load. See `slapd.conf(5)`.
+    Default value is OS-dependent, see manifest.
+
+schema
+    Name of LDAP schema to load. Must be the name without extension of a
+    `.schema` file in slapd's schema directory (usually `/etc/slapd/schema` or
+    `/usr/local/etc/openldap/schema`).
+    Example value: `inetorgperson`
+    The type user must ensure that the schema file is deployed.
+    This defaults to a sensible subset, for details see the type definition.
+
+description
+    The description of the base DN passed in the `suffix` parameter.
+    Defaults to `Managed by cdist, do not edit manually.`
+
+
+BOOLEAN PARAMETERS
+------------------
+staging
+    Passed to `cdist-type__letsencrypt_cert`; has otherwise no use.
+    Obtain a test certificate from a staging server.
+
+replicate
+    Whether to setup replication or not.
+    If present `syncrepl-credentials` and `syncrepl-host` are also required.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # Example of a simple server with manual certificate management.
+    pki_prefix="/usr/local/etc/pki/realms/ldap.camilion.cloud"
+    __openldap_server \
+        --manager-dn 'cn=manager,dc=camilion,dc=cloud' \
+        --manager-password "foo" \
+        --manager-password-hash '{SSHA}foo' \
+        --serverid 0 \
+        --suffix 'dc=camilion,dc=cloud' \
+        --slapd-url 'ldaps://ldap.camilion.cloud' \
+        --tls-cert "${pki_prefix}/default.crt" \
+        --tls-privkey "${pki_prefix}/default.key" \
+        --tls-ca "${pki_prefix}/CA.crt"
+
+    # The created basedn looks as follows:
+    #
+    # dn: dc=camilion,dc=cloud
+    # objectClass: top
+    # objectClass: dcObject
+    # objectClass: organization
+    # o: Managed by cdist, do not edit manually.
+    # dc: camilion
+    #
+    # Do not change it manually, the type will overwrite your changes.
+
+
+    #
+    # Changing to a replicated setup is a simple change to something like:
+    #
+    # Example for multiple servers with replication and automatic
+    # Let's Encrypt certificate management through certbot.
+    id=1
+    for host in ldap-test1.ungleich.ch ldap-test2.ungleich.ch; do
+        echo "__ungleich_ldap \
+            --manager-dn 'cn=manager,dc=ungleich,dc=ch' \
+            --manager-psasword 'foo' \
+            --manager-password-hash '{SSHA}fooo' \
+            --serverid '${id}' \
+            --suffix 'dc=ungleich,dc=ch' \
+            --slapd-url ldap://${host} \
+            --searchbase 'dc=ungleich,dc=ch' \
+            --syncrepl-credentials 'fooo' \
+            --syncrepl-host 'ldap-test1.ungleich.ch' \
+            --syncrepl-host 'ldap-test2.ungleich.ch' \
+            --description 'Ungleich LDAP server'" \
+            --staging \
+            | cdist config -i - -v ${host}
+        id=$((id + 1))
+    done
+
+    # The created basedn looks as follows:
+    #
+    # dn: dc=ungleich,dc=ch
+    # objectClass: top
+    # objectClass: dcObject
+    # objectClass: organization
+    # o: Ungleich LDAP server
+    # dc: ungleich
+    #
+    # Do not change it manually, the type will overwrite your changes.
+
+
+SEE ALSO
+--------
+:strong:`cdist-type__letsencrypt_cert`\ (7)
+
+
+AUTHORS
+-------
+ungleich <foss--@--ungleich.ch>
+Evilham <contact--@--evilham.com>
+
+
+COPYING
+-------
+Copyright \(C) 2020 ungleich glarus ag. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.

