diff --git a/.gitattributes b/.gitattributes index 01d20f30..45c10d7b 100644 --- a/.gitattributes +++ b/.gitattributes @@ -4,5 +4,5 @@ docs/speeches export-ignore docs/video export-ignore docs/src/man7 export-ignore -bin/cdist-build-helper export-ignore +bin/build-helper export-ignore README-maintainers export-ignore diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a4bc67aa..1cc17995 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,23 +1,18 @@ ---- -image: code.ungleich.ch:5050/ungleich-public/cdist/cdist-ci:latest - stages: - test -before_script: - - ./bin/cdist-build-helper version - -shellcheck: - stage: test - script: - - ./bin/cdist-build-helper shellcheck - -pycodestyle: - stage: test - script: - - ./bin/cdist-build-helper pycodestyle - unit_tests: stage: test script: - - ./bin/cdist-build-helper test + - ./bin/build-helper version + - ./bin/build-helper test + +pycodestyle: + stage: test + script: + - ./bin/build-helper pycodestyle + +shellcheck: + stage: test + script: + - ./bin/build-helper shellcheck diff --git a/Makefile b/Makefile index 89286310..f89ac1e7 100644 --- a/Makefile +++ b/Makefile @@ -35,9 +35,9 @@ DOCS_SRC_DIR=./docs/src SPEECHDIR=./docs/speeches TYPEDIR=./cdist/conf/type -SPHINXM=$(MAKE) -C $(DOCS_SRC_DIR) man -SPHINXH=$(MAKE) -C $(DOCS_SRC_DIR) html -SPHINXC=$(MAKE) -C $(DOCS_SRC_DIR) clean +SPHINXM=make -C $(DOCS_SRC_DIR) man +SPHINXH=make -C $(DOCS_SRC_DIR) html +SPHINXC=make -C $(DOCS_SRC_DIR) clean ################################################################################ # Manpages @@ -81,7 +81,7 @@ version: } # Manpages #3: generic part -man: version configskel $(MANTYPES) $(DOCSREF) $(DOCSTYPESREF) +man: version $(MANTYPES) $(DOCSREF) $(SPHINXM) html: version configskel $(MANTYPES) $(DOCSREF) $(DOCSTYPESREF) @@ -104,7 +104,7 @@ DOTMANTYPES=$(subst /man.rst,.rst,$(DOTMANTYPEPREFIX)) $(DOTMAN7DSTDIR)/cdist-type%.rst: $(DOTTYPEDIR)/%/man.rst ln -sf "$^" $@ -dotman: version configskel $(DOTMANTYPES) $(DOCSREF) $(DOCSTYPESREF) +dotman: version $(DOTMANTYPES) $(SPHINXM) ################################################################################ diff --git a/README b/README new file mode 100644 index 00000000..caf2dac8 --- /dev/null +++ b/README @@ -0,0 +1,7 @@ +cdist +----- + +cdist is a usable configuration management system. + +For the web documentation have a look at https://www.cdi.st/ +or at docs/src for reStructuredText manual. diff --git a/README-maintainers b/README-maintainers index 5766dd7d..af57f475 100644 --- a/README-maintainers +++ b/README-maintainers @@ -1,4 +1,4 @@ -Maintainers should use ./bin/cdist-build-helper script. +Maintainers should use ./bin/build-helper script. Makefile is intended for end users. It can be used for non-maintaining targets that can be run from pure source (without git repository). diff --git a/README.md b/README.md deleted file mode 100644 index a468dd86..00000000 --- a/README.md +++ /dev/null @@ -1,31 +0,0 @@ -# cdist - -**cdist** is a usable configuration management system. - -It adheres to the [**KISS principle**](https://en.wikipedia.org/wiki/KISS_principle) -and is being used in small up to enterprise grade environments. - -For more information have a look at [**homepage**](https://cdi.st) -or at **``docs/src``** for manual in **reStructuredText** format. - -## Contributing - -Merge/Pull requests can be made in both -[upstream **GitLab**](https://code.ungleich.ch/ungleich-public/cdist/merge_requests) -(managed by [**ungleich**](https://ungleich.ch)) -and [**GitHub** project](https://github.com/ungleich/cdist/pulls). - -Issues can be made and other project management activites happen -[**only in GitLab**](https://code.ungleich.ch/ungleich-public/cdist) -(needs [**ungleich** account](https://account.ungleich.ch)). - -For community-maintained types there is -[**cdist-contrib** project](https://code.ungleich.ch/ungleich-public/cdist-contrib). - -## Participating - -IRC: ``#cdist`` @ [libera](https://libera.chat) - -Matrix: ``#cdist:ungleich.ch`` - -Matrix and IRC are bridged. diff --git a/bin/cdist-build-helper b/bin/build-helper similarity index 93% rename from bin/cdist-build-helper rename to bin/build-helper index 0380b3f8..ed41e438 100755 --- a/bin/cdist-build-helper +++ b/bin/build-helper @@ -45,7 +45,7 @@ usage() { shellcheck-manifests shellcheck-local-gencodes shellcheck-remote-gencodes - shellcheck-bin + shellcheck-scripts shellcheck-gencodes shellcheck-types shellcheck @@ -100,7 +100,7 @@ case "$option" in if (\$0 ~ /^$end/) { exit } else { - print \$0 + print \$0 } } }" "$basedir/docs/changelog" @@ -135,7 +135,7 @@ case "$option" in version=$1; shift - ( + ( cat << eof Subject: cdist $version has been released @@ -336,7 +336,7 @@ eof make docs-clean make docs - ############################################################# + ############################################################# # Everything green, let's do the release # Tag the current commit @@ -371,6 +371,7 @@ eof Manual steps post release: - cdist-web - send generated mailinglist.tmp mail + - twitter eof ;; @@ -405,7 +406,7 @@ eof ;; pycodestyle|pep8) - pycodestyle "${basedir}" "${basedir}/bin/cdist" + pycodestyle "${basedir}" "${basedir}/scripts/cdist" ;; check-pycodestyle) @@ -460,34 +461,27 @@ eof test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } ;; - # NOTE: shellcheck-scripts is kept for compatibility - shellcheck-bin|shellcheck-scripts) + shellcheck-scripts) # shellcheck disable=SC2086 - ${SHELLCHECKCMD} bin/cdist-dump bin/cdist-new-type > "${SHELLCHECKTMP}" + ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type > "${SHELLCHECKTMP}" test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } ;; shellcheck-gencodes) - errors=false - "$0" shellcheck-local-gencodes || errors=true - "$0" shellcheck-remote-gencodes || errors=true - ! $errors || exit 1 + "$0" shellcheck-local-gencodes || exit 1 + "$0" shellcheck-remote-gencodes || exit 1 ;; shellcheck-types) - errors=false - "$0" shellcheck-type-explorers || errors=true - "$0" shellcheck-manifests || errors=true - "$0" shellcheck-gencodes || errors=true - ! $errors || exit 1 + "$0" shellcheck-type-explorers || exit 1 + "$0" shellcheck-manifests || exit 1 + "$0" shellcheck-gencodes || exit 1 ;; shellcheck) - errors=false - "$0" shellcheck-global-explorers || errors=true - "$0" shellcheck-types || errors=true - "$0" shellcheck-bin || errors=true - ! $errors || exit 1 + "$0" shellcheck-global-explorers || exit 1 + "$0" shellcheck-types || exit 1 + "$0" shellcheck-scripts || exit 1 ;; shellcheck-type-files) @@ -497,14 +491,12 @@ eof ;; shellcheck-with-files) - errors=false - "$0" shellcheck || errors=true - "$0" shellcheck-type-files || errors=true - ! $errors || exit 1 + "$0" shellcheck || exit 1 + "$0" shellcheck-type-files || exit 1 ;; shellcheck-build-helper) - ${SHELLCHECKCMD} ./bin/cdist-build-helper + ${SHELLCHECKCMD} ./bin/build-helper ;; check-shellcheck) diff --git a/bin/cdist b/bin/cdist index adb06a8d..645020a1 100755 --- a/bin/cdist +++ b/bin/cdist @@ -1,8 +1,7 @@ -#!/usr/bin/env python3 +#!/bin/sh # -*- coding: utf-8 -*- # -# 2010-2016 Nico Schottelius (nico-cdist at schottelius.org) -# 2016 Darko Poljak (darko.poljak at gmail.com) +# 2012 Nico Schottelius (nico-cdist at schottelius.org) # # This file is part of cdist. # @@ -21,83 +20,14 @@ # # -import logging -import os -import sys +# Wrapper for real script to allow execution from checkout +dir=${0%/*} -# See if this file's parent is cdist module -# and if so add it to module search path. -cdist_dir = os.path.realpath( - os.path.join( - os.path.dirname(os.path.realpath(__file__)), - os.pardir)) -cdist_init_dir = os.path.join(cdist_dir, 'cdist', '__init__.py') -if os.path.exists(cdist_init_dir): - sys.path.insert(0, cdist_dir) +# Ensure version is present - the bundled/shipped version contains a static version, +# the git version contains a dynamic version +"$dir/build-helper" version -import cdist # noqa 402 -import cdist.argparse # noqa 402 -import cdist.banner # noqa 402 -import cdist.config # noqa 402 -import cdist.install # noqa 402 -import cdist.shell # noqa 402 -import cdist.inventory # noqa 402 +libdir=$(cd "${dir}/../" && pwd -P) +export PYTHONPATH="${libdir}" - -def commandline(): - """Parse command line""" - - # preos subcommand hack - if len(sys.argv) > 1 and sys.argv[1] == 'preos': - return cdist.preos.PreOS.commandline(sys.argv[1:]) - parser, cfg = cdist.argparse.parse_and_configure(sys.argv[1:]) - args = cfg.get_args() - - # Work around python 3.3 bug: - # http://bugs.python.org/issue16308 - # http://bugs.python.org/issue9253 - - # FIXME: catching AttributeError also hides - # real problems.. try a different way - - # FIXME: we always print main help, not - # the help of the actual parser being used! - try: - getattr(args, "func") - except AttributeError: - parser['main'].print_help() - sys.exit(0) - - args.func(args) - - -if __name__ == "__main__": - if sys.version_info[:3] < cdist.MIN_SUPPORTED_PYTHON_VERSION: - print( - 'Python >= {} is required on the source host.'.format( - ".".join(map(str, cdist.MIN_SUPPORTED_PYTHON_VERSION))), - file=sys.stderr) - sys.exit(1) - - exit_code = 0 - - try: - import re - import os - - if re.match("__", os.path.basename(sys.argv[0])): - import cdist.emulator - emulator = cdist.emulator.Emulator(sys.argv) - emulator.run() - else: - commandline() - - except KeyboardInterrupt: - exit_code = 2 - - except cdist.Error as e: - log = logging.getLogger("cdist") - log.error(e) - exit_code = 1 - - sys.exit(exit_code) +"$dir/../scripts/cdist" "$@" diff --git a/cdist/__init__.py b/cdist/__init__.py index 31d49889..c673b3ba 100644 --- a/cdist/__init__.py +++ b/cdist/__init__.py @@ -22,27 +22,11 @@ import os import hashlib -import subprocess import cdist.log +import cdist.version - -VERSION = 'unknown version' - -try: - import cdist.version - VERSION = cdist.version.VERSION -except ModuleNotFoundError: - cdist_dir = os.path.abspath( - os.path.join(os.path.dirname(__file__), os.pardir)) - if os.path.isdir(os.path.join(cdist_dir, '.git')): - try: - VERSION = subprocess.check_output( - ['git', 'describe', '--always'], - cwd=cdist_dir, - universal_newlines=True) - except Exception: - pass +VERSION = cdist.version.VERSION BANNER = """ .. . .x+=:. s @@ -64,9 +48,6 @@ REMOTE_EXEC = "ssh -o User=root" REMOTE_CMDS_CLEANUP_PATTERN = "ssh -o User=root -O exit -S {}" -MIN_SUPPORTED_PYTHON_VERSION = (3, 5) - - class Error(Exception): """Base exception class for this project""" pass diff --git a/cdist/argparse.py b/cdist/argparse.py index f17315e7..611c484a 100644 --- a/cdist/argparse.py +++ b/cdist/argparse.py @@ -5,14 +5,12 @@ import logging import collections import functools import cdist.configuration -import cdist.log import cdist.preos import cdist.info -import cdist.scan.commandline # set of beta sub-commands -BETA_COMMANDS = set(('install', 'inventory', 'scan', )) +BETA_COMMANDS = set(('install', 'inventory', )) # set of beta arguments for sub-commands BETA_ARGS = { 'config': set(('tag', 'all_tagged_hosts', 'use_archiving', )), @@ -127,14 +125,6 @@ def get_parsers(): 'value.'), action='count', default=None) - parser['colored_output'] = argparse.ArgumentParser(add_help=False) - parser['colored_output'].add_argument( - '--colors', metavar='WHEN', - help="Colorize cdist's output based on log level; " - "WHEN is 'always', 'never', or 'auto'.", - action='store', dest='colored_output', required=False, - choices=cdist.configuration.ColoredOutputOption.CHOICES) - parser['beta'] = argparse.ArgumentParser(add_help=False) parser['beta'].add_argument( '-b', '--beta', @@ -207,13 +197,6 @@ def get_parsers(): 'supported. Without argument CPU count is used by default. '), action='store', dest='jobs', const=multiprocessing.cpu_count()) - parser['config_main'].add_argument( - '--log-server', - action='store_true', - help=('Start a log server for sub processes to use. ' - 'This is mainly useful when running cdist nested ' - 'from a code-local script. Log server is alwasy ' - 'implicitly started for \'install\' command.')) parser['config_main'].add_argument( '-n', '--dry-run', help='Do not execute code.', action='store_true') @@ -274,7 +257,8 @@ def get_parsers(): '-f', '--file', help=('Read specified file for a list of additional hosts to ' 'operate on or if \'-\' is given, read stdin (one host per ' - 'line).'), + 'line). If no host or host file is specified then, by ' + 'default, read hosts from stdin.'), dest='hostfile', required=False) parser['config_args'].add_argument( '-p', '--parallel', nargs='?', metavar='HOST_MAX', @@ -299,7 +283,6 @@ def get_parsers(): 'host', nargs='*', help='Host(s) to operate on.') parser['config'] = parser['sub'].add_parser( 'config', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['config_main'], parser['inventory_common'], @@ -318,7 +301,6 @@ def get_parsers(): parser['add-host'] = parser['invsub'].add_parser( 'add-host', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['add-host'].add_argument( @@ -326,12 +308,13 @@ def get_parsers(): parser['add-host'].add_argument( '-f', '--file', help=('Read additional hosts to add from specified file ' - 'or from stdin if \'-\' (each host on separate line). '), + 'or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin.'), dest='hostfile', required=False) parser['add-tag'] = parser['invsub'].add_parser( 'add-tag', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['add-tag'].add_argument( @@ -340,12 +323,20 @@ def get_parsers(): parser['add-tag'].add_argument( '-f', '--file', help=('Read additional hosts to add tags from specified file ' - 'or from stdin if \'-\' (each host on separate line). '), + 'or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor hosts/hostfile' + ' are specified then tags are read from stdin and are' + ' added to all hosts.'), dest='hostfile', required=False) parser['add-tag'].add_argument( '-T', '--tag-file', help=('Read additional tags to add from specified file ' - 'or from stdin if \'-\' (each tag on separate line). '), + 'or from stdin if \'-\' (each tag on separate line). ' + 'If no tag or tag file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor hosts/hostfile' + ' are specified then tags are read from stdin and are' + ' added to all hosts.'), dest='tagfile', required=False) parser['add-tag'].add_argument( '-t', '--taglist', @@ -355,7 +346,6 @@ def get_parsers(): parser['del-host'] = parser['invsub'].add_parser( 'del-host', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['del-host'].add_argument( @@ -366,12 +356,13 @@ def get_parsers(): parser['del-host'].add_argument( '-f', '--file', help=('Read additional hosts to delete from specified file ' - 'or from stdin if \'-\' (each host on separate line). '), + 'or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin.'), dest='hostfile', required=False) parser['del-tag'] = parser['invsub'].add_parser( 'del-tag', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['del-tag'].add_argument( @@ -384,13 +375,20 @@ def get_parsers(): parser['del-tag'].add_argument( '-f', '--file', help=('Read additional hosts to delete tags for from specified ' - 'file or from stdin if \'-\' (each host on separate ' - 'line). '), + 'file or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor hosts/hostfile' + ' are specified then tags are read from stdin and are' + ' deleted from all hosts.'), dest='hostfile', required=False) parser['del-tag'].add_argument( '-T', '--tag-file', help=('Read additional tags from specified file ' - 'or from stdin if \'-\' (each tag on separate line). '), + 'or from stdin if \'-\' (each tag on separate line). ' + 'If no tag or tag file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor' + ' hosts/hostfile are specified then tags are read from' + ' stdin and are added to all hosts.'), dest='tagfile', required=False) parser['del-tag'].add_argument( '-t', '--taglist', @@ -400,7 +398,6 @@ def get_parsers(): parser['list'] = parser['invsub'].add_parser( 'list', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['list'].add_argument( @@ -433,7 +430,7 @@ def get_parsers(): # Shell parser['shell'] = parser['sub'].add_parser( - 'shell', parents=[parser['loglevel'], parser['colored_output']]) + 'shell', parents=[parser['loglevel']]) parser['shell'].add_argument( '-s', '--shell', help=('Select shell to use, defaults to current shell. Used shell' @@ -471,47 +468,6 @@ def get_parsers(): 'pattern', nargs='?', help='Glob pattern.') parser['info'].set_defaults(func=cdist.info.Info.commandline) - # Scan = config + further - parser['scan'] = parser['sub'].add_parser('scan', add_help=False, - parents=[parser['config']]) - - parser['scan'] = parser['sub'].add_parser( - 'scan', parents=[parser['loglevel'], - parser['beta'], - parser['colored_output'], - parser['common'], - parser['config_main']]) - - parser['scan'].add_argument( - '-m', '--mode', help='Which modes should run', - action='append', default=[], - choices=['scan', 'trigger', 'config']) - parser['scan'].add_argument( - '--list', - action='store_true', - help='List the known hosts and exit') - parser['scan'].add_argument( - '--config', - action='store_true', - help='Try to configure detected hosts') - parser['scan'].add_argument( - '-I', '--interface', - action='append', default=[], required=True, - help='On which interfaces to scan/trigger') - parser['scan'].add_argument( - '--name-mapper', - action='store', default=None, - help='Map addresses to names, required for config mode') - parser['scan'].add_argument( - '-d', '--config-delay', - action='store', default=3600, type=int, - help='How long (seconds) to wait before reconfiguring after last try') - parser['scan'].add_argument( - '-t', '--trigger-delay', - action='store', default=5, type=int, - help='How long (seconds) to wait between ICMPv6 echo requests') - parser['scan'].set_defaults(func=cdist.scan.commandline.commandline) - for p in parser: parser[p].epilog = EPILOG @@ -522,12 +478,7 @@ def handle_loglevel(args): if hasattr(args, 'quiet') and args.quiet: args.verbose = _verbosity_level_off - logging.getLogger().setLevel(_verbosity_level[args.verbose]) - - -def handle_log_colors(args): - if cdist.configuration.ColoredOutputOption.translate(args.colored_output): - cdist.log.CdistFormatter.USE_COLORS = True + logging.root.setLevel(_verbosity_level[args.verbose]) def parse_and_configure(argv, singleton=True): @@ -541,14 +492,13 @@ def parse_and_configure(argv, singleton=True): raise cdist.Error(str(e)) # Loglevels are handled globally in here handle_loglevel(args) - handle_log_colors(args) log = logging.getLogger("cdist") - log.verbose("version %s", cdist.VERSION) - log.trace('command line args: %s', cfg.command_line_args) - log.trace('configuration: %s', cfg.get_config()) - log.trace('configured args: %s', args) + log.verbose("version %s" % cdist.VERSION) + log.trace('command line args: {}'.format(cfg.command_line_args)) + log.trace('configuration: {}'.format(cfg.get_config())) + log.trace('configured args: {}'.format(args)) check_beta(vars(args)) diff --git a/cdist/conf/explorer/cpu_cores b/cdist/conf/explorer/cpu_cores index 81e5294e..a52bddac 100755 --- a/cdist/conf/explorer/cpu_cores +++ b/cdist/conf/explorer/cpu_cores @@ -32,11 +32,6 @@ case "$os" in sysctl -n hw.ncpuonline ;; - "freebsd"|"netbsd") - PATH=$(getconf PATH) - sysctl -n hw.ncpu - ;; - *) if [ -r /proc/cpuinfo ]; then cores="$(grep "core id" /proc/cpuinfo | sort | uniq | wc -l)" diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks index 56d62d10..87a6b5c6 100755 --- a/cdist/conf/explorer/disks +++ b/cdist/conf/explorer/disks @@ -1,66 +1,27 @@ -#!/bin/sh -e -# -# based on previous work by other people, modified by: -# 2020 Dennis Camera -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Finds disks of the system (excl. ram disks, floppy, cdrom) +#!/bin/sh uname_s="$(uname -s)" -case $uname_s in +case "${uname_s}" in FreeBSD) sysctl -n kern.disks ;; - OpenBSD) - sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+' - ;; - NetBSD) - PATH=$(getconf PATH) - sysctl -n hw.disknames | awk -v RS=' ' '/^[lsw]d[0-9]+/' + OpenBSD|NetBSD) + sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+' | xargs ;; Linux) - # list of major device numbers toexclude: - # ram disks, floppies, cdroms - # https://www.kernel.org/doc/Documentation/admin-guide/devices.txt - ign_majors='1 2 11' - - if command -v lsblk >/dev/null 2>&1 + if command -v lsblk > /dev/null then - lsblk -e "$(echo "$ign_majors" | tr ' ' ',')" -dno name - elif test -d /sys/block/ - then - # shellcheck disable=SC2012 - ls -1 /sys/block/ \ - | awk -v ign_majors="$(echo "$ign_majors" | tr ' ' '|')" ' - { - devfile = "/sys/block/" $0 "/dev" - getline devno < devfile - close(devfile) - if (devno !~ "^(" ign_majors "):") print - }' + # exclude ram disks, floppies and cdroms + # https://www.kernel.org/doc/Documentation/admin-guide/devices.txt + lsblk -e 1,2,11 -dno name | xargs else - echo "Don't know how to list disks on Linux without lsblk and sysfs." >&2 - echo 'If you can, please submit a patch.'>&2 + printf "Don't know how to list disks for %s operating system without lsblk, if you can please submit a patch\n" "${uname_s}" >&2 fi ;; *) - printf "Don't know how to list disks for %s operating system.\n" "${uname_s}" >&2 - printf 'If you can please submit a patch\n' >&2 + printf "Don't know how to list disks for %s operating system, if you can please submit a patch\n" "${uname_s}" >&2 ;; -esac \ -| xargs +esac + +exit 0 diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init index f27c77ef..1b921c68 100755 --- a/cdist/conf/explorer/init +++ b/cdist/conf/explorer/init @@ -221,7 +221,6 @@ check_systemstarter() { check_sysvinit() ( init_path=${1:-/sbin/init} - test -x "${init_path}" || return 1 grep -q 'INIT_VERSION=sysvinit-[0-9.]*' "${init_path}" || return 1 # It is quite common to use SysVinit to stack other init systemd diff --git a/cdist/conf/explorer/machine_type b/cdist/conf/explorer/machine_type index 00646c75..bb21f69c 100755 --- a/cdist/conf/explorer/machine_type +++ b/cdist/conf/explorer/machine_type @@ -1,6 +1,7 @@ -#!/bin/sh -e +#!/bin/sh # -# 2021 Dennis Camera (cdist at dtnr.ch) +# 2014 Daniel Heule (hda at sfs.biz) +# 2014 Thomas Oettli (otho at sfs.biz) # # This file is part of cdist. # @@ -17,1019 +18,63 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# This explorer tries to determine what type of machine the target to be -# configured is (container, virtual machine, bare-metal). -# -# It will print one line for each layer it can detect. -# The format of all lines is: TYPE[ VERB VENDOR] -# -# VERB does not have a special meaning, it is just for better readability. -# -# e.g. -# container -# container on lxc -# virtual by kvm-spapr -# -# The third word of each line (except the first) can be composed of different -# parts concatenated with a `-' (minus) character, with each component being -# a specification of the previous, e.g.: -# - lxc-libvirt (LXC container, managed by libvirt) -# - lpar-s390 / lpar-power (LPAR running on IBM S/390 or POWER, respectively) -# - xen-hvm / xen-pv (Xen HVM vs para-virtualization) -# -# If this explorer cannot collect enough information about virtualization it -# will fall back to 'physical'. # -# Add /sbin and /usr/sbin to the path so we can find system -# binaries like dmidecode. -PATH=$(getconf PATH 2>/dev/null) || PATH='/usr/bin:/bin' -PATH="/sbin:/usr/sbin:${PATH}" -export PATH +# FIXME: other system types (not linux ...) -arch=$(uname -m | sed -e 's/i.86/i386/' -e 's/arm.*/arm/') -uname_s=$(uname -s) - - -is_command() { command -v "$1" >/dev/null 2>&1; } - -files_same() { - # shellcheck disable=SC2012 - LC_ALL=C df -P "$1" "$2" 2>/dev/null | { - read -r _ # skip header line - read -r fs1 _ _ _ _ mp1 - read -r fs2 _ _ _ _ mp2 - test "${fs1}" = "${fs2}" -a "${mp1}" = "${mp2}" || return 1 - } && - ls -1Ldi "$1" "$2" 2>/dev/null | { - read -r ino1 _ - read -r ino2 _ - test "${ino1}" = "${ino2}" || return 1 - } -} - -is_oneof() ( - x=$1; shift - for y - do - test "${x}" = "${y}" || continue - return 0 - done - return 1 -) - -tolower() { LC_ALL=C tr '[:upper:]' '[:lower:]'; } - -# shellcheck disable=SC2086 -glob_exists() { set -- $1; test -e "$1"; } - -get_dmi_field() { - if is_oneof "${uname_s}" NetBSD - then - case $1 - in - (system-manufacturer) _mib=machdep.dmi.system-vendor ;; - (system-product-name) _mib=machdep.dmi.system-product ;; - (system-version|system-uuid) _mib=machdep.dmi.$1 ;; - (bios-vendor|bios-version) _mib=machdep.dmi.$1 ;; - (biod-release-date) _mib=machdep.dmi.bios-date ;; - (*) _mib= ;; - esac - - test -n "${_mib}" && get_sysctl "${_mib}" | grep -e . && return - fi - - if is_command dmidecode - then - dmidecode -s "$1" - elif test -d "${dmi_sysfs-}" - then - case $1 - in - (system-manufacturer) _filename=sys_vendor ;; - (system-product-name) _filename=product_name ;; - (*) _filename=$(echo "$1" | tr - _) ;; - esac - if test -r "${dmi_sysfs-}/${_filename}" - then - cat "${dmi_sysfs}/${_filename}" - fi - unset _filename - elif test "${uname_s}" = OpenBSD - then - # NOTE: something similar to system-manufacutrer and system-product-name - # is available on OpenBSD in sysctl - case $1 - in - (system-manufacturer) _mib=hw.vendor ;; - (system-product-name) _mib=hw.product ;; - (*) _mib= ;; - esac - - test -n "${_mib}" && get_sysctl "${_mib}" | grep -e . && return - fi - - return 1 -} - -has_cpuinfo() { test -e /proc/cpuinfo; } - -get_sysctl() { - is_command sysctl && sysctl -n "$1" 2>/dev/null -} - -detected_layer() { - test -n "${_toplayer:-}" || echo "${_toplayer:=${1:?