cdist/conf/type/__openldap_server/manifest

@@ -0,0 +1,263 @@
+#!/bin/sh
+
+name="${__target_host}"
+manager_dn=$(cat "${__object}/parameter/manager-dn")
+manager_password_hash=$(cat "${__object}/parameter/manager-password-hash")
+serverid=$(cat "${__object}/parameter/serverid")
+suffix=$(cat "${__object}/parameter/suffix")
+slapd_modules=$(cat "${__object}/parameter/module" 2>/dev/null || true)
+schemas=$(cat "${__object}/parameter/schema")
+slapd_urls=$(tr '\n' ' ' < "${__object}/parameter/slapd-url")
+tls_cipher_suite=$(cat "${__object}/parameter/tls-cipher-suite" 2>/dev/null || true)
+
+
+os="$(cat "${__global}/explorer/os")"
+
+# Setup OS-dependent vars
+CONF_OWNER="root"
+CONF_GROUP="root"
+case "${os}" in
+    freebsd)
+        PKGS="openldap-server"
+        ETC="/usr/local/etc"
+        SLAPD_DIR="/usr/local/etc/openldap"
+        SLAPD_DATA_DIR="/var/db/openldap-data"
+        SLAPD_RUN_DIR="/var/run/openldap"
+        SLAPD_MODULE_PATH="/usr/local/libexec/openldap"
+        if [ -z "${slapd_modules}" ]; then
+            # It looks like ppolicy and syncprov must be compiled
+            slapd_modules="back_mdb back_monitor"
+        fi
+        CONF_OWNER="ldap"
+        CONF_GROUP="ldap"
+        if [ -z "${tls_cipher_suite}" ]; then
+            # TODO: research default for FreeBSD. 'NORMAL' appears to not work
+            tls_cipher_suite="HIGH:MEDIUM:+SSLv2"
+        fi
+        ;;
+    debian|ubuntu|devuan)
+        PKGS="slapd ldap-utils"
+        ETC="/etc"
+        SLAPD_DIR="/etc/ldap"
+        SLAPD_DATA_DIR="/var/lib/ldap"
+        SLAPD_RUN_DIR="/var/run/slapd"
+        SLAPD_MODULE_PATH="/usr/lib/ldap"
+        if [ -z "${slapd_modules}" ]; then
+            slapd_modules="back_mdb ppolicy syncprov back_monitor"
+        fi
+        if [ -z "${tls_cipher_suite}" ]; then
+            tls_cipher_suite="NORMAL"
+        fi
+        ;;
+    *)
+        echo "Don't know the openldap defaults for: $os" >&2
+        exit 1
+        ;;
+esac
+
+PKG_MAIN=$(echo "${PKGS}" | awk '{print $1;}')
+
+
+# Determine if __letsencrypt_cert is to be used and setup vars accordingly
+if [ -f "${__object}/parameter/tls-cert" ]; then
+    tls_cert=$(cat "${__object}/parameter/tls-cert")
+
+    if [ ! -f "${__object}/parameter/tls-privkey" ]; then
+        echo "When tls-cert is defined, tls-privkey is also required." >&2
+        exit 1
+    fi
+    tls_privkey=$(cat "${__object}/parameter/tls-privkey")
+
+    if [ ! -f "${__object}/parameter/tls-ca" ]; then
+        echo "When tls-cert is defined, tls-ca is also required." >&2
+        exit 1
+    fi
+    tls_ca=$(cat "${__object}/parameter/tls-ca")
+
+    _skip_letsencrypt_cert="YES"
+else
+    if [ ! -f "${__object}/parameter/admin-email" ]; then
+        echo "When using __letsencrypt_cert, admin-email is also required." >&2
+        exit 1
+    fi
+    admin_email=$(cat "${__object}/parameter/admin-email")
+
+    tls_cert="${SLAPD_DIR}/sasl2/cert.pem"
+    tls_privkey="${SLAPD_DIR}/sasl2/privkey.pem"
+    tls_ca="${SLAPD_DIR}/sasl2/chain.pem"
+fi
+
+mkdir "${__object}/files"
+ldapconf="${__object}/files/ldapconf"
+
+replication=""
+if [ -f "${__object}/parameter/replicate" ]; then
+    replication=yes
+
+    if [ ! -f "${__object}/parameter/syncrepl-searchbase" ]; then
+        echo "Requiring the searchbase for replication" >&2
+        exit 1
+    fi
+    syncrepl_searchbase=$(cat "${__object}/parameter/syncrepl-searchbase")
+
+    if [ ! -f "${__object}/parameter/syncrepl-credentials" ]; then
+        echo "Requiring credentials for replication" >&2
+        exit 1
+    fi
+
+    syncrepl_credentials=$(cat "${__object}/parameter/syncrepl-credentials")
+
+    if [ ! -f "${__object}/parameter/syncrepl-host" ]; then
+        echo "Requiring host(s) for replication" >&2
+        exit 1
+    fi
+    syncrepl_hosts=$(cat "${__object}/parameter/syncrepl-host")
+
+fi
+
+# Install required packages
+for pkg in ${PKGS}; do
+    __package "${pkg}"
+done
+
+
+require="__package/${PKG_MAIN}" __start_on_boot slapd
+
+# Setup -h flag for the listeners. See man slapd (-h flag).
+case "${os}" in
+    freebsd)
+        require="__start_on_boot/slapd" __key_value \
+               --file "/etc/rc.conf" \
+               --key "slapd_flags" \
+               --value "\"-h '${slapd_urls}'\"" \
+               --delimiter "=" \
+               --comment "# LDAP Listener URLs" \
+               "${__target_host}__slapd_flags"
+        ;;
+    debian|ubuntu|devuan)
+        require="__package/${PKG_MAIN}" __line rm_slapd_conf \
+               --file ${ETC}/default/slapd \
+               --regex 'SLAPD_CONF=.*' \
+               --state absent
+
+        require="__package/${PKG_MAIN}" __line rm_slapd_services \
+               --file ${ETC}/default/slapd \
+               --regex 'SLAPD_SERVICES=.*' \
+               --state absent
+
+        require="__line/rm_slapd_conf" __line add_slapd_conf \
+               --file ${ETC}/default/slapd \
+               --line "SLAPD_CONF=${SLAPD_DIR}/slapd.conf" \
+               --state present
+
+        require="__line/rm_slapd_services" __line add_slapd_services \
+               --file ${ETC}/default/slapd \
+               --line "SLAPD_SERVICES=\"${slapd_urls}\"" \
+               --state present
+        ;;
+    *)
+        # Nothing to do here, move on.
+        ;;
+esac
+
+
+if [ -z "${_skip_letsencrypt_cert}" ]; then
+    if [ -f "${__object}/parameter/staging" ]; then
+        staging="--staging"
+    else
+        staging=""
+    fi
+
+    __letsencrypt_cert "${name}" --admin-email "${admin_email}" \
+        --renew-hook "cp ${ETC}/letsencrypt/live/${name}/*.pem ${SLAPD_DIR}/sasl2 && chown -R openldap:openldap ${SLAPD_DIR}/sasl2 && service slapd restart" \
+        --automatic-renewal ${staging}
+fi
+
+require="__package/${PKG_MAIN}" __directory ${SLAPD_DIR}/slapd.d --state absent
+
+if [ -z "${_skip_letsencrypt_cert}" ]; then
+    require="__package/${PKG_MAIN} __letsencrypt_cert/${name}" \
+           __file ${SLAPD_DIR}/slapd.conf --owner ${CONF_OWNER} --group ${CONF_GROUP} --mode 644 \
+           --source "${ldapconf}"
+else
+    require="__package/${PKG_MAIN}" \
+           __file ${SLAPD_DIR}/slapd.conf --owner ${CONF_OWNER} --group ${CONF_GROUP} --mode 644 \
+           --source "${ldapconf}"
+fi
+
+# Start slapd.conf
+cat << EOF > "${ldapconf}"
+pidfile ${SLAPD_RUN_DIR}/slapd.pid
+argsfile ${SLAPD_RUN_DIR}/slapd.args
+
+TLSCipherSuite ${tls_cipher_suite}
+TLSCertificateFile ${tls_cert}
+TLSCertificateKeyFile ${tls_privkey}
+TLSCACertificateFile ${tls_ca}
+
+disallow bind_anon
+require bind
+security tls=1
+EOF
+
+# Add specified schemas
+for schema in ${schemas}; do
+    echo "include ${SLAPD_DIR}/schema/${schema}.schema" >> "${ldapconf}"
+done
+
+# Add specified modules
+echo "modulepath ${SLAPD_MODULE_PATH}" >> "${ldapconf}"
+for module in ${slapd_modules}; do
+    echo "moduleload ${module}.la" >> "${ldapconf}"
+done
+
+# Rest of the config
+cat << EOF >> "${ldapconf}"
+loglevel 1024
+
+database mdb
+maxsize 1073741824
+
+suffix "${suffix}"
+directory ${SLAPD_DATA_DIR}
+rootdn "${manager_dn}"
+rootpw "${manager_password_hash}"
+
+index objectClass eq,pres
+index ou,cn,mail,surname,givenname eq,pres,sub
+index uidNumber,gidNumber,loginShell eq,pres
+index uid,memberUid eq,pres,sub
+index nisMapName,nisMapEntry eq,pres,sub
+index entryCSN,entryUUID eq
+
+serverid ${serverid}
+EOF
+
+# Setup replication
+if [ "${replication}" ]; then
+    rid=1;
+    for syncrepl in ${syncrepl_hosts}; do
+    cat <<EOF >> "${ldapconf}"
+syncrepl rid=${rid}
+ provider=ldap://${syncrepl}
+ bindmethod=simple
+ starttls=yes
+ binddn="${manager_dn}"
+ credentials=${syncrepl_credentials}
+ searchbase="${syncrepl_searchbase}"
+ type=refreshAndPersist
+ retry="5 + 5 +"
+ interval=00:00:00:05
+EOF
+    rid=$((rid + 1))
+    done
+    cat <<EOF >> "${ldapconf}"
+mirrormode true
+overlay syncprov
+syncprov-checkpoint 100 5
+syncprov-sessionlog 100
+
+database monitor
+limits dn.exact="${manager_dn}" time=unlimited size=unlimited
+EOF
+fi