}}" -} - - -# Check for chroot - -has_chroot_systemd() { - is_command systemd-detect-virt && systemd-detect-virt --help | grep -q -e '^ -r' -} - -check_chroot_systemd() { - systemd-detect-virt -r -} - -has_chroot_debian_ischroot() { - is_command ischroot -} - -check_chroot_debian_ischroot() { - ischroot --default-false -} - -has_chroot_procfs() { - test -d /proc/ -} - -check_chroot_procfs() ( - is_chroot=false # default - if test -e /proc/1/root && ! files_same /proc/1/root / - then - is_chroot=true - fi - if test -e /proc/1/mountinfo -a -e /proc/self/mountinfo - then - has_mountinfo=true - cmp -s /proc/1/mountinfo /proc/self/mountinfo || is_chroot=true - fi - - if ${is_chroot} - then - # try to determine where the chroot has been mounted - rootdev=$(LC_ALL=C df -P / | awk 'NR==2{print $1}') - - if test -e "${rootdev}" - then - # escape chroot to determine where the device containing the - # chroot's / is mounted - rootdevmnt=$(LC_ALL=C chroot /proc/1/root df -P "${rootdev}" | awk 'NR==2{print $6}') - - # shellcheck disable=SC2012 - root_ino=$(ls -1di / | awk '{print $1}') - - # escape chroot and find mount point by inode - chroot /proc/1/root find "${rootdevmnt}" -xdev -type d -inum "${root_ino}" - elif ${has_mountinfo} - then - while read -r mntid _ _ _ cmntpnt _ - do - read -r _ _ _ _ hmntpnt _ <<-EOF - $(grep -e "^$((mntid)) " /proc/1/mountinfo) - EOF - printf '%s\n' "${hmntpnt%${cmntpnt}}" - done /dev/null) && - case ${_ctengine} - in - (''|'none') - return 1 ;; - ('container-other') - return 0 ;; - ('systemd-nspawn') - echo systemd_nspawn ;; - (*) - echo "${_ctengine}" ;; - esac -) - -has_ct_pid_1() { - test -r /run/systemd/container -o -r /proc/1/environ -} - -translate_container_name() { - case $1 - in - ('lxc') - echo lxc ;; - ('lxc-libvirt') - echo lxc-libvirt ;; - ('podman') - echo podman ;; - ('systemd-nspawn') - echo systemd_nspawn ;; - (*) - return 1 ;; - esac - return 0 -} - -check_ct_pid_1() { - if test -r /run/systemd/container - then - translate_container_name "$(head -n1 /run/systemd/container)" \ - && return 0 - fi - - if test -r /proc/1/environ - then - translate_container_name "$( - LC_ALL=C tr '\000' '\n' /dev/null - then - # https://github.com/Microsoft/WSL/issues/423#issuecomment-221627364 - echo wsl - elif test -d /var/.cagefs - then - # https://docs.cloudlinux.com/cloudlinux_os_components/#cagefs - # CageFS is not "really" a container, but it isn't a chroot either. - echo cagefs - elif test -e /proc/self/status && grep -q -e '^VxID: [0-9]\{1,\}' /proc/self/status - then - # Linux-VServer - if grep -q -x -F 'VxID: 0' /proc/self/status - then - # host - return 1 - else - # guest - echo linux_vserver - fi - else - return 1 - fi -} - -check_ct_os_specific() ( - if jailed=$(get_sysctl security.jail.jailed) && test "${jailed}" = 1 - then - # FreeBSD jail - echo jail - return 0 - fi - - if is_command zonename && test "$(zonename)" != global - then - # Solaris zone - echo zone - return 0 - fi - - return 1 -) - - -# Check for hypervisor - -guess_hypervisor_from_cpu_model() { - case $1 - in - (*\ KVM\ *) - echo kvm ;; - (*\ QEMU\ *|QEMU\ *) - echo qemu ;; - (*) - return 1 ;; - esac -} - -has_vm_systemd() { - is_command systemd-detect-virt && systemd-detect-virt --help | grep -q -e '^ -v' -} - -check_vm_systemd() ( - _hypervisor=$(systemd-detect-virt -v 2>/dev/null) && - case ${_hypervisor} - in - (''|'none') - return 1 ;; - ('amazon') - echo aws ;; - ('bochs') - echo kvm ;; - ('microsoft') - # assumption - echo hyperv ;; - ('oracle') - echo virtualbox ;; - ('vm-other') - return 0 ;; - (*) - echo "${_hypervisor}" ;; - esac -) - -has_vm_cpuinfo() { has_cpuinfo; } - -check_vm_cpuinfo() { - if grep -q -F 'User Mode Linux' /proc/cpuinfo \ - || grep -q -F 'UML' /proc/cpuinfo - then - # User Mode Linux - echo uml - elif grep -q -e '^vendor_id.*: PowerVM Lx86' /proc/cpuinfo - then - # IBM PowerVM Lx86 (Linux/x86 emulator) - echo powervm_lx86 - elif grep -q -e '^vendor_id.*: IBM/S390' /proc/cpuinfo - then - # IBM SystemZ (S/390) - if test -f /proc/sysinfo - then - if grep -q -e '^VM[0-9]* Control Program: KVM/Linux' /proc/sysinfo - then - echo kvm-s390 - return 0 - elif grep -q -e '^VM[0-9]* Control Program: z/VM' /proc/sysinfo - then - echo zvm - return 0 - elif grep -q -e '^LPAR ' /proc/sysinfo - then - echo zvm-lpar - return 0 - fi - fi - return 1 - else - if grep -q -e '^model name.*:' /proc/cpuinfo - then - sed -n -e 's/^model name[^:]*: *//p' /proc/cpuinfo \ - | while read -r _cpu_model - do - guess_hypervisor_from_cpu_model "${_cpu_model}" - done \ - | sort \ - | uniq -c \ - | awk ' - { if ($1 > most_c) { most_c = $1; most_s = $2 } } - END { - if (most_s) print most_s - exit !most_s - }' \ - && return 0 - fi - return 1 - fi -} - -check_vm_arch_specific() { - case ${arch} - in - (ppc64|ppc64le) - # Check PPC64 LPAR, KVM - - # example /proc/cpuinfo line indicating 'not baremetal' - # platform : pSeries - # - # example /proc/ppc64/lparcfg systemtype line - # system_type=IBM pSeries (emulated by qemu) - - if has_cpuinfo && grep -q -e 'platform.**pSeries' /proc/cpuinfo - then - if test -e /proc/ppc64/lparcfg - then - # Assume LPAR, now detect shared or dedicated - if grep -q -x -F 'shared_processor_mode=1' /proc/ppc64/lparcfg - then - echo powervm-shared - return 0 - else - echo powervm-dedicated - return 0 - fi - fi - fi - ;; - (sparc*) - # Check for SPARC LDoms - - if test -e /dev/mdesc - then - if test -d /sys/class/vlds/ctrl -a -d /sys/class/vlds/sp - then - # control LDom - return 1 - else - # guest LDom - echo ldom-sparc - fi - - # MDPROP=/usr/lib/ldoms/mdprop.py - # if test -x "${MDPROP}" - # then - # if test -n "$("${MDPROP}" -v iodevice device-type=pciex)" - # then - # echo ldoms-root - # echo ldoms-io - # elif test -n "$("${MDPROP}" -v iov-device vf-id=0)" - # then - # echo ldoms-io - # fi - # fi - return 0 - fi - ;; - (i?86|x86*|amd64|i86pc) - # VMM CPUID flag denotes that this system is running under a VMM - if is_oneof "${uname_s}" Darwin - then - get_sysctl machdep.cpu.features | tr ' ' '\n' | grep -qixF VMM \ - && return 0 - fi - if has_cpuinfo \ - && grep -q -i -e '^flags.*:.*\(hypervisor\|vmm\)' /proc/cpuinfo - then - return 0 - fi - ;; - (ia64) - if test -d /sys/bus/xen -a ! -d /sys/bus/xen-backend - then - # PV-on-HVM drivers installed in a Xen guest - echo xen-hvm - return 0 - fi - ;; - esac - return 1 -} - -has_vm_dmi() { - # Check for various products in SMBIOS/DMI. - # Note that DMI doesn't exist on all architectures (only x86 and some ARM). - # On other architectures the $dmi variable will be empty. - - if test -d /sys/class/dmi/id/ - then - dmi_sysfs=/sys/class/dmi/id - elif test -d /sys/devices/virtual/dmi/id/ - then - dmi_sysfs=/sys/devices/virtual/dmi/id - fi - - # shellcheck disable=SC2015 - { - is_command dmidecode \ - && ( - # dmidecode needs to exit 0 and not print the No SMBIOS/DMI line - dmi_out=$(dmidecode 2>&1) \ - && ! printf '%s\n' "${dmi_out}" \ - | grep -qF 'No SMBIOS nor DMI entry point found, sorry.' - ) \ - || test -d "${dmi_sysfs}" - } -} - -check_vm_dmi() { - case $(get_dmi_field system-product-name) - in - (*.metal) - if test "$(get_dmi_field system-manufacturer)" = 'Amazon EC2' - then - # AWS EC2 bare metal -> no virtualisation - return 1 - fi - ;; - ('BHYVE') - echo bhyve - return 0 - ;; - ('Google Compute Engine') - echo gce - return 0 - ;; - ('RHEV Hypervisor') - # Red Hat Enterprise Virtualization - echo rhev - return 0 - ;; - ('KVM'|'Bochs'|'KVM Virtual Machine') - echo kvm - return 0 - ;; - ('Parallels Virtual Platform') - echo parallels - return 0 - ;; - ('VirtualBox') - echo virtualbox - return 0 - ;; - ('VMware Virtual Platform') - echo vmware - return 0 - ;; - esac - - case $(get_dmi_field system-manufacturer) - in - ('Alibaba'*) - case $(get_dmi_field system-product-name) - in - ('Alibaba Cloud ECS') - echo alibaba-ecs - ;; - (*) - echo alibaba - ;; - esac - return 0 - ;; - ('Amazon EC2') - # AWS on bare-metal or KVM - echo aws-ec2 - return 0 - ;; - ('innotek GmbH'|'Oracle Corporation') - echo virtualbox - return 0 - ;; - ('Joyent') - if test "$(get_dmi_field system-product-name)" = 'SmartDC HVM' - then - # SmartOS KVM - echo kvm-smartdc_hvm - return 0 - fi - ;; - ('Microsoft Corporation'*) - if test "$(get_dmi_field system-product-name)" = 'Virtual Machine' - then - if test -e /proc/irq/7/hyperv \ - || expr "$(get_dmi_field bios-version)" : 'VRTUAL.*' >/dev/null - then - echo hyperv - return 0 - fi - - case $(get_dmi_field system-version) - in - (VPC[0-9]*|VS2005*|*[Vv]irtual*[Pp][Cc]*) - echo virtualpc - return 0 - ;; - (*) - echo hyperv - return 0 - ;; - esac - fi - ;; - ('Nutanix') - # Nutanix AHV. Similar to KVM. - if test "$(get_dmi_field system-product-name)" = 'AHV' - then - echo nutanix_ahv - return 0 - fi - ;; - ('oVirt') - echo ovirt - return 0 - ;; - ('Parallels Software International Inc.') - echo parallels - return 0 - ;; - ('QEMU') - echo qemu - return 0 - ;; - ('VMware, Inc.') - echo vmware - return 0 - ;; - esac - - case $(get_dmi_field bios-vendor) - in - ('Amazon EC2') - # AWS on bare-metal or KVM - echo aws-ec2 - return 0 - ;; - ('BHYVE') - echo bhyve - return 0 - ;; - ('innotek GmbH') - echo virtualbox - return 0 - ;; - ('Parallels Software International Inc.') - echo parallels - return 0 - ;; - ('Xen') - if get_dmi_field bios-version | grep -q -e '\([0-9]\{1,\}\.\)\{2\}amazon' - then - # AWS on Xen - echo aws-xen - return 0 - fi - ;; - esac - - return 1 -} - -check_vm_hyp_specific() { - if is_command vmware-checkvm && vmware-checkvm >/dev/null - then - # vmware-checkvm is provided by VMware's open-vm-tools - echo vmware - return 0 - elif test -d /proc/xen - then - test -r /proc/xen/capabilities && - if grep -q -F 'control_d' /proc/xen/capabilities 2>/dev/null - then - # Xen dom0 - return 1 - else - # Xen domU - echo xen - return 0 - fi - fi - return 1 -} - -has_vm_dt() { - # OpenFirmware/Das U-Boot device-tree - test -d /proc/device-tree -} - -check_vm_dt() { - case ${arch} - in - (arm|aarch64) - if test -r /proc/device-tree/hypervisor/compatible - then - if grep -q -F 'xen' /proc/device-tree/hypervisor/compatible - then - echo xen - return 0 - elif grep -q -F 'vmware' /proc/device-tree/hypervisor/compatible - then - # e.g. VMware ESXi on ARM - echo vmware - return 0 - fi - fi - if glob_exists /proc/device-tree/fw-cfg@*/compatible - then - # qemu,fw-cfg-mmio - sed -e 's/,.*$//' /proc/device-tree/fw-cfg@*/compatible | head -n1 - return 0 - fi - if grep -q -F 'dummy-virt' /proc/device-tree/compatible - then - echo lkvm - return 0 - fi - ;; - (ppc64*) - if test -d /proc/device-tree/hypervisor \ - && grep -qF 'linux,kvm' /proc/device-tree/hypervisor/compatible - then - # We are running as a spapr KVM guest on ppc64 - echo kvm-spapr - return 0 - fi - if test -r /proc/device-tree/ibm,partition-name \ - && test -r /proc/device-tree/hmc-managed\? \ - && test -r /proc/device-tree/chosen/qemu,graphic-width - then - echo powervm - fi - ;; - esac - return 1 -} - -has_vm_sys_hypervisor() { - test -d /sys/hypervisor/ -} - -check_vm_sys_hypervisor() { - test -r /sys/hypervisor/type && - case $(head -n1 /sys/hypervisor/type) - in - (xen) - # Ordinary kernel with pv_ops. There does not seem to be - # enough information at present to tell whether this is dom0 - # or domU. - echo xen - return 0 - ;; - esac - return 1 -} - -check_vm_os_specific() { - _hyp_generic=false - - case ${uname_s} - in - (Darwin) - if hv_vmm_present=$(get_sysctl kern.hv_vmm_present) \ - && test "${hv_vmm_present}" -ne 0 - then - _hyp_generic=true - fi - ;; - (FreeBSD) - # FreeBSD does not have /proc/cpuinfo even when procfs is used. - # Instead there is a sysctl kern.vm_guest. - # Which is 'none' if physical, else the virtualisation. - vm_guest=$(get_sysctl kern.vm_guest | tolower) && - case ${vm_guest} - in - (none) ;; - (generic) _hyp_generic=true ;; - (*) - # kernel could detect hypervisor - case ${vm_guest} - in - (hv) echo hyperv ;; - (vbox) echo virtualbox ;; - (*) echo "${vm_guest}" ;; - esac - return 0 - ;; - esac - ;; - (NetBSD) - machdep_hv=$(get_sysctl machdep.hypervisor | tolower) && - case ${machdep_hv} - in - (none) ;; - (generic) _hyp_generic=true ;; - (*) - # kernel could detect hypervisor - case ${machdep_hv} - in - (hyper-v) echo hyperv ;; - (xenhvm*) echo xen-hvm ;; - (xenpv*) echo xen-pv ;; - (xen*) echo xen ;; - (*) echo "${machdep_hv}" ;; - esac - return 0 - ;; - esac - ;; - (OpenBSD) - if is_command hostctl && glob_exists /dev/pvbus[0-9]* - then - for _pvbus in /dev/pvbus[0-9]* - do - _h_out=$(hostctl -f "${_pvbus}" -t 2>/dev/null) || continue - case $(expr "${_h_out}" : '[^:]*: *\(.*\)$') - in - (KVM) echo kvm ;; - (Hyper-V) echo hyperv ;; - (VMware) echo vmware ;; - (Xen) echo xen ;; - (bhyve) echo bhyve ;; - (OpenBSD) echo openbsd_vmm ;; - esac - return 0 - done - fi - ;; - (SunOS) - diag_conf=$(prtdiag | sed -n -e 's/.*Configuration: *//p' -e '/^$/q') - # NOTE: Don't use -e or -F in Solaris grep - if printf '%s\n' "${diag_conf}" | grep -q -i QEMU - then - echo qemu - return 0 - elif printf '%s\n' "${diag_conf}" | grep -q -i VMware - then - echo vmware - return 0 - fi - ;; - (Linux) - if is_command dmesg - then - while read -r line - do - case ${line} - in - ('Booting paravirtualized kernel on ') - case $(expr "${line}" : '.* kernel on \(.*\)') - in - ('Xen') - echo xen-pv; return 0 ;; - ('bare hardware') - return 1 ;; - esac - ;; - ('Hypervisor detected') - case $(expr "${line}" : '.*: *\(.*\)') - in - ('ACRN') - echo acrn ;; - ('Jailhouse') - echo jailhouse ;; - ('KVM') - echo kvm ;; - ('Microsoft Hyper-V') - echo hyperv ;; - ('VMware') - echo vmware ;; - ('Xen HVM') - echo xen-hvm ;; - ('Xen PV') - echo xen-pv ;; - esac - return 0 - ;; - (lpar:*' under hypervisor') - return 0 ;; - esac - done <<-EOF - $(dmesg 2>/dev/null | awk ' - /Booting paravirtualized kernel on / - /Hypervisor detected: / - /lpar: .* under hypervisor/ - ') - EOF - fi - esac - - # Try to guess hypervisor based on CPU model (sysctl hw.model if available) - if cpu_model=$(get_sysctl hw.model) - then - guess_hypervisor_from_cpu_model "${cpu_model}" && return 0 - fi - - if ${_hyp_generic} - then - # cannot say which hypervisor, but one was detected - return 0 - else - return 1 - fi -} - -run_stage() { - if type "has_$1_$2" >/dev/null 2>&1 - then - "has_$1_$2" - else - true - fi \ - && "check_$1_$2" -} - - -# Execute chroot stages - -for stage in \ - procfs debian_ischroot systemd -do - chrootpnt=$(run_stage chroot ${stage}) || continue - is_chrooted=true - detected_layer 'chroot' - if test -n "${chrootpnt}" - then - echo chroot at "${chrootpnt}" - break - fi -done -if ${is_chrooted:-false} && test -z "${chrootpnt}" -then - # could determine chroot, but not its mount point - echo chroot +if [ -d "/proc/vz" ] && [ ! -d "/proc/bc" ]; then + echo openvz + exit fi - -# Execute container stages - -for stage in \ - systemd pid_1 cgroup files os_specific -do - ctengine=$(run_stage ct ${stage}) || continue - detected_layer 'container' - is_contained=true - if test -n "${ctengine}" - then - echo container on "${ctengine}" - break - fi -done -if ${is_contained:-false} && test -z "${ctengine}" -then - # none of the stages could determine the specific container engine, but - # we are running in some container. - echo container +if [ -e "/proc/1/environ" ] && + tr '\000' '\n' < "/proc/1/environ" | grep -Eiq '^container='; then + echo lxc + exit fi +if [ -r /proc/cpuinfo ]; then + # this should only exist on virtual guest machines, + # tested on vmware, xen, kvm + if grep -q "hypervisor" /proc/cpuinfo; then + # this file is aviable in xen guest systems + if [ -r /sys/hypervisor/type ]; then + if grep -q -i "xen" /sys/hypervisor/type; then + echo virtual_by_xen + exit + fi + else + if [ -r /sys/class/dmi/id/product_name ]; then + if grep -q -i 'vmware' /sys/class/dmi/id/product_name; then + echo "virtual_by_vmware" + exit + elif grep -q -i 'bochs' /sys/class/dmi/id/product_name; then + echo "virtual_by_kvm" + exit + elif grep -q -i 'virtualbox' /sys/class/dmi/id/product_name; then + echo "virtual_by_virtualbox" + exit + fi + fi -# Execute virtual machine / hypervisor stages + if [ -r /sys/class/dmi/id/sys_vendor ]; then + if grep -q -i 'qemu' /sys/class/dmi/id/sys_vendor; then + echo "virtual_by_kvm" + exit + fi + fi -for stage in \ - systemd os_specific hyp_specific sys_hypervisor dt dmi cpuinfo arch_specific -do - hypervisor=$(run_stage vm ${stage}) || continue - detected_layer 'virtual machine' - is_virtual=true - if test -n "${hypervisor}" - then - echo virtual by "${hypervisor}" - break - fi -done -if ${is_virtual:-false} && test -z "${hypervisor}" -then - # none of the stages could determine the specific hypervisor, but - # we are virtual. - echo virtual + if [ -r /sys/class/dmi/id/chassis_vendor ]; then + if grep -q -i 'qemu' /sys/class/dmi/id/chassis_vendor; then + echo "virtual_by_kvm" + exit + fi + fi + fi + echo "virtual_by_unknown" + else + echo "physical" + fi +else + echo "unknown" fi - - -# Fallback - -detected_layer physical diff --git a/cdist/conf/explorer/memory b/cdist/conf/explorer/memory index c6d113cf..4e3efff8 100755 --- a/cdist/conf/explorer/memory +++ b/cdist/conf/explorer/memory @@ -1,9 +1,8 @@ -#!/bin/sh -e +#!/bin/sh # # 2014 Daniel Heule (hda at sfs.biz) # 2014 Thomas Oettli (otho at sfs.biz) # Copyright 2017, Philippe Gregoire -# 2020 Dennis Camera # # This file is part of cdist. # @@ -20,73 +19,23 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# Returns the amount of memory physically installed in the system, or if that -# cannot be determined the amount available to the operating system kernel, -# in kibibytes (kiB). +# -str2bytes() { - awk -F' ' ' - $2 == "B" || !$2 { print $1 } - $2 == "kB" { printf "%.f\n", ($1 * 1000) } - $2 == "MB" { printf "%.f\n", ($1 * 1000 * 1000) } - $2 == "GB" { printf "%.f\n", ($1 * 1000 * 1000 * 1000) } - $2 == "TB" { printf "%.f\n", ($1 * 1000 * 1000 * 1000 * 1000) } - $2 == "kiB" { printf "%.f\n", ($1 * 1024) } - $2 == "MiB" { printf "%.f\n", ($1 * 1024 * 1024) } - $2 == "GiB" { printf "%.f\n", ($1 * 1024 * 1024 * 1024) } - $2 == "TiB" { printf "%.f\n", ($1 * 1024 * 1024 * 1024 * 1024) }' -} +# FIXME: other system types (not linux ...) -bytes2kib() { - awk '$0 > 0 { printf "%.f\n", ($0 / 1024) }' -} +os=$("$__explorer/os") +case "$os" in + "macosx") + echo "$(sysctl -n hw.memsize)/1024" | bc + ;; + "openbsd") + echo "$(sysctl -n hw.physmem) / 1048576" | bc + ;; -case $(uname -s) -in - (Darwin) - sysctl -n hw.memsize | bytes2kib - ;; - (FreeBSD) - sysctl -n hw.realmem | bytes2kib - ;; - (NetBSD|OpenBSD) - # NOTE: This reports "usable" memory, not physically installed memory. - command -p sysctl -n hw.physmem | bytes2kib - ;; - (SunOS) - # Make sure that awk from xpg4 is used for the scripts to work - export PATH="/usr/xpg4/bin:${PATH}" - prtconf \ - | awk -F ': ' ' - $1 == "Memory size" { sub(/Megabytes/, "MiB", $2); print $2 } - /^$/ { exit }' \ - | str2bytes \ - | bytes2kib - ;; - (Linux) - if test -d /sys/devices/system/memory - then - # Use memory blocks if the architecture (e.g. x86, PPC64, s390) - # supports them (they denote physical memory) - num_mem_blocks=$(cat /sys/devices/system/memory/memory[0-9]*/state | grep -cxF online) - mem_block_size=$(cat /sys/devices/system/memory/block_size_bytes) - - echo $((num_mem_blocks * 0x$mem_block_size)) | bytes2kib && exit - fi - if test -r /proc/meminfo - then - # Fall back to meminfo file on other architectures (e.g. ARM, MIPS, - # PowerPC) - # NOTE: This is "usable" memory, not physically installed memory. - awk -F ': +' '$1 == "MemTotal" { sub(/B$/, "iB", $2); print $2 }' /proc/meminfo \ - | str2bytes \ - | bytes2kib - fi - ;; - (*) - printf "Your kernel (%s) is currently not supported by the memory explorer\n" "$(uname -s)" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - ;; + *) + if [ -r /proc/meminfo ]; then + grep "MemTotal:" /proc/meminfo | awk '{print $2}' + fi + ;; esac diff --git a/cdist/conf/explorer/os b/cdist/conf/explorer/os index 46d87f3e..563fa4cf 100755 --- a/cdist/conf/explorer/os +++ b/cdist/conf/explorer/os @@ -143,13 +143,6 @@ case "$uname_s" in esac if [ -f /etc/os-release ]; then - # after sles15, suse don't provide an /etc/SuSE-release anymore, but there is almost no difference between sles and opensuse leap, so call it suse - # shellcheck disable=SC1091 - if (. /etc/os-release && echo "${ID_LIKE}" | grep -q '\(^\|\ \)suse\($\|\ \)') - then - echo suse - exit 0 - fi # already lowercase, according to: # https://www.freedesktop.org/software/systemd/man/os-release.html awk -F= '/^ID=/ { if ($2 ~ /^'"'"'(.*)'"'"'$/ || $2 ~ /^"(.*)"$/) { print substr($2, 2, length($2) - 2) } else { print $2 } }' /etc/os-release diff --git a/cdist/conf/explorer/os_version b/cdist/conf/explorer/os_version index bbc9e4f0..1d54ea60 100755 --- a/cdist/conf/explorer/os_version +++ b/cdist/conf/explorer/os_version @@ -1,7 +1,6 @@ -#!/bin/sh -e +#!/bin/sh # # 2010-2011 Nico Schottelius (nico-cdist at schottelius.org) -# 2020-2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -18,22 +17,12 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # +# # All os variables are lower case # +# -rc_getvar() { - awk -F= -v varname="$2" ' - function unquote(s) { - if (s ~ /^".*"$/ || s ~ /^'\''.*'\''$/) - return substr(s, 2, length(s) - 2) - else - return s - } - $1 == varname { print unquote(substr($0, index($0, "=") + 1)) }' "$1" -} - -case $("${__explorer:?}/os") -in +case "$("$__explorer/os")" in amazon) cat /etc/system-release ;; @@ -42,53 +31,10 @@ in cat /etc/arch-release ;; debian) - debian_version=$(cat /etc/debian_version) - case $debian_version - in - testing/unstable) - # previous to Debian 4.0 testing/unstable was used - # cf. https://metadata.ftp-master.debian.org/changelogs/main/b/base-files/base-files_11_changelog - echo 3.99 - ;; - */sid) - # sid versions don't have a number, so we decode by codename: - case $(expr "$debian_version" : '\([a-z]\{1,\}\)/') - in - trixie) echo 12.99 ;; - bookworm) echo 11.99 ;; - bullseye) echo 10.99 ;; - buster) echo 9.99 ;; - stretch) echo 8.99 ;; - jessie) echo 7.99 ;; - wheezy) echo 6.99 ;; - squeeze) echo 5.99 ;; - lenny) echo 4.99 ;; - *) echo 99.99 ;; - esac - ;; - *) - echo "$debian_version" - ;; - esac + cat /etc/debian_version ;; devuan) - devuan_version=$(cat /etc/devuan_version) - case ${devuan_version} - in - (*/ceres) - # ceres versions don't have a number, so we decode by codename: - case ${devuan_version} - in - (chimaera/ceres) echo 3.99 ;; - (beowulf/ceres) echo 2.99 ;; - (ascii/ceres) echo 1.99 ;; - (*) exit 1 - esac - ;; - (*) - echo "${devuan_version}" - ;; - esac + cat /etc/devuan_version ;; fedora) cat /etc/fedora-release @@ -97,20 +43,7 @@ in cat /etc/gentoo-release ;; macosx) - # NOTE: Legacy versions (< 10.3) do not support options - sw_vers | awk -F ':[ \t]+' '$1 == "ProductVersion" { print $2 }' - ;; - freebsd) - # Apparently uname -r is not a reliable way to get the patch level. - # See: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251743 - if command -v freebsd-version >/dev/null 2>&1 - then - # get userland version - freebsd-version -u - else - # fallback to kernel release for FreeBSD < 10.0 - uname -r - fi + sw_vers -productVersion ;; *bsd|solaris) uname -r @@ -135,22 +68,9 @@ in fi ;; ubuntu) - if command -v lsb_release >/dev/null 2>&1 - then - lsb_release -sr - elif test -r /usr/lib/os-release - then - # fallback to /usr/lib/os-release if lsb_release is not present (like - # on minimized Ubuntu installations) - rc_getvar /usr/lib/os-release VERSION_ID - elif test -r /etc/lsb-release - then - # extract DISTRIB_RELEASE= variable from /etc/lsb-release on old - # versions without /usr/lib/os-release. - rc_getvar /etc/lsb-release DISTRIB_RELEASE - fi + lsb_release -sr ;; alpine) cat /etc/alpine-release ;; -esac +esac \ No newline at end of file diff --git a/cdist/conf/type/__postgres_extension/explorer/state b/cdist/conf/type/__acl/explorer/checks old mode 100644 new mode 100755 similarity index 54% rename from cdist/conf/type/__postgres_extension/explorer/state rename to cdist/conf/type/__acl/explorer/checks index 9d156be7..70bb0412 --- a/cdist/conf/type/__postgres_extension/explorer/state +++ b/cdist/conf/type/__acl/explorer/checks @@ -1,7 +1,6 @@ #!/bin/sh -e -# -*- mode: sh; indent-tabs-mode: t -*- # -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) +# 2019 Ander Punnar (ander-at-kvlt-dot-ee) # # This file is part of cdist. # @@ -18,24 +17,23 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# Prints "present" if the extension is currently installed. -# "absent" otherwise. -quote() { printf '%s\n' "$*" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"; } +# TODO check if filesystem has ACL turned on etc -postgres_user=$("${__type_explorer:?}/postgres_user") - -IFS=: read -r dbname extname < /dev/null + then + echo "missing $param '$check'" >&2 + exit 1 + fi + done fi diff --git a/cdist/conf/type/__acl/explorer/getent b/cdist/conf/type/__acl/explorer/getent deleted file mode 100755 index 7e6c2c30..00000000 --- a/cdist/conf/type/__acl/explorer/getent +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -e - -getent passwd | awk -F: '{print "user:"$1}' -getent group | awk -F: '{print "group:"$1}' diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote index 32318e91..e5404a9d 100755 --- a/cdist/conf/type/__acl/gencode-remote +++ b/cdist/conf/type/__acl/gencode-remote @@ -22,8 +22,8 @@ file_is="$( cat "$__object/explorer/file_is" )" if [ "$file_is" = 'missing' ] \ && [ -z "$__cdist_dry_run" ] \ - && [ ! -f "$__object/parameter/file" ] \ - && [ ! -f "$__object/parameter/directory" ] + && \( [ ! -f "$__object/parameter/file" ] \ + || [ ! -f "$__object/parameter/directory" ] \) then exit 0 fi @@ -47,26 +47,28 @@ then elif [ -f "$__object/parameter/entry" ] then acl_should="$( cat "$__object/parameter/entry" )" +elif [ -f "$__object/parameter/acl" ] +then + acl_should="$( cat "$__object/parameter/acl" )" +elif + [ -f "$__object/parameter/user" ] \ + || [ -f "$__object/parameter/group" ] \ + || [ -f "$__object/parameter/mask" ] \ + || [ -f "$__object/parameter/other" ] +then + acl_should="$( for param in user group mask other + do + [ ! -f "$__object/parameter/$param" ] && continue + + echo "$param" | grep -Eq 'mask|other' && sep=:: || sep=: + + echo "$param$sep$( cat "$__object/parameter/$param" )" + done )" else echo 'no parameters set' >&2 exit 1 fi -# instead of setfacl's non-helpful message "Option -m: Invalid argument near character X" -# let's check if target has necessary users and groups, since mistyped or missing -# users/groups in target is most common reason. -echo "$acl_should" \ - | grep -Po '(user|group):[^:]+' \ - | sort -u \ - | while read -r l - do - if ! grep "$l" -Fxq "$__object/explorer/getent" - then - echo "no $l' in target" | sed "s/:/ '/" >&2 - exit 1 - fi - done - if [ -f "$__object/parameter/default" ] then acl_should="$( echo "$acl_should" \ diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst index 307be72b..28412871 100644 --- a/cdist/conf/type/__acl/man.rst +++ b/cdist/conf/type/__acl/man.rst @@ -12,14 +12,11 @@ Fully supported and tested on Linux (ext4 filesystem), partial support for FreeB See ``setfacl`` and ``acl`` manpages for more details. -One of ``--entry`` or ``--source`` must be used. - -OPTIONAL MULTIPLE PARAMETERS +REQUIRED MULTIPLE PARAMETERS ---------------------------- entry Set ACL entry following ``getfacl`` output syntax. - Must be used if ``--source`` is not used. OPTIONAL PARAMETERS @@ -28,7 +25,6 @@ source Read ACL entries from stdin or file. Ordering of entries is not important. When reading from file, comments and empty lines are ignored. - Must be used if ``--entry`` is not used. file Create/change file with ``__file`` using ``user:group:mode`` pattern. @@ -52,6 +48,12 @@ remove ``mask`` and ``other`` entries can't be removed, but only changed. +DEPRECATED PARAMETERS +--------------------- +Parameters ``acl``, ``user``, ``group``, ``mask`` and ``other`` are deprecated and they +will be removed in future versions. Please use ``entry`` parameter instead. + + EXAMPLES -------- diff --git a/cdist/conf/type/__acl/parameter/deprecated/acl b/cdist/conf/type/__acl/parameter/deprecated/acl new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/acl @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/group b/cdist/conf/type/__acl/parameter/deprecated/group new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/group @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/mask b/cdist/conf/type/__acl/parameter/deprecated/mask new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/mask @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/other b/cdist/conf/type/__acl/parameter/deprecated/other new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/other @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/user b/cdist/conf/type/__acl/parameter/deprecated/user new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/user @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/optional b/cdist/conf/type/__acl/parameter/optional index 5a0c29a3..cdcbc0b8 100644 --- a/cdist/conf/type/__acl/parameter/optional +++ b/cdist/conf/type/__acl/parameter/optional @@ -1,3 +1,5 @@ +mask +other source file directory diff --git a/cdist/conf/type/__acl/parameter/optional_multiple b/cdist/conf/type/__acl/parameter/optional_multiple index 4c884f03..c615d507 100644 --- a/cdist/conf/type/__acl/parameter/optional_multiple +++ b/cdist/conf/type/__acl/parameter/optional_multiple @@ -1 +1,4 @@ entry +acl +user +group diff --git a/cdist/conf/type/__apt_backports/man.rst b/cdist/conf/type/__apt_backports/man.rst deleted file mode 100644 index 7036fb84..00000000 --- a/cdist/conf/type/__apt_backports/man.rst +++ /dev/null @@ -1,104 +0,0 @@ -cdist-type__debian_backports(7) -=============================== - -NAME ----- -cdist-type__apt_backports - Install backports - - -DESCRIPTION ------------ -This singleton type installs backports for the current OS release. -It aborts if backports are not supported for the specified OS or -no version codename could be fetched (like Debian unstable). - -The package index will be automatically updated if required. - -It supports backports from following OSes: - -- Debian -- Devuan -- Ubuntu - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -state - Represents the state of the backports repository. ``present`` or - ``absent``, defaults to ``present``. - - Will be directly passed to :strong:`cdist-type__apt_source`\ (7). - -mirror - The mirror to fetch the backports from. Will defaults to the generic - mirror of the current OS. - - Will be directly passed to :strong:`cdist-type__apt_source`\ (7). - - -BOOLEAN PARAMETERS ------------------- -None. - - -MESSAGES --------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # setup the backports - __apt_backports - __apt_backports --state absent - __apt_backports --state present --mirror "http://ftp.de.debian.org/debian/" - - # install a backports package - # currently for the buster release backports - require="__apt_backports" __package_apt wireguard \ - --target-release buster-backports - - -ABORTS ------- -Aborts if the detected os is not Debian. - -Aborts if no distribuition codename could be detected. This is common for the -unstable distribution, but there is no backports repository for it already. - - -CAVEATS -------- -For Ubuntu, it setup all componenents for the backports repository: ``main``, -``restricted``, ``universe`` and ``multiverse``. The user may not want to -install proprietary packages, which will only be installed if the user -explicitly uses the backports target-release. The user may change this behavior -to install backports packages without the need of explicitly select it. - - -SEE ALSO --------- -`Official Debian Backports site `_ - -:strong:`cdist-type__apt_source`\ (7) - - -AUTHORS -------- -Matthias Stecher - - -COPYING -------- -Copyright \(C) 2020 Matthias Stecher. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_backports/manifest b/cdist/conf/type/__apt_backports/manifest deleted file mode 100755 index 6fcd9212..00000000 --- a/cdist/conf/type/__apt_backports/manifest +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh -e -# __apt_backports/manifest -# -# 2020 Matthias Stecher (matthiasstecher at gmx.de) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# -# Enables/disables backports repository. Utilises __apt_source for it. -# - - -# Get the distribution codename by /etc/os-release. -# is already executed in a subshell by string substitution -# lsb_release may not be given in all installations -codename_os_release() { - # shellcheck disable=SC1090 - # shellcheck disable=SC1091 - . "$__global/explorer/os_release" - printf "%s" "$VERSION_CODENAME" -} - -# detect backport distribution -os="$(cat "$__global/explorer/os")" -case "$os" in - debian) - dist="$( codename_os_release )" - components="main" - mirror="http://deb.debian.org/debian/" - ;; - devuan) - dist="$( codename_os_release )" - components="main" - mirror="http://deb.devuan.org/merged" - ;; - ubuntu) - dist="$( codename_os_release )" - components="main restricted universe multiverse" - mirror="http://archive.ubuntu.com/ubuntu" - ;; - - *) - printf "Backports for %s are not supported!\n" "$os" >&2 - exit 1 - ;; -esac - -# error if no codename given (e.g. on Debian unstable) -if [ -z "$dist" ]; then - printf "No backports for unkown version of distribution %s!\n" "$os" >&2 - exit 1 -fi - - -# parameters -state="$(cat "$__object/parameter/state")" - -# mirror already set for the os, only override user-values -if [ -f "$__object/parameter/mirror" ]; then - mirror="$(cat "$__object/parameter/mirror")" -fi - - -# install the given backports repository -__apt_source "${dist}-backports" \ - --state "$state" \ - --distribution "${dist}-backports" \ - --component "$components" \ - --uri "$mirror" diff --git a/cdist/conf/type/__apt_backports/parameter/default/state b/cdist/conf/type/__apt_backports/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__apt_backports/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__apt_backports/parameter/optional b/cdist/conf/type/__apt_backports/parameter/optional deleted file mode 100644 index 4b05c235..00000000 --- a/cdist/conf/type/__apt_backports/parameter/optional +++ /dev/null @@ -1,2 +0,0 @@ -state -mirror diff --git a/cdist/conf/type/__apt_key/explorer/state b/cdist/conf/type/__apt_key/explorer/state index 8ab268c1..38f1bd3c 100755 --- a/cdist/conf/type/__apt_key/explorer/state +++ b/cdist/conf/type/__apt_key/explorer/state @@ -27,25 +27,18 @@ else keyid="$__object_id" fi -# From apt-key(8): -# Use of apt-key is deprecated, except for the use of apt-key del in -# maintainer scripts to remove existing keys from the main keyring. -# If such usage of apt-key is desired the additional installation of -# the GNU Privacy Guard suite (packaged in gnupg) is required. -if [ -f "${__object}/parameter/use-deprecated-apt-key" ]; then - if apt-key export "$keyid" | head -n 1 | grep -Fqe "BEGIN PGP PUBLIC KEY BLOCK" - then echo present - else echo absent - fi - exit -fi - keydir="$(cat "$__object/parameter/keydir")" keyfile="$keydir/$__object_id.gpg" -if [ -f "$keyfile" ] +if [ -d "$keydir" ] then - echo present - exit + if [ -f "$keyfile" ] + then echo present + else echo absent + fi +else + # fallback to deprecated apt-key + apt-key export "$keyid" | head -n 1 | grep -Fqe "BEGIN PGP PUBLIC KEY BLOCK" \ + && echo present \ + || echo absent fi -echo absent diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote index 17dc9bfc..0c96ff67 100755 --- a/cdist/conf/type/__apt_key/gencode-remote +++ b/cdist/conf/type/__apt_key/gencode-remote @@ -25,7 +25,11 @@ else fi state_should="$(cat "$__object/parameter/state")" state_is="$(cat "$__object/explorer/state")" -method="$(cat "$__object/key_method")" + +if [ "$state_should" = "$state_is" ]; then + # nothing to do + exit 0 +fi keydir="$(cat "$__object/parameter/keydir")" keyfile="$keydir/$__object_id.gpg" @@ -33,18 +37,30 @@ keyfile="$keydir/$__object_id.gpg" case "$state_should" in present) keyserver="$(cat "$__object/parameter/keyserver")" - # Using __download or __file as key source - # Propagate messages if needed - if [ "${method}" = "uri" ] || [ "${method}" = "source" ]; then - if grep -Eq "^__(file|download)$keyfile" "$__messages_in"; then - echo "added '$keyid'" >> "$__messages_out" + + if [ -f "$__object/parameter/uri" ]; then + uri="$(cat "$__object/parameter/uri")" + + if [ -d "$keydir" ]; then + cat << EOF + +curl -s -L \\ + -o "$keyfile" \\ + "$uri" + +key="\$( cat "$keyfile" )" + +if echo "\$key" | grep -Fq 'BEGIN PGP PUBLIC KEY BLOCK' +then + echo "\$key" | gpg --dearmor > "$keyfile" +fi + +EOF + else + # fallback to deprecated apt-key + echo "curl -s -L '$uri' | apt-key add -" fi - exit 0 - elif [ "${state_is}" = "present" ]; then - exit 0 - fi - # Using key servers to fetch the key - if [ ! -f "$__object/parameter/use-deprecated-apt-key" ]; then + elif [ -d "$keydir" ]; then # we need to kill gpg after 30 seconds, because gpg # can get stuck if keyserver is not responding. # exporting env var and not exit 1, @@ -84,16 +100,13 @@ EOF echo "added '$keyid'" >> "$__messages_out" ;; absent) - # Removal for keys added from a keyserver without this flag - # is done in the manifest - if [ "$state_is" != "absent" ] && \ - [ -f "$__object/parameter/use-deprecated-apt-key" ]; then + if [ -f "$keyfile" ]; then + echo "rm '$keyfile'" + else # fallback to deprecated apt-key echo "apt-key del \"$keyid\"" - echo "removed '$keyid'" >> "$__messages_out" - # Propagate messages if needed - elif grep -Eq "^__file$keyfile" "$__messages_in"; then - echo "removed '$keyid'" >> "$__messages_out" fi + + echo "removed '$keyid'" >> "$__messages_out" ;; esac diff --git a/cdist/conf/type/__apt_key/man.rst b/cdist/conf/type/__apt_key/man.rst index e35eaa0f..234bc715 100644 --- a/cdist/conf/type/__apt_key/man.rst +++ b/cdist/conf/type/__apt_key/man.rst @@ -10,14 +10,6 @@ DESCRIPTION ----------- Manages the list of keys used by apt to authenticate packages. -This is done by placing the requested key in a file named -``$__object_id.gpg`` in the ``keydir`` directory. - -This is supported by modern releases of Debian-based distributions. - -In order of preference, exactly one of: ``source``, ``uri`` or ``keyid`` -must be specified. - REQUIRED PARAMETERS ------------------- @@ -26,49 +18,21 @@ None. OPTIONAL PARAMETERS ------------------- -keydir - keyring directory, defaults to ``/etc/apt/trusted.pgp.d``, which is - enabled system-wide by default. - -source - path to a file containing the GPG key of the repository. - Using this is recommended as it ensures that the manifest/type manintainer - has validated the key. - If ``-``, the GPG key is read from the type's stdin. - state 'present' or 'absent'. Defaults to 'present' -uri - the URI from which to download the key. - It is highly recommended that you only use protocols with TLS like HTTPS. - This uses ``__download`` but does not use checksums, if you want to ensure - that the key doesn't change, you are better off downloading it and using - ``--source``. - - -DEPRECATED OPTIONAL PARAMETERS ------------------------------- keyid - the id of the key to download from the ``keyserver``. - This is to be used in absence of ``--source`` and ``--uri`` or together - with ``--use-deprecated-apt-key`` for key removal. - Defaults to ``$__object_id``. + the id of the key to add. Defaults to __object_id keyserver - the keyserver from which to fetch the key. - Defaults to ``pool.sks-keyservers.net``. + the keyserver from which to fetch the key. If omitted the default set + in ./parameter/default/keyserver is used. +keydir + key save location, defaults to ``/etc/apt/trusted.pgp.d`` -DEPRECATED BOOLEAN PARAMETERS ------------------------------ -use-deprecated-apt-key - ``apt-key(8)`` will last be available in Debian 11 and Ubuntu 22.04. - You can use this parameter to force usage of ``apt-key(8)``. - Please only use this parameter to *remove* keys from the keyring, - in order to prepare for removal of ``apt-key``. - Adding keys should be done without this parameter. - This parameter will be removed when Debian 11 stops being supported. +uri + the URI from which to download the key EXAMPLES @@ -76,39 +40,33 @@ EXAMPLES .. code-block:: sh - # add a key that has been verified by a type maintainer - __apt_key jitsi_meet_2021 \ - --source cdist-contrib/type/__jitsi_meet/files/apt_2021.gpg + # Add Ubuntu Archive Automatic Signing Key + __apt_key 437D05B5 + # Same thing + __apt_key 437D05B5 --state present + # Get rid of it + __apt_key 437D05B5 --state absent - # remove an old, deprecated or expired key - __apt_key jitsi_meet_2016 --state absent + # same thing with human readable name and explicit keyid + __apt_key UbuntuArchiveKey --keyid 437D05B5 - # Get rid of a key that might have been added to - # /etc/apt/trusted.gpg with apt-key - __apt_key 0x40976EAF437D05B5 --use-deprecated-apt-key --state absent + # same thing with other keyserver + __apt_key UbuntuArchiveKey --keyid 437D05B5 --keyserver keyserver.ubuntu.com - # add a key that we define in-line - __apt_key jitsi_meet_2021 --source '-' < Ander Punnar -Evilham COPYING ------- -Copyright \(C) 2011-2021 Steven Armstrong, Ander Punnar and Evilham. You can +Copyright \(C) 2011-2019 Steven Armstrong and Ander Punnar. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_key/manifest b/cdist/conf/type/__apt_key/manifest index 889a764a..010357cd 100755 --- a/cdist/conf/type/__apt_key/manifest +++ b/cdist/conf/type/__apt_key/manifest @@ -2,105 +2,7 @@ __package gnupg -state_should="$(cat "${__object}/parameter/state")" - -incompatible_args() -{ - cat >> /dev/stderr <<-EOF - This type does not support --${1} and --${method} simultaneously. - EOF - exit 1 -} - -if [ -f "${__object}/parameter/source" ]; then - method="source" - src="$(cat "${__object}/parameter/source")" - if [ "${src}" = "-" ]; then - src="${__object}/stdin" - fi -fi -if [ -f "${__object}/parameter/uri" ]; then - if [ -n "${method}" ]; then - incompatible_args uri - fi - method="uri" - src="$(cat "${__object}/parameter/uri")" -fi -if [ -f "${__object}/parameter/keyid" ]; then - if [ -n "${method}" ]; then - incompatible_args keyid - fi - method="keyid" -fi -# Keep old default -if [ -z "${method}" ]; then - method="keyid" -fi -# Save this for later in gencode-remote -echo "${method}" > "${__object}/key_method" - -# Required remotely (most likely already installed) -__package dirmngr -# We need this in case a key has to be dearmor'd -__package gnupg -export require="__package/gnupg" - -if [ -f "${__object}/parameter/use-deprecated-apt-key" ]; then - # This is required if apt-key(8) is to be used - if [ "${method}" = "source" ] || [ "${method}" = "uri" ]; then - incompatible_args use-deprecated-apt-key - fi -else - if [ "${state_should}" = "absent" ] && \ - [ -f "${__object}/parameter/keyid" ]; then - cat >> /dev/stderr < -Dennis Camera COPYING ------- -Copyright \(C) 2014 Steven Armstrong, 2020 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright \(C) 2014 Steven Armstrong. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_norecommends/manifest b/cdist/conf/type/__apt_norecommends/manifest index fc187784..e737df89 100755 --- a/cdist/conf/type/__apt_norecommends/manifest +++ b/cdist/conf/type/__apt_norecommends/manifest @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2014 Steven Armstrong (steven-cdist at armstrong.cc) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,28 +19,26 @@ # -os=$(cat "${__global:?}/explorer/os") +os=$(cat "$__global/explorer/os") -case ${os} -in - (ubuntu|debian|devuan) - __file /etc/apt/apt.conf.d/00InstallRecommends --state present \ - --owner root --group root --mode 0644 --source - <<-'EOF' - APT::Install-Recommends "false"; - APT::Install-Suggests "false"; - APT::AutoRemove::RecommendsImportant "false"; - APT::AutoRemove::SuggestsImportant "false"; - EOF - - # TODO: Remove the following object after some time - require=__file/etc/apt/apt.conf.d/00InstallRecommends \ - __file /etc/apt/apt.conf.d/99-no-recommends --state absent - ;; - (*) - cat >&2 <&2 << DONE The developer of this type (${__type##*/}) did not think your operating system ($os) would have any use for it. If you think otherwise please submit a patch. -EOF - exit 1 - ;; +DONE + exit 1 + ;; esac diff --git a/cdist/conf/type/__apt_pin/man.rst b/cdist/conf/type/__apt_pin/man.rst deleted file mode 100644 index 4229c0cd..00000000 --- a/cdist/conf/type/__apt_pin/man.rst +++ /dev/null @@ -1,79 +0,0 @@ -cdist-type__apt_pin(7) -====================== - -NAME ----- -cdist-type__apt_pin - Manage apt pinning rules - - -DESCRIPTION ------------ -Adds/removes/edits rules to pin some packages to a specific distribution. Useful if using multiple debian repositories at the same time. (Useful, if one wants to use a few specific packages from backports or perhaps Debain testing... or even sid.) - - -REQUIRED PARAMETERS -------------------- -distribution - Specifies what distribution the package should be pinned to. Accepts both codenames (buster/bullseye/sid) and suite names (stable/testing/...). - - -OPTIONAL PARAMETERS -------------------- -package - Package name, glob or regular expression to match (multiple) packages. If not specified `__object_id` is used. - -priority - The priority value to assign to matching packages. Deafults to 500. (To match the default target distro's priority) - -state - Will be passed to underlying `__file` type; see there for valid values and defaults. - - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Add the bullseye repo to buster, but do not install any packages by default, - # only if explicitely asked for (-1 means "never" for apt) - __apt_pin bullseye-default \ - --package "*" \ - --distribution bullseye \ - --priority -1 - - require="__apt_pin/bullseye-default" __apt_source bullseye \ - --uri http://deb.debian.org/debian/ \ - --distribution bullseye \ - --component main - - __apt_pin foo --package "foo foo-*" --distribution bullseye - - __foo # Assuming, this installs the `foo` package internally - - __package foo-plugin-extras # Assuming we also need some extra stuff - - -SEE ALSO --------- -:strong:`apt_preferences`\ (5) -:strong:`cdist-type__apt_source`\ (7) -:strong:`cdist-type__apt_backports`\ (7) -:strong:`cdist-type__file`\ (7) - -AUTHORS -------- -Daniel Fancsali - - -COPYING -------- -Copyright \(C) 2021 Daniel Fancsali. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_pin/manifest b/cdist/conf/type/__apt_pin/manifest deleted file mode 100755 index 983b2b42..00000000 --- a/cdist/conf/type/__apt_pin/manifest +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/sh -e -# -# 2021 Daniel Fancsali (fancsali@gmail.com) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - - -name="$__object_id" - -os=$(cat "$__global/explorer/os") -state="$(cat "$__object/parameter/state")" - -if [ -f "$__object/parameter/package" ]; then - package="$(cat "$__object/parameter/package")" -else - package=$name -fi - -distribution="$(cat "$__object/parameter/distribution")" -priority="$(cat "$__object/parameter/priority")" - - -case "$os" in - debian|ubuntu|devuan) - ;; - *) - printf "This type is specific to Debian and it's derivatives" >&2 - exit 1 - ;; -esac - -case $distribution in - stable|testing|unstable|experimental) - pin="release a=$distribution" - ;; - *) - pin="release n=$distribution" - ;; -esac - - -__file "/etc/apt/preferences.d/$name" \ - --owner root --group root --mode 0644 \ - --state "$state" \ - --source - << EOF -# Created by cdist ${__type##*/} -# Do not change. Changes will be overwritten. -# - -# $name -Package: $package -Pin: $pin -Pin-Priority: $priority -EOF diff --git a/cdist/conf/type/__apt_pin/parameter/default/priority b/cdist/conf/type/__apt_pin/parameter/default/priority deleted file mode 100644 index 1b79f38e..00000000 --- a/cdist/conf/type/__apt_pin/parameter/default/priority +++ /dev/null @@ -1 +0,0 @@ -500 diff --git a/cdist/conf/type/__apt_pin/parameter/default/state b/cdist/conf/type/__apt_pin/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__apt_pin/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__apt_pin/parameter/optional b/cdist/conf/type/__apt_pin/parameter/optional deleted file mode 100644 index 847e703d..00000000 --- a/cdist/conf/type/__apt_pin/parameter/optional +++ /dev/null @@ -1,3 +0,0 @@ -state -package -priority diff --git a/cdist/conf/type/__apt_pin/parameter/required b/cdist/conf/type/__apt_pin/parameter/required deleted file mode 100644 index c8572d92..00000000 --- a/cdist/conf/type/__apt_pin/parameter/required +++ /dev/null @@ -1 +0,0 @@ -distribution diff --git a/cdist/conf/type/__apt_source/gencode-remote b/cdist/conf/type/__apt_source/gencode-remote index 973b0f6c..1e8592c6 100755 --- a/cdist/conf/type/__apt_source/gencode-remote +++ b/cdist/conf/type/__apt_source/gencode-remote @@ -22,21 +22,7 @@ name="$__object_id" destination="/etc/apt/sources.list.d/${name}.list" -# There are special arguments to apt(8) to prevent aborts if apt woudn't been -# updated after the 19th April 2021 till the bullseye release. The additional -# arguments acknoledge the happend suite change (the apt(8) update does the -# same by itself). -# -# Using '-o $config' instead of the --allow-releaseinfo-change-* parameter -# allows backward compatablility to pre-buster Debian versions. -# -# See more: ticket #861 -# https://code.ungleich.ch/ungleich-public/cdist/-/issues/861 -apt_opts="-o Acquire::AllowReleaseInfoChange::Suite=true -o Acquire::AllowReleaseInfoChange::Version=true" - -# run 'apt-get update' only if something changed with our sources.list file -# it will be run a second time on error as a redundancy messure to success if grep -q "^__file${destination}" "$__messages_in"; then - printf 'apt-get %s update || apt-get %s update\n' "$apt_opts" "$apt_opts" + printf 'apt-get update || apt-get update\n' fi diff --git a/cdist/conf/type/__apt_update_index/gencode-remote b/cdist/conf/type/__apt_update_index/gencode-remote index 2d7f9030..70b59710 100755 --- a/cdist/conf/type/__apt_update_index/gencode-remote +++ b/cdist/conf/type/__apt_update_index/gencode-remote @@ -18,23 +18,9 @@ # along with cdist. If not, see . # - -# There are special arguments to apt(8) to prevent aborts if apt woudn't been -# updated after the 19th April 2021 till the bullseye release. The additional -# arguments acknoledge the happend suite change (the apt(8) update does the -# same by itself). -# -# Using '-o $config' instead of the --allow-releaseinfo-change-* parameter -# allows backward compatablility to pre-buster Debian versions. -# -# See more: ticket #861 -# https://code.ungleich.ch/ungleich-public/cdist/-/issues/861 -apt_opts="-o Acquire::AllowReleaseInfoChange::Suite=true -o Acquire::AllowReleaseInfoChange::Version=true" - # run 'apt-get update' if anything in /etc/apt is newer then /var/lib/apt/lists -# it will be run a second time on error as a redundancy messure to success cat << DONE if find /etc/apt -mindepth 1 -cnewer /var/lib/apt/lists | grep . > /dev/null; then - apt-get $apt_opts update || apt-get $apt_opts update + apt-get update || apt-get update fi DONE diff --git a/cdist/conf/type/__block/gencode-remote b/cdist/conf/type/__block/gencode-remote index 7a1f4064..1f5cc033 100755 --- a/cdist/conf/type/__block/gencode-remote +++ b/cdist/conf/type/__block/gencode-remote @@ -46,29 +46,28 @@ fi remove_block() { cat << DONE -tmpfile=\$(mktemp ${quoted_file}.cdist.XXXXXXXXXX) +tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX) # preserve ownership and permissions of existing file -if [ -f $quoted_file ]; then - cp -p $quoted_file "\$tmpfile" +if [ -f "$file" ]; then + cp -p "$file" "\$tmpfile" fi -awk -v prefix=$(quote "$prefix") -v suffix=$(quote "$suffix") ' +awk -v prefix=^$(quote "$prefix")\$ -v suffix=^$(quote "$suffix")\$ ' { - if (\$0 == prefix) { + if (match(\$0,prefix)) { triggered=1 } if (triggered) { - if (\$0 == suffix) { + if (match(\$0,suffix)) { triggered=0 } } else { print } -}' $quoted_file > "\$tmpfile" -mv -f "\$tmpfile" $quoted_file +}' "$file" > "\$tmpfile" +mv -f "\$tmpfile" "$file" DONE } -quoted_file="$(quote "$file")" case "$state_should" in present) if [ "$state_is" = "changed" ]; then @@ -78,7 +77,7 @@ case "$state_should" in echo add >> "$__messages_out" fi cat << DONE -cat >> $quoted_file << '${__type##*/}_DONE' +cat >> "$file" << ${__type##*/}_DONE $(cat "$block") ${__type##*/}_DONE DONE diff --git a/cdist/conf/type/__cdist/manifest b/cdist/conf/type/__cdist/manifest index 0b0f1263..a97cf288 100755 --- a/cdist/conf/type/__cdist/manifest +++ b/cdist/conf/type/__cdist/manifest @@ -37,7 +37,6 @@ source="$(cat "$__object/parameter/source")" # out of it home=/home/$username -# shellcheck disable=SC2086 __user "$username" --home "$home" $shell require="__user/$username" __directory "$home" \ diff --git a/cdist/conf/type/__clean_path/explorer/list b/cdist/conf/type/__clean_path/explorer/list index 2bdc63a5..07d38127 100755 --- a/cdist/conf/type/__clean_path/explorer/list +++ b/cdist/conf/type/__clean_path/explorer/list @@ -18,12 +18,7 @@ # along with cdist. If not, see . # -if [ -f "$__object/parameter/path" ] -then - path="$( cat "$__object/parameter/path" )" -else - path="/$__object_id" -fi +path="/$__object_id" [ ! -d "$path" ] && exit 0 diff --git a/cdist/conf/type/__clean_path/gencode-remote b/cdist/conf/type/__clean_path/gencode-remote index 2899c4a5..998a70d8 100755 --- a/cdist/conf/type/__clean_path/gencode-remote +++ b/cdist/conf/type/__clean_path/gencode-remote @@ -20,12 +20,7 @@ [ ! -s "$__object/explorer/list" ] && exit 0 -if [ -f "$__object/parameter/path" ] -then - path="$( cat "$__object/parameter/path" )" -else - path="/$__object_id" -fi +path="/$__object_id" pattern="$( cat "$__object/parameter/pattern" )" diff --git a/cdist/conf/type/__clean_path/man.rst b/cdist/conf/type/__clean_path/man.rst index 31d90701..826f4589 100644 --- a/cdist/conf/type/__clean_path/man.rst +++ b/cdist/conf/type/__clean_path/man.rst @@ -10,7 +10,7 @@ DESCRIPTION ----------- Remove files and directories which match the pattern. -Provided path must be a directory. +Provided path (as __object_id) must be a directory. Patterns are passed to ``find``'s ``-regex`` - see ``find(1)`` for more details. @@ -29,9 +29,6 @@ pattern OPTIONAL PARAMETERS ------------------- -path - Path which will be cleaned. Defaults to ``$__object_id``. - exclude Pattern of files which are excluded from removal. @@ -49,11 +46,6 @@ EXAMPLES --exclude '.