cdist/conf/type/__openldap_server/parameter/boolean

@@ -0,0 +1,2 @@
+staging
+replicate

cdist/conf/type/__openldap_server/parameter/default/description

@@ -0,0 +1 @@
+Managed by cdist, do not edit manually.

cdist/conf/type/__openldap_server/parameter/default/schema

@@ -0,0 +1,12 @@
+corba
+core
+cosine
+duaconf
+dyngroup
+inetorgperson
+java
+misc
+nis
+openldap
+ppolicy
+collective

cdist/conf/type/__openldap_server/parameter/optional

@@ -0,0 +1,8 @@
+description
+syncrepl-credentials
+syncrepl-searchbase
+admin-email
+tls-cipher-suite
+tls-cert
+tls-privkey
+tls-ca

cdist/conf/type/__openldap_server/parameter/optional_multiple

@@ -0,0 +1,3 @@
+syncrepl-host
+module
+schema

cdist/conf/type/__openldap_server/parameter/required

@@ -0,0 +1,5 @@
+manager-dn
+manager-password
+manager-password-hash
+serverid
+suffix

cdist/conf/type/__openldap_server/parameter/required_multiple

@@ -0,0 +1 @@
+slapd-url

cdist/conf/type/__package_update_index/gencode-remote

@@ -47,9 +47,9 @@ case "$type" in
         echo "pacman --noprogressbar --sync --refresh"
         echo "pacman package database synced (age was: $currage)" >> "$__messages_out"
         ;;
-    alpine)
+    apk)
         echo "apk update"
-        echo "apk package database updated."
+        echo "apk package database updated." >>"$__messages_out"
         ;;
     *)
         echo "Don't know how to manage packages for type: $type" >&2

cdist/conf/type/__postgres_database/gencode-remote

@@ -41,12 +41,16 @@ if [ "$state_should" != "$state_is" ]; then
       present)
          owner=""
          if [ -f "$__object/parameter/owner" ]; then
-            owner="-O '$(cat "$__object/parameter/owner")'"
+            owner="-O \"$(cat "$__object/parameter/owner")\""
          fi
-         echo "su - '$postgres_user' -c \"createdb $owner '$name'\""
+         cat << EOF
+su - '$postgres_user' -c "createdb $owner \"$name\""
+EOF
       ;;
       absent)
-         echo "su - '$postgres_user' -c \"dropdb '$name'\""
+         cat << EOF
+su - '$postgres_user' -c "dropdb \"$name\""
+EOF
       ;;
    esac
 fi

cdist/conf/type/__postgres_role/gencode-remote

@@ -53,11 +53,13 @@ case "$state_should" in
         done
 
         [ -n "$password" ] && password="PASSWORD '$password'"
-
+        cat << EOF
-        cmd="CREATE ROLE $name WITH $password $booleans"
+su - '$postgres_user' -c "psql postgres -wc 'CREATE ROLE \"$name\" WITH $password $booleans;'"
-        echo "su - '$postgres_user' -c \"psql postgres -wc \\\"$cmd\\\"\""
+EOF
     ;;
     absent)
-        echo "su - '$postgres_user' -c \"dropuser \\\"$name\\\"\""
+        cat << EOF
+su - '$postgres_user' -c "dropuser \"$name\""
+EOF
     ;;
 esac

cdist/conf/type/__start_on_boot/man.rst

@@ -12,7 +12,7 @@ This cdist type allows you to enable or disable stuff to be started
 at boot of your operating system.
 
 Warning: This type has not been tested intensively and is not fully
-supported (i.e. \*BSD are not implemented).
+supported.
 