+\(charset\.conf\|security\.conf\)' \ --onchange 'service apache2 restart' - __clean_path apache2-conf-enabled \ - --path /etc/apache2/conf-enabled \ - --pattern '.+' \ - --exclude '.+\(charset\.conf\|security\.conf\)' \ - --onchange 'service apache2 restart' AUTHORS ------- diff --git a/cdist/conf/type/__clean_path/parameter/optional b/cdist/conf/type/__clean_path/parameter/optional index 3b97f71c..6f313474 100644 --- a/cdist/conf/type/__clean_path/parameter/optional +++ b/cdist/conf/type/__clean_path/parameter/optional @@ -1,3 +1,2 @@ exclude onchange -path diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest index 7b54529c..0d819d45 100755 --- a/cdist/conf/type/__consul_agent/manifest +++ b/cdist/conf/type/__consul_agent/manifest @@ -1,7 +1,7 @@ #!/bin/sh -e # # 2015 Steven Armstrong (steven-cdist at armstrong.cc) -# 2015-2020 Nico Schottelius (nico-cdist at schottelius.org) +# 2015-2019 Nico Schottelius (nico-cdist at schottelius.org) # 2019 Timothée Floure (timothee.floure at ungleich.ch) # # This file is part of cdist. @@ -37,22 +37,10 @@ fi # Those are default that might be overriden by os-specific logic. data_dir="/var/lib/consul" - - - +conf_dir="/etc/consul/conf.d" +conf_file="config.json" tls_dir="$conf_dir/tls" -case "$os" in - alpine) - conf_dir="/etc/consul" - conf_file="server.json" - ;; - *) - conf_dir="/etc/consul/conf.d" - conf_file="config.json" - ;; -esac - ### # Sane deployment, based on distribution package when available. @@ -232,7 +220,7 @@ if [ -f "$__object/parameter/ca-file-source" ] || \ [ -f "$__object/parameter/cert-file-source" ] || \ [ -f "$__object/parameter/key-file-source" ]; then - requires="$config_deployment_requires" __directory "$tls_dir" \ + requires="$config_deployment_requires" __directory $tls_dir \ --owner root --group "$group" --mode 750 --state "$state" # Append to service restart requirements. diff --git a/cdist/conf/type/__coturn/files/turnserver.conf.sh b/cdist/conf/type/__coturn/files/turnserver.conf.sh new file mode 100755 index 00000000..0e2f2995 --- /dev/null +++ b/cdist/conf/type/__coturn/files/turnserver.conf.sh @@ -0,0 +1,744 @@ +#!/bin/sh + +generate_use_auth_secret () { + if [ $USE_AUTH_SECRET ]; then + echo 'use-auth-secret' + else + echo '#use-auth-secret' + fi +} + +generate_static_auth_secret () { + if [ "$STATIC_AUTH_SECRET" $! "" ]; then + echo "static-auth-secret=$STATIC_AUTH_SECRET" + else + echo "#static-auth-secret=north" + fi +} + +generate_realm () { + if [ "$REALM" != "" ]; then + echo "realm=$REALM" + else + echo "#realm=mycompany.org" + fi +} + +generate_no_tcp_relay () { + if [ $NO_TCP_RELAY ]; then + echo 'no-tcp-releay' + else + echo '#no-tcp-relay' + fi +} + +cat << EOF +# Coturn TURN SERVER configuration file +# +# Boolean values note: where boolean value is supposed to be used, +# you can use '0', 'off', 'no', 'false', 'f' as 'false, +# and you can use '1', 'on', 'yes', 'true', 't' as 'true' +# If the value is missed, then it means 'true'. +# + +# Listener interface device (optional, Linux only). +# NOT RECOMMENDED. +# +#listening-device=eth0 + +# TURN listener port for UDP and TCP (Default: 3478). +# Note: actually, TLS & DTLS sessions can connect to the +# "plain" TCP & UDP port(s), too - if allowed by configuration. +# +#listening-port=3478 + +# TURN listener port for TLS (Default: 5349). +# Note: actually, "plain" TCP & UDP sessions can connect to the TLS & DTLS +# port(s), too - if allowed by configuration. The TURN server +# "automatically" recognizes the type of traffic. Actually, two listening +# endpoints (the "plain" one and the "tls" one) are equivalent in terms of +# functionality; but we keep both endpoints to satisfy the RFC 5766 specs. +# For secure TCP connections, we currently support SSL version 3 and +# TLS version 1.0, 1.1 and 1.2. +# For secure UDP connections, we support DTLS version 1. +# +#tls-listening-port=5349 + +# Alternative listening port for UDP and TCP listeners; +# default (or zero) value means "listening port plus one". +# This is needed for RFC 5780 support +# (STUN extension specs, NAT behavior discovery). The TURN Server +# supports RFC 5780 only if it is started with more than one +# listening IP address of the same family (IPv4 or IPv6). +# RFC 5780 is supported only by UDP protocol, other protocols +# are listening to that endpoint only for "symmetry". +# +#alt-listening-port=0 + +# Alternative listening port for TLS and DTLS protocols. +# Default (or zero) value means "TLS listening port plus one". +# +#alt-tls-listening-port=0 + +# Listener IP address of relay server. Multiple listeners can be specified. +# If no IP(s) specified in the config file or in the command line options, +# then all IPv4 and IPv6 system IPs will be used for listening. +# +#listening-ip=172.17.19.101 +#listening-ip=10.207.21.238 +#listening-ip=2607:f0d0:1002:51::4 + +# Auxiliary STUN/TURN server listening endpoint. +# Aux servers have almost full TURN and STUN functionality. +# The (minor) limitations are: +# +# 1) Auxiliary servers do not have alternative ports and +# they do not support STUN RFC 5780 functionality (CHANGE REQUEST). +# +# 2) Auxiliary servers also are never returning ALTERNATIVE-SERVER reply. +# +# Valid formats are 1.2.3.4:5555 for IPv4 and [1:2::3:4]:5555 for IPv6. +# +# There may be multiple aux-server options, each will be used for listening +# to client requests. +# +#aux-server=172.17.19.110:33478 +#aux-server=[2607:f0d0:1002:51::4]:33478 + +# (recommended for older Linuxes only) +# Automatically balance UDP traffic over auxiliary servers (if configured). +# The load balancing is using the ALTERNATE-SERVER mechanism. +# The TURN client must support 300 ALTERNATE-SERVER response for this +# functionality. +# +#udp-self-balance + +# Relay interface device for relay sockets (optional, Linux only). +# NOT RECOMMENDED. +# +#relay-device=eth1 + +# Relay address (the local IP address that will be used to relay the +# packets to the peer). +# Multiple relay addresses may be used. +# The same IP(s) can be used as both listening IP(s) and relay IP(s). +# +# If no relay IP(s) specified, then the turnserver will apply the default +# policy: it will decide itself which relay addresses to be used, and it +# will always be using the client socket IP address as the relay IP address +# of the TURN session (if the requested relay address family is the same +# as the family of the client socket). +# +#relay-ip=172.17.19.105 +#relay-ip=2607:f0d0:1002:51::5 + +# For Amazon EC2 users: +# +# TURN Server public/private address mapping, if the server is behind NAT. +# In that situation, if a -X is used in form "-X " then that ip will be reported +# as relay IP address of all allocations. This scenario works only in a simple case +# when one single relay address is be used, and no RFC5780 functionality is required. +# That single relay address must be mapped by NAT to the 'external' IP. +# The "external-ip" value, if not empty, is returned in XOR-RELAYED-ADDRESS field. +# For that 'external' IP, NAT must forward ports directly (relayed port 12345 +# must be always mapped to the same 'external' port 12345). +# +# In more complex case when more than one IP address is involved, +# that option must be used several times, each entry must +# have form "-X ", to map all involved addresses. +# RFC5780 NAT discovery STUN functionality will work correctly, +# if the addresses are mapped properly, even when the TURN server itself +# is behind A NAT. +# +# By default, this value is empty, and no address mapping is used. +# +#external-ip=60.70.80.91 +# +#OR: +# +#external-ip=60.70.80.91/172.17.19.101 +#external-ip=60.70.80.92/172.17.19.102 + + +# Number of the relay threads to handle the established connections +# (in addition to authentication thread and the listener thread). +# If explicitly set to 0 then application runs relay process in a +# single thread, in the same thread with the listener process +# (the authentication thread will still be a separate thread). +# +# If this parameter is not set, then the default OS-dependent +# thread pattern algorithm will be employed. Usually the default +# algorithm is the most optimal, so you have to change this option +# only if you want to make some fine tweaks. +# +# In the older systems (Linux kernel before 3.9), +# the number of UDP threads is always one thread per network listening +# endpoint - including the auxiliary endpoints - unless 0 (zero) or +# 1 (one) value is set. +# +#relay-threads=0 + +# Lower and upper bounds of the UDP relay endpoints: +# (default values are 49152 and 65535) +# +#min-port=49152 +#max-port=65535 + +# Uncomment to run TURN server in 'normal' 'moderate' verbose mode. +# By default the verbose mode is off. +#verbose + +# Uncomment to run TURN server in 'extra' verbose mode. +# This mode is very annoying and produces lots of output. +# Not recommended under any normal circumstances. +# +#Verbose + +# Uncomment to use fingerprints in the TURN messages. +# By default the fingerprints are off. +# +#fingerprint + +# Uncomment to use long-term credential mechanism. +# By default no credentials mechanism is used (any user allowed). +# +#lt-cred-mech + +# This option is opposite to lt-cred-mech. +# (TURN Server with no-auth option allows anonymous access). +# If neither option is defined, and no users are defined, +# then no-auth is default. If at least one user is defined, +# in this file or in command line or in usersdb file, then +# lt-cred-mech is default. +# +#no-auth + +# TURN REST API flag. +# (Time Limited Long Term Credential) +# Flag that sets a special authorization option that is based upon authentication secret. +# +# This feature's purpose is to support "TURN Server REST API", see +# "TURN REST API" link in the project's page +# https://github.com/coturn/coturn/ +# +# This option is used with timestamp: +# +# usercombo -> "timestamp:userid" +# turn user -> usercombo +# turn password -> base64(hmac(secret key, usercombo)) +# +# This allows TURN credentials to be accounted for a specific user id. +# If you don't have a suitable id, the timestamp alone can be used. +# This option is just turning on secret-based authentication. +# The actual value of the secret is defined either by option static-auth-secret, +# or can be found in the turn_secret table in the database (see below). +# +# Read more about it: +# - https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00 +# - https://www.ietf.org/proceedings/87/slides/slides-87-behave-10.pdf +# +# Be aware that use-auth-secret overrides some part of lt-cred-mech. +# Notice that this feature depends internally on lt-cred-mech, so if you set +# use-auth-secret then it enables internally automatically lt-cred-mech option +# like if you enable both. +# +# You can use only one of the to auth mechanisms in the same time because, +# both mechanism use the username and password validation in different way. +# +# This way be aware that you can't use both auth mechnaism in the same time! +# Use in config either the lt-cred-mech or the use-auth-secret +# to avoid any confusion. +# +$(generate_use_auth_secret) + +# 'Static' authentication secret value (a string) for TURN REST API only. +# If not set, then the turn server +# will try to use the 'dynamic' value in turn_secret table +# in user database (if present). The database-stored value can be changed on-the-fly +# by a separate program, so this is why that other mode is 'dynamic'. +# +$(generate_static_auth_secret) + +# Server name used for +# the oAuth authentication purposes. +# The default value is the realm name. +# +#server-name=blackdow.carleon.gov + +# Flag that allows oAuth authentication. +# +#oauth + +# 'Static' user accounts for long term credentials mechanism, only. +# This option cannot be used with TURN REST API. +# 'Static' user accounts are NOT dynamically checked by the turnserver process, +# so that they can NOT be changed while the turnserver is running. +# +#user=username1:key1 +#user=username2:key2 +# OR: +#user=username1:password1 +#user=username2:password2 +# +# Keys must be generated by turnadmin utility. The key value depends +# on user name, realm, and password: +# +# Example: +# $ turnadmin -k -u ninefingers -r north.gov -p youhavetoberealistic +# Output: 0xbc807ee29df3c9ffa736523fb2c4e8ee +# ('0x' in the beginning of the key is what differentiates the key from +# password. If it has 0x then it is a key, otherwise it is a password). +# +# The corresponding user account entry in the config file will be: +# +#user=ninefingers:0xbc807ee29df3c9ffa736523fb2c4e8ee +# Or, equivalently, with open clear password (less secure): +#user=ninefingers:youhavetoberealistic +# + +# SQLite database file name. +# +# Default file name is /var/db/turndb or /usr/local/var/db/turndb or +# /var/lib/turn/turndb. +# +#userdb=/var/db/turndb + +# PostgreSQL database connection string in the case that we are using PostgreSQL +# as the user database. +# This database can be used for long-term credential mechanism +# and it can store the secret value for secret-based timed authentication in TURN RESP API. +# See http://www.postgresql.org/docs/8.4/static/libpq-connect.html for 8.x PostgreSQL +# versions connection string format, see +# http://www.postgresql.org/docs/9.2/static/libpq-connect.html#LIBPQ-CONNSTRING +# for 9.x and newer connection string formats. +# +#psql-userdb="host= dbname= user= password= connect_timeout=30" + +# MySQL database connection string in the case that we are using MySQL +# as the user database. +# This database can be used for long-term credential mechanism +# and it can store the secret value for secret-based timed authentication in TURN RESP API. +# +# Optional connection string parameters for the secure communications (SSL): +# ca, capath, cert, key, cipher +# (see http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html for the +# command options description). +# +# Use string format as below (space separated parameters, all optional): +# +#mysql-userdb="host= dbname= user= password= port= connect_timeout= read_timeout=" + +# If you want to use in the MySQL connection string the password in encrypted format, +# then set in this option the MySQL password encryption secret key file. +# +# Warning: If this option is set, then mysql password must be set in "mysql-userdb" in encrypted format! +# If you want to use cleartext password then do not set this option! +# +# This is the file path which contain secret key of aes encryption while using password encryption. +# +#secret-key-file=/path/ + +# MongoDB database connection string in the case that we are using MongoDB +# as the user database. +# This database can be used for long-term credential mechanism +# and it can store the secret value for secret-based timed authentication in TURN RESP API. +# Use string format is described at http://hergert.me/docs/mongo-c-driver/mongoc_uri.html +# +#mongo-userdb="mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][/[database][?options]]" + +# Redis database connection string in the case that we are using Redis +# as the user database. +# This database can be used for long-term credential mechanism +# and it can store the secret value for secret-based timed authentication in TURN RESP API. +# Use string format as below (space separated parameters, all optional): +# +#redis-userdb="ip= dbname= password= port= connect_timeout=" + +# Redis status and statistics database connection string, if used (default - empty, no Redis stats DB used). +# This database keeps allocations status information, and it can be also used for publishing +# and delivering traffic and allocation event notifications. +# The connection string has the same parameters as redis-userdb connection string. +# Use string format as below (space separated parameters, all optional): +# +#redis-statsdb="ip= dbname= password= port= connect_timeout=" + +# The default realm to be used for the users when no explicit +# origin/realm relationship was found in the database, or if the TURN +# server is not using any database (just the commands-line settings +# and the userdb file). Must be used with long-term credentials +# mechanism or with TURN REST API. +# +# Note: If default realm is not specified at all, then realm falls back to the host domain name. +# If domain name is empty string, or '(None)', then it is initialized to am empty string. +# +$(generate_realm) + +# The flag that sets the origin consistency +# check: across the session, all requests must have the same +# main ORIGIN attribute value (if the ORIGIN was +# initially used by the session). +# +#check-origin-consistency + +# Per-user allocation quota. +# default value is 0 (no quota, unlimited number of sessions per user). +# This option can also be set through the database, for a particular realm. +# +#user-quota=0 + +# Total allocation quota. +# default value is 0 (no quota). +# This option can also be set through the database, for a particular realm. +# +#total-quota=0 + +# Max bytes-per-second bandwidth a TURN session is allowed to handle +# (input and output network streams are treated separately). Anything above +# that limit will be dropped or temporary suppressed (within +# the available buffer limits). +# This option can also be set through the database, for a particular realm. +# +#max-bps=0 + +# +# Maximum server capacity. +# Total bytes-per-second bandwidth the TURN server is allowed to allocate +# for the sessions, combined (input and output network streams are treated separately). +# +# bps-capacity=0 + +# Uncomment if no UDP client listener is desired. +# By default UDP client listener is always started. +# +#no-udp + +# Uncomment if no TCP client listener is desired. +# By default TCP client listener is always started. +# +#no-tcp + +# Uncomment if no TLS client listener is desired. +# By default TLS client listener is always started. +# +#no-tls + +# Uncomment if no DTLS client listener is desired. +# By default DTLS client listener is always started. +# +#no-dtls + +# Uncomment if no UDP relay endpoints are allowed. +# By default UDP relay endpoints are enabled (like in RFC 5766). +# +#no-udp-relay + +# Uncomment if no TCP relay endpoints are allowed. +# By default TCP relay endpoints are enabled (like in RFC 6062). +# +$(generate_no_tcp_relay) + +# Uncomment if extra security is desired, +# with nonce value having limited lifetime. +# By default, the nonce value is unique for a session, +# and has unlimited lifetime. +# Set this option to limit the nonce lifetime. +# It defaults to 600 secs (10 min) if no value is provided. After that delay, +# the client will get 438 error and will have to re-authenticate itself. +# +#stale-nonce=600 + +# Uncomment if you want to set the maximum allocation +# time before it has to be refreshed. +# Default is 3600s. +# +#max-allocate-lifetime=3600 + + +# Uncomment to set the lifetime for the channel. +# Default value is 600 secs (10 minutes). +# This value MUST not be changed for production purposes. +# +#channel-lifetime=600 + +# Uncomment to set the permission lifetime. +# Default to 300 secs (5 minutes). +# In production this value MUST not be changed, +# however it can be useful for test purposes. +# +#permission-lifetime=300 + +# Certificate file. +# Use an absolute path or path relative to the +# configuration file. +# +#cert=/usr/local/etc/turn_server_cert.pem + +# Private key file. +# Use an absolute path or path relative to the +# configuration file. +# Use PEM file format. +# +#pkey=/usr/local/etc/turn_server_pkey.pem + +# Private key file password, if it is in encoded format. +# This option has no default value. +# +#pkey-pwd=... + +# Allowed OpenSSL cipher list for TLS/DTLS connections. +# Default value is "DEFAULT". +# +#cipher-list="DEFAULT" + +# CA file in OpenSSL format. +# Forces TURN server to verify the client SSL certificates. +# By default it is not set: there is no default value and the client +# certificate is not checked. +# +# Example: +#CA-file=/etc/ssh/id_rsa.cert + +# Curve name for EC ciphers, if supported by OpenSSL +# library (TLS and DTLS). The default value is prime256v1, +# if pre-OpenSSL 1.0.2 is used. With OpenSSL 1.0.2+, +# an optimal curve will be automatically calculated, if not defined +# by this option. +# +#ec-curve-name=prime256v1 + +# Use 566 bits predefined DH TLS key. Default size of the key is 1066. +# +#dh566 + +# Use 2066 bits predefined DH TLS key. Default size of the key is 1066. +# +#dh2066 + +# Use custom DH TLS key, stored in PEM format in the file. +# Flags --dh566 and --dh2066 are ignored when the DH key is taken from a file. +# +#dh-file= + +# Flag to prevent stdout log messages. +# By default, all log messages are going to both stdout and to +# the configured log file. With this option everything will be +# going to the configured log only (unless the log file itself is stdout). +# +#no-stdout-log + +# Option to set the log file name. +# By default, the turnserver tries to open a log file in +# /var/log, /var/tmp, /tmp and current directories directories +# (which open operation succeeds first that file will be used). +# With this option you can set the definite log file name. +# The special names are "stdout" and "-" - they will force everything +# to the stdout. Also, the "syslog" name will force everything to +# the system log (syslog). +# In the runtime, the logfile can be reset with the SIGHUP signal +# to the turnserver process. +# +#log-file=/var/tmp/turn.log + +# Option to redirect all log output into system log (syslog). +# +syslog + +# This flag means that no log file rollover will be used, and the log file +# name will be constructed as-is, without PID and date appendage. +# This option can be used, for example, together with the logrotate tool. +# +#simple-log + +# Option to set the "redirection" mode. The value of this option +# will be the address of the alternate server for UDP & TCP service in form of +# [:]. The server will send this value in the attribute +# ALTERNATE-SERVER, with error 300, on ALLOCATE request, to the client. +# Client will receive only values with the same address family +# as the client network endpoint address family. +# See RFC 5389 and RFC 5766 for ALTERNATE-SERVER functionality description. +# The client must use the obtained value for subsequent TURN communications. +# If more than one --alternate-server options are provided, then the functionality +# can be more accurately described as "load-balancing" than a mere "redirection". +# If the port number is omitted, then the default port +# number 3478 for the UDP/TCP protocols will be used. +# Colon (:) characters in IPv6 addresses may conflict with the syntax of +# the option. To alleviate this conflict, literal IPv6 addresses are enclosed +# in square brackets in such resource identifiers, for example: +# [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 . +# Multiple alternate servers can be set. They will be used in the +# round-robin manner. All servers in the pool are considered of equal weight and +# the load will be distributed equally. For example, if we have 4 alternate servers, +# then each server will receive 25% of ALLOCATE requests. A alternate TURN server +# address can be used more than one time with the alternate-server option, so this +# can emulate "weighting" of the servers. +# +# Examples: +#alternate-server=1.2.3.4:5678 +#alternate-server=11.22.33.44:56789 +#alternate-server=5.6.7.8 +#alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 + +# Option to set alternative server for TLS & DTLS services in form of +# :. If the port number is omitted, then the default port +# number 5349 for the TLS/DTLS protocols will be used. See the previous +# option for the functionality description. +# +# Examples: +#tls-alternate-server=1.2.3.4:5678 +#tls-alternate-server=11.22.33.44:56789 +#tls-alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 + +# Option to suppress TURN functionality, only STUN requests will be processed. +# Run as STUN server only, all TURN requests will be ignored. +# By default, this option is NOT set. +# +#stun-only + +# Option to suppress STUN functionality, only TURN requests will be processed. +# Run as TURN server only, all STUN requests will be ignored. +# By default, this option is NOT set. +# +#no-stun + +# This is the timestamp/username separator symbol (character) in TURN REST API. +# The default value is ':'. +# rest-api-separator=: + +# Flag that can be used to allow peers on the loopback addresses (127.x.x.x and ::1). +# This is an extra security measure. +# +# (To avoid any security issue that allowing loopback access may raise, +# the no-loopback-peers option is replaced by allow-loopback-peers.) +# +# Allow it only for testing in a development environment! +# In production it adds a possible security vulnerability, so for security reasons +# it is not allowed using it together with empty cli-password. +# +#allow-loopback-peers + +# Flag that can be used to disallow peers on well-known broadcast addresses (224.0.0.0 and above, and FFXX:