 
 REQUIRED PARAMETERS

cdist/exec/local.py

@@ -69,7 +69,6 @@ class Local(object):
 
         self.exec_path = exec_path
         self.custom_initial_manifest = initial_manifest
-        self._add_conf_dirs = add_conf_dirs
         self.cache_path_pattern = cache_path_pattern
         self.quiet_mode = quiet_mode
         if configuration:
@@ -84,16 +83,7 @@ class Local(object):
         self._init_cache_dir(None)
         self._init_paths()
         self._init_object_marker()
-        self._init_conf_dirs()
+        self._init_conf_dirs(add_conf_dirs)
-
-    @property
-    def dist_conf_dir(self):
-        return os.path.abspath(os.path.join(os.path.dirname(cdist.__file__),
-                                            "conf"))
-
-    @property
-    def home_dir(self):
-        return cdist.home_dir()
 
     def _init_log(self):
         self.log = logging.getLogger(self.target_host[0])
@@ -140,28 +130,9 @@ class Local(object):
         # Does not need to be secure - just randomly different from .cdist
         self.object_marker_name = tempfile.mktemp(prefix='.cdist-', dir='')
 
-    def _init_conf_dirs(self):
+    def _init_conf_dirs(self, add_conf_dirs):
-        self.conf_dirs = []
+        self.conf_dirs = util.resolve_conf_dirs(
-
+            self.configuration, add_conf_dirs=add_conf_dirs)
-        self.conf_dirs.append(self.dist_conf_dir)
-
-        # Is the default place for user created explorer, type and manifest
-        if self.home_dir:
-            self.conf_dirs.append(self.home_dir)
-
-        # Add directories defined in the CDIST_PATH environment variable
-        # if 'CDIST_PATH' in os.environ:
-        #     cdist_path_dirs = re.split(r'(?<!\\):', os.environ['CDIST_PATH'])
-        #     cdist_path_dirs.reverse()
-        #     self.conf_dirs.extend(cdist_path_dirs)
-        if 'conf_dir' in self.configuration:
-            conf_dirs = self.configuration['conf_dir']
-            if conf_dirs:
-                self.conf_dirs.extend(conf_dirs)
-
-        # Add command line supplied directories
-        if self._add_conf_dirs:
-            self.conf_dirs.extend(self._add_conf_dirs)
 
     def _init_directories(self):
         self.mkdir(self.conf_path)
@@ -187,10 +158,11 @@ class Local(object):
             self.object_marker_name, self.object_marker_file))
 
     def _init_cache_dir(self, cache_dir):
+        home_dir = cdist.home_dir()
         if cache_dir:
             self.cache_path = cache_dir
-        elif self.home_dir:
+        elif home_dir:
-            self.cache_path = os.path.join(self.home_dir, "cache")
+            self.cache_path = os.path.join(home_dir, "cache")
         else:
             raise cdist.Error(
                 "No homedir setup and no cache dir location given")

cdist/exec/util.py

@@ -24,6 +24,7 @@ import os
 from tempfile import TemporaryFile
 
 import cdist
+import cdist.configuration
 
 
 # IMPORTANT:
@@ -175,3 +176,34 @@ def log_std_fd(log, command, stdfd, prefix):
         stdfd.seek(0, 0)
         log.trace("Command: {}; {}: {}".format(
             command, prefix, stdfd.read().decode()))
+
+
+def dist_conf_dir():
+    return os.path.abspath(os.path.join(os.path.dirname(cdist.__file__),
+                                        "conf"))
+
+
+def resolve_conf_dirs(configuration, add_conf_dirs):
+    conf_dirs = []
+
+    conf_dirs.append(dist_conf_dir())
+
+    home_dir = cdist.home_dir()
+    if home_dir:
+        conf_dirs.append(home_dir)
+
+    if 'conf_dir' in configuration:
+        x = configuration['conf_dir']
+        if x:
+            conf_dirs.extend(x)
+
+    if add_conf_dirs:
+        conf_dirs.extend(add_conf_dirs)
+    conf_dirs = set(conf_dirs)
+    return conf_dirs
+
+
+def resolve_conf_dirs_from_config_and_args(args):
+    cfg = cdist.configuration.Configuration(args)
+    configuration = cfg.get_config(section='GLOBAL')
+    return resolve_conf_dirs(configuration, args.conf_dir)

cdist/info.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# 2019-2020 Darko Poljak (darko.poljak at gmail.com)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import cdist
+import cdist.configuration
+import cdist.core
+import cdist.exec.util as util
+import os
+import glob
+import fnmatch
+
+
+class Info(object):
+
+    def __init__(self, conf_dirs, args):
+        self.conf_dirs = conf_dirs
+        self.all = args.all
+        self.display_global_explorers = args.global_explorers
+        self.display_types = args.types
+        if not self.display_global_explorers and not self.display_types:
+            self.all = True
+        self.fixed_string = args.fixed_string
+        self._setup_glob_pattern(args.pattern)
+        self.full = args.full
+
+    def _setup_glob_pattern(self, pattern):
+        if pattern is None:
+            self.glob_pattern = '*'
+        elif ('?' in pattern or '*' in pattern or '[' in pattern or
+              self.fixed_string):
+            self.glob_pattern = pattern
+        else:
+            self.glob_pattern = '*' + pattern + '*'
+
+    @classmethod
+    def commandline(cls, args):
+        conf_dirs = util.resolve_conf_dirs_from_config_and_args(args)
+        c = cls(conf_dirs, args)
+        c.run()
+
+    def _get_global_explorers(self, conf_path):
+        rv = []
+        global_explorer_path = os.path.join(conf_path, "explorer",
+                                            self.glob_pattern)
+        if self.fixed_string:
+            if os.path.exists(global_explorer_path):
+                rv.append(global_explorer_path)
+        else:
+            for explorer in glob.glob(global_explorer_path):
+                rv.append(explorer)
+        return rv
+
+    def _should_display_type(self, dir_entry):
+        if not dir_entry.is_dir():
+            return False
+        if self.glob_pattern is None:
+            return True
+        if self.fixed_string:
+            return dir_entry.name == self.glob_pattern
+        else:
+            return fnmatch.fnmatch(dir_entry.name, self.glob_pattern)
+
+    def _get_types(self, conf_path):
+        rv = []
+        types_path = os.path.join(conf_path, "type")
+        if not os.path.exists(types_path):
+            return rv
+        with os.scandir(types_path) as it:
+            for entry in it:
+                if self._should_display_type(entry):
+                    rv.append(entry.path)
+        return rv
+
+    def _display_details(self, title, details, default_values=None,
+                         deprecated=None):
+        if not details:
+            return
+        if isinstance(details, bool):
+            print("\t{}: {}".format(title, 'yes' if details else 'no'))
+        elif isinstance(details, str):
+            print("\t{}: {}".format(title, details))
+        elif isinstance(details, list):
+            dv = dict(default_values) if default_values else {}
+            dp = dict(deprecated) if deprecated else {}
+
+            print("\t{}:".format(title))
+            for x in sorted(details):
+                print("\t\t{}".format(x), end='')
+                has_default = x in dv
+                is_deprecated = x in dp
+                need_comma = False
+                if has_default or is_deprecated:
+                    print(" (", end='')
+                if has_default:
+                    print("default: {}".format(dv[x]), end='')
+                    need_comma = True
+                if is_deprecated:
+                    print("{}deprecated".format(', ' if need_comma else ''),
+                          end='')
+                if has_default or is_deprecated:
+                    print(")", end='')
+                print()
+
+    def _display_type_parameters(self, cdist_type):
+        self._display_details("required parameters",
+                              cdist_type.required_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("required multiple parameters",
+                              cdist_type.required_multiple_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("optional parameters",
+                              cdist_type.optional_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("optional multiple parameters",
+                              cdist_type.optional_multiple_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("boolean parameters",
+                              cdist_type.boolean_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+
+    def _display_type_characteristics(self, cdist_type):
+        characteristics = []
+        if cdist_type.is_install:
+            characteristics.append('install')
+        else:
+            characteristics.append('config')
+        if cdist_type.is_singleton:
+            characteristics.append('singleton')
+        if cdist_type.is_nonparallel:
+            characteristics.append('nonparallel')
+        else:
+            characteristics.append('parallel')
+        if cdist_type.deprecated is not None:
+            characteristics.append('deprecated')
+        print("\t{}".format(', '.join(characteristics)))
+
+    def _display_type_details(self, type_path):
+        dirname, basename = os.path.split(type_path)
+        cdist_type = cdist.core.CdistType(dirname, basename)
+
+        self._display_type_characteristics(cdist_type)
+        self._display_type_parameters(cdist_type)
+
+    def run(self):
+        rv = []
+        for cp in self.conf_dirs:
+            conf_path = os.path.expanduser(cp)
+            if self.all or self.display_global_explorers:
+                rv.extend((x, 'E', ) for x in self._get_global_explorers(
+                    conf_path))
+            if self.all or self.display_types:
+                rv.extend((x, 'T', ) for x in self._get_types(conf_path))
+        rv = sorted(rv, key=lambda x: x[0])
+        for x, t in rv:
+            print(x)
+            if self.full and t == 'T':
+                self._display_type_details(x)

cdist/preos.py

@@ -5,6 +5,9 @@ import inspect
 import argparse
 import cdist
 import logging
+import cdist.argparse
+import cdist.configuration
+import cdist.exec.util as util
 
 
 _PREOS_CALL = "commandline"
@@ -12,17 +15,16 @@ _PREOS_NAME = "_preos_name"
 _PREOS_MARKER = "_cdist_preos"
 _PLUGINS_DIR = "preos"
 _PLUGINS_PATH = [os.path.join(os.path.dirname(__file__), _PLUGINS_DIR), ]
-cdist_home = cdist.home_dir()
-if cdist_home:
-    cdist_home_preos = os.path.join(cdist_home, "preos")
-    if os.path.isdir(cdist_home_preos):
-        _PLUGINS_PATH.append(cdist_home_preos)
-sys.path.extend(_PLUGINS_PATH)
-
-
 log = logging.getLogger("PreOS")
 
 
+def extend_plugins_path(dirs):
+    for dir in dirs:
+        preos_dir = os.path.expanduser(os.path.join(dir, "preos"))
+        if os.path.isdir(preos_dir):
+            _PLUGINS_PATH.append(preos_dir)
+
+
 def preos_plugin(obj):
     """It is preos if _PREOS_MARKER is True and has _PREOS_CALL."""
     if hasattr(obj, _PREOS_MARKER):
@@ -71,31 +73,58 @@ def check_root():
         raise cdist.Error("Must be run with root privileges")
 
 
+def get_available_preoses_string(cls):
+    preoses = ['    - {}'.format(x) for x in sorted(set(cls.preoses))]
+    return "Available PreOS-es:\n{}".format("\n".join(preoses))
+
+
 class PreOS(object):
     preoses = None
 
     @classmethod
     def commandline(cls, argv):
+        cdist_parser = cdist.argparse.get_parsers()
+        parser = argparse.ArgumentParser(
+            description="Create PreOS", prog="cdist preos",
+            parents=[cdist_parser['loglevel'], ])
+        parser.add_argument('preos', help='PreOS to create',
+                            nargs='?', default=None)
+        parser.add_argument('-c', '--conf-dir',
+                            help=('Add configuration directory (one that '
+                                  'contains "preos" subdirectory)'),
+                            action='append')
+        parser.add_argument('-g', '--config-file',
+                            help='Use specified custom configuration file.',
+                            dest="config_file", required=False)
+        parser.add_argument('-L', '--list-preoses',
+                            help='List available PreOS-es',
+                            action='store_true', default=False)
+        parser.add_argument('remainder_args', nargs=argparse.REMAINDER)
+        args = parser.parse_args(argv[1:])
+        cdist.argparse.handle_loglevel(args)
+        log.debug("preos args : {}".format(args))
 
-        if not cls.preoses:
+        conf_dirs = util.resolve_conf_dirs_from_config_and_args(args)
+
+        extend_plugins_path(conf_dirs)
+        sys.path.extend(_PLUGINS_PATH)
         cls.preoses = find_preoses()
 
-        parser = argparse.ArgumentParser(
+        if args.list_preoses or not args.preos:
-            description="Create PreOS", prog="cdist preos")
+            print(get_available_preoses_string(cls))
-        parser.add_argument('preos', help='PreOS to create, one of: {}'.format(
+            sys.exit(0)
-            set(cls.preoses)))
-        args = parser.parse_args(argv[1:2])
 
         preos_name = args.preos
         if preos_name in cls.preoses:
             preos = cls.preoses[preos_name]
             func = getattr(preos, _PREOS_CALL)
             if inspect.ismodule(preos):
-                func_args = [preos, argv[2:], ]
+                func_args = [preos, args.remainder_args, ]
             else:
-                func_args = [argv[2:], ]
+                func_args = [args.remainder_args, ]
             log.info("Running preos : {}".format(preos_name))
             func(*func_args)
         else:
-            log.error("Unknown preos: {}, available preoses: {}".format(
+            raise cdist.Error(
-                preos_name, set(cls.preoses.keys())))
+                "Invalid PreOS {}. {}".format(
+                    preos_name, get_available_preoses_string(cls)))

docs/changelog

@@ -1,6 +1,30 @@
 Changelog
 ---------
 
+next:
+	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
+	* Core: preos: Fix missing configuration file usage, support -g, --config-file option (Darko Poljak)
+	* Core info command: Support tilde expansion of conf directories (Darko Poljak)
+
+6.4.0: 2020-01-04
+	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
+	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)
+	* Types __postgres_*: Use double quoted identifiers in generated SQL (Timothée Floure)
+	* Core: Add cdist info command (Darko Poljak)
+	* New types: __mysql_user, __mysql_privileges (Ander Punnar)
+	* Type __mysql_database: Rewrite (Ander Punnar)
+
+6.3.0: 2019-12-12
+	* Type __package_update_index: Fix Alpine part (Dominique Roux)
+	* Documentation: Fix man pages for install types (Darko Poljak)
+	* Documentation: Embed config skeleton instead of rewriting it (Darko Poljak)
+	* Documentation: Remove cdist-type prefix and man page reference from type list in html (Darko Poljak)
+	* Documentation: PreOS english nitpicking (Evil Ham)
+	* Documentation: Add installing from source with signature verification (Darko Poljak)
+	* Core: preos: Support top command logging options, custom conf-dir option and CDIST_PATH env var (Darko Poljak)
+	* Type __start_on_boot: Docs: remove unsupported *BSD claim (Evil Ham)
+	* New type: __openldap_server (Evil Ham)
+
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)
 

docs/src/cdist-configuration.rst

@@ -31,73 +31,11 @@ can be used.
 
 Config file format
 ------------------
+
 cdist configuration file is in the INI file format. Currently it supports
 only [GLOBAL] section.
-The possible keywords and their meanings are as follows:
 
-:strong:`archiving`
+Here you can find configuration file skeleton:
-    Use specified archiving. Valid values include:
-    'none', 'tar', 'tgz', 'tbz2' and 'txz'.
 
-:strong:`beta`
+.. literalinclude:: cdist.cfg.skeleton
-    Enable beta functionality. It recognizes boolean values from
+    :language: ini
-    'yes'/'no', 'on'/'off', 'true'/'false' and '1'/'0'.
-
-:strong:`cache_path_pattern`
-    Specify cache path pattern.
-
-:strong:`conf_dir`
-    List of configuration directories separated with the character conventionally
-    used by the operating system to separate search path components (as in PATH),
-    such as ':' for POSIX or ';' for Windows.
-    If also specified at command line then values from command line are
-    appended to this value.
-
-:strong:`init_manifest`
-    Specify default initial manifest.
-
-:strong:`inventory_dir`
-    Specify inventory directory.
-
-:strong:`jobs`
-    Specify number of jobs for parallel processing. If -1 then the default,
-    number of CPU's in the system is used. If 0 then parallel processing in
-    jobs is disabled. If set to positive number then specified maximum
-    number of processes will be used.
-
-:strong:`local_shell`
-    Shell command used for local execution.
-
-:strong:`out_path`
-    Directory to save cdist output in.
-
-:strong:`parallel`
-    Process hosts in parallel. If -1 then the default, number of CPU's in
-    the system is used. If 0 then parallel processing of hosts is disabled.
-    If set to positive number then specified maximum number of processes
-    will be used.
-
-:strong:`remote_copy`
-    Command to use for remote copy (should behave like scp).
-
-:strong:`remote_exec`
-    Command to use for remote execution (should behave like ssh).
-
-:strong:`remote_out_path`
-    Directory to save cdist output in on the target host.
-
-:strong:`remote_shell`
-    Shell command at remote host used for remote execution.
-
-:strong:`save_output_streams`
-    Enable/disable saving output streams (enabled by default).
-    It recognizes boolean values from 'yes'/'no', 'on'/'off', 'true'/'false'
-    and '1'/'0'.
-
-:strong:`timestamp`
-    Timestamp log messages with the current local date and time
-    in the format: YYYYMMDDHHMMSS.us.
-
-:strong:`verbosity`
-    Set verbosity level. Valid values are: 
-    'ERROR', 'WARNING', 'INFO', 'VERBOSE', 'DEBUG', 'TRACE' and 'OFF'.

docs/src/cdist-install.rst

@@ -23,8 +23,6 @@ Target Hosts
 Install cdist
 -------------
 
-You can install cdist either from git or as a python package.
-
 From git
 ~~~~~~~~
 
@@ -42,6 +40,7 @@ To install cdist, execute the following commands:
 
 From version 4.2.0 cdist tags and releases are signed.
 You can get GPG public key used for signing `here <_static/pgp-key-EFD2AE4EC36B6901.asc>`_.
+It is assumed that you are familiar with *git* ways of signing and verification.
 
 You can also get cdist from `github mirror <https://github.com/ungleich/cdist>`_.
 
@@ -157,3 +156,27 @@ Cdist is available as a python package at
 .. code-block:: sh
 
     pip install cdist
+
+Installing from source with signature verification
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If you want to install cdist from signed source and verify it, first you need to
+download cdist archive and its detached signature.
+
+Get both, *cdist-x.y.z.tar.gz* and *cdist-x.y.z.tar.gz.asc* from release
+notes of the desired tag *x.y.z* at
+`cdist git repository <https://code.ungleich.ch/ungleich-public/cdist/-/tags>`_.
+
+Get GPG public key used for signing `here <_static/pgp-key-EFD2AE4EC36B6901.asc>`_
+and import it into GPG.
+
+Now cdist source archive can be verified using `gpg`, e.g. to verify `cdist-6.2.0`:
+
+.. code-block:: sh
+
+    $ gpg --verify cdist-6.2.0.tar.gz.asc cdist-6.2.0.targ.gz
+    gpg: Signature made Sat Nov 30 23:14:19 2019 CET
+    gpg:                using RSA key 69767822F3ECC3C349C1EFFFEFD2AE4EC36B6901
+    gpg: Good signature from "ungleich GmbH (ungleich FOSS) <foss@ungleich.ch>" [ultimate]
+
+Further steps are the same as for `installing from git <cdist-install.html#from-git>`_.

docs/src/cdist-preos.rst

@@ -4,9 +4,9 @@ PreOS
 Description
 -----------
 With cdist you can install and configure new machines. You can use cdist to
-create PreOS, minimal OS which purpose is to boot new machine.
+create PreOS, minimal OS whose purpose is to boot a new machine.
-After PreOS is booted machine is ready for installing desired OS and
+After PreOS is booted, the machine is ready for installing the desired OS and
-then it is ready for configuration.
+afterwards it is ready for configuration.
 
 PreOS creation
 --------------
@@ -15,62 +15,62 @@ Currently supported PreOS-es include:
 
 * debian
 * ubuntu
-* devuan.
+* devuan
 
-PreOS is created using cdist preos command. preos command has subcommands that
+PreOS is created using the ``cdist preos`` command.
-create the desired PreOS.
+This command has subcommands that determine the desired PreOS.
 
-For example, to create ubuntu PreOS:
+For example, to create an ubuntu PreOS:
 
 .. code-block:: sh
 
     $ cdist preos ubuntu /preos/preos-ubuntu -B -C \
         -k ~/.ssh/id_rsa.pub -p /preos/pxe-ubuntu
 
-For more info about available options see cdist manual page.
+For more info about the available options see the cdist manual page.
 
-This will bootstrap (``-B``) ubuntu PreOS in ``/preos/preos-ubuntu`` directory, it
+This will bootstrap (``-B``) ubuntu PreOS in the ``/preos/preos-ubuntu``
-will be configured (``-C``) using default built-in initial manifest and with
+directory, it will be configured (``-C``) using default the built-in initial
-specified ssh authorized key (``-k``).
+manifest and with specified ssh authorized key (``-k``).
-After bootstrapping and configuration PXE
+After bootstrapping and configuration, the PXE boot directory will be
-boot directory will be created (``-p``) in ``/preos/pxe-ubuntu``.
+created (``-p``) in ``/preos/pxe-ubuntu``.
 
-After PreOS is created new machines can be booted using created PXE (after
+After PreOS is created, new machines can be booted using the created PXE
-proper dhcp, tftp setting).
+(after proper dhcp and tftp settings).
 
-Since PreOS is configured with ssh authorized key it can be accessed throguh
+Since PreOS is configured with ssh authorized key it can be accessed through
 ssh, i.e. it can be further installed and configured with cdist.
 
-Implementing new PreOS sub-command
+Implementing a new PreOS sub-command
-----------------------------------
+------------------------------------
 preos command is implemented as a plugin system. This plugin system scans for
-preos subcommands in ``cdist/preos/`` distribution directory and also in
+preos subcommands in the ``cdist/preos/`` distribution directory and also in
 ``~/.cdist/preos/`` directory if it exists.
 
 preos subcommand is a module or a class that satisfies the following:
 
-* it has attribute ``_cdist_preos`` set to ``True``
+* it has the attribute ``_cdist_preos`` set to ``True``
-* it has function/method ``commandline``.
+* it defines a function/method ``commandline``.
 
-For a module based preos subcommand ``commandline`` function accepts a module
+For a module-based preos subcommand, the ``commandline`` function accepts a
-object as its first argument and the list of command line
+module object as its first argument and the list of command line
 arguments (``sys.argv[2:]``).
 
-For a class preos subcommand ``commandline`` method should be staticmethod and
+For a class-based preos subcommand ``commandline`` method should be
-it accepts a class object as its first argument and the list of command line
+static-method and must accept a class as its first argument and the
-arguments(``sys.argv[2:]``).
+list of command line arguments (``sys.argv[2:]``).
 
 If preos scanning finds a module/class that has ``_cdist_preos`` set
-to ``True`` and it has function/method ``commandline`` then this module/class is
+to ``True`` and a function/method ``commandline`` then this module/class is
 registered to preos subcommands. The name of the command is set to ``_preos_name``
-attribute if it exists, otherwise it is set to the module/class name, lowercase.
+attribute if defined in the module/class, defaulting to the module/class name in lowercase.
-When registered preos subcommand is specified as preos command then ``commandline``
+When a registered preos subcommand is specified, ``commandline``
-will be called with first argument set to module/class object and second argument
+will be called with the first argument set to module/class and the second
-set to ``sys.argv[2:]``.
+argument set to ``sys.argv[2:]``.
 
-Example writing new dummy preos sub-command
+Example of writing new dummy preos sub-command
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-Module based preos:
+Module-based preos:
 ^^^^^^^^^^^^^^^^^^^
 
 #. Create directory ``~/.cdist/preos/`` if it does not exist
@@ -88,16 +88,12 @@ When you try to run this new preos you will get:
 
 .. code-block:: sh
 
-    $ cdist preos -h
+    $ cdist preos -L
-    usage: cdist preos [-h] preos
+    Available PreOS-es:
-
+        - debian
-    Create PreOS
+        - devuan
-
+        - netbsd
-    positional arguments:
+        - ubuntu
-      preos       PreOS to create, one of: {'netbsd', 'debian', 'ubuntu'}
-
-    optional arguments:
-      -h, --help  show this help message and exit
     $ cdist preos netbsd
     NetBSD PreOS: []
 
@@ -121,17 +117,13 @@ When you try to run this new preos you will get:
 .. code-block:: sh
 
     $ cdist preos -h
-    usage: cdist preos [-h] preos
+    Available PreOS-es:
-
+        - debian
-    Create PreOS
+        - devuan
-
+        - freebsd
-    positional arguments:
+        - ubuntu
-      preos       PreOS to create, one of: {'freebsd', 'debian', 'ubuntu'}
-
-    optional arguments:
-      -h, --help  show this help message and exit
     $ cdist preos freebsd
     FreeBSD dummy preos: []
 
 In the ``commandline`` function/method you have all the freedom to actually create
-PreOS.
+a PreOS.

docs/src/cdist-types.rst

@@ -1,8 +0,0 @@
-cdist types
-===========
-
-.. toctree::
-   :titlesonly:
-   :glob:
-
-   man7/*

docs/src/cdist-types.rst.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+#
+# 2019 Darko Poljak (darko.poljak at gmail.com) 
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Generate cdist-types.rst that lists available types.
+#
+
+__cdist_pwd="$(pwd -P)"
+__cdist_mydir="${0%/*}";
+__cdist_abs_mydir="$(cd "$__cdist_mydir" && pwd -P)"
+__cdist_myname=${0##*/};
+__cdist_abs_myname="$__cdist_abs_mydir/$__cdist_myname"
+
+filename="${__cdist_myname%.sh}"
+dest="$__cdist_abs_mydir/$filename"
+
+cd "$__cdist_abs_mydir"
+
+exec > "$dest"
+cat << eof 
+cdist types
+===========
+
+.. toctree::
+   :titlesonly:
+
+eof
+
+# If there is no such file then ls prints error to stderr,
+# so redirect stderr to /dev/null.
+for type in $(ls man7/cdist-type__*.rst 2>/dev/null | LC_ALL=C sort); do
+    no_dir="${type#man7/}";
+    no_type="${no_dir#cdist-type}";
+    name="${no_type%.rst}";
+    manref="${no_dir%.rst}"
+    man="${manref}(7)"
+
+    echo "   $name" "<man7/${manref}>"
+done

docs/src/man1/cdist.rst

@@ -11,7 +11,7 @@ SYNOPSIS
 
 ::
 
-    cdist [-h] [-V] {banner,config,install,inventory,preos,shell} ...
+    cdist [-h] [-V] {banner,config,install,inventory,preos,shell,info} ...
 
     cdist banner [-h] [-l LOGLEVEL] [-q] [-v]
 
@@ -59,23 +59,25 @@ SYNOPSIS
                          [-I INVENTORY_DIR] [-a] [-f HOSTFILE] [-H] [-t]
                          [host [host ...]]
 
-    cdist preos [-h] preos
+    cdist preos [-h] [-l LOGLEVEL] [-q] [-v] [-c CONF_DIR] [-g CONFIG_FILE]
+                [-L]
+                [preos] ...
 
-    cdist preos debian [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+    cdist preos [preos-options] debian [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
                                        [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
                                        [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
                                        [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
                                        [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
                                        target_dir
 
-    cdist preos devuan [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+    cdist preos [preos-options] devuan [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
                                        [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
                                        [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
                                        [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
                                        [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
                                        target_dir
 
-    cdist preos ubuntu [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+    cdist preos [preos-options] ubuntu [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
                                        [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
                                        [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
                                        [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
@@ -84,6 +86,8 @@ SYNOPSIS
 
     cdist shell [-h] [-l LOGLEVEL] [-q] [-v] [-s SHELL]
 
+    cdist info [-h] [-a] [-c CONF_DIR] [-e] [-F] [-f] [-g CONFIG_FILE] [-t] [pattern]
+
 
 DESCRIPTION
 -----------
@@ -103,7 +107,7 @@ All commands accept the following options:
 **-l LOGLEVEL, --log-level LOGLEVEL**
     Set the specified verbosity level. The levels, in
     order from the lowest to the highest, are: ERROR (-1),
-    WARNING (0), INFO (1), VERBOSE (2), DEBUG (3) TRACE (4
+    WARNING (0), INFO (1), VERBOSE (2), DEBUG (3), TRACE (4
     or higher). If used along with -v then -v increases
     last set value and -l overwrites last set value.
 
@@ -116,7 +120,7 @@ All commands accept the following options:
     value is 0 which includes ERROR and WARNING levels.
     The levels, in order from the lowest to the highest,
     are: ERROR (-1), WARNING (0), INFO (1), VERBOSE (2),
-    DEBUG (3) TRACE (4 or higher). If used along with -l
+    DEBUG (3), TRACE (4 or higher). If used along with -l
     then -l overwrites last set value and -v increases
     last set value.
 
@@ -457,7 +461,18 @@ List inventory database.
 
 PREOS
 -----
-Create PreOS. Currently, the following PreOS-es are supported:
+Create PreOS.
+
+**-c CONF_DIR, --conf-dir CONF_DIR**
+    Add configuration directory (one that contains "preos" subdirectory).
+
+**-g CONFIG_FILE, --config-file CONFIG_FILE**
+    Use specified custom configuration file.
+
+**-L, --list-preoses**
+    List available PreOS-es.
+
+Currently, the following PreOS-es are supported:
 
 * debian
 * ubuntu
@@ -596,6 +611,39 @@ usage. Its primary use is for debugging type parameters.
     be POSIX compatible shell.
 
 
+INFO
+----
+Display information for cdist (global explorers, types).
+
+**pattern**
+    Glob pattern. If it contains special characters('?', '*', '[') then it is
+    used as specified, otherwise it is translated to `*pattern*`.
+
+**-h, --help**
+    Show help message and exit.
+
+**-a, --all**
+    Display all info. This is the default.
+
+**-c CONF_DIR, --conf-dir CONF_DIR**
+    Add configuration directory (can be repeated).
+
+**-e, --global-explorers**
+    Display info for global explorers.
+
+**-F, --fixed-string**
+    Interpret pattern as a fixed string.
+
+**-f, --full**
+    Display full details.
+
+**-g CONFIG_FILE, --config-file CONFIG_FILE**
+    Use specified custom configuration file.
+
+**-t, --types**
+    Display info for types.
+
+
 CONFIGURATION
 -------------
 cdist obtains configuration data from the following sources in the following
@@ -907,5 +955,5 @@ such case and display a warning message. An example of such a case:
 
 COPYING
 -------
-Copyright \(C) 2011-2017 Nico Schottelius. Free use of this software is
+Copyright \(C) 2011-2019 Nico Schottelius. Free use of this software is
 granted under the terms of the GNU General Public License v3 or later (GPLv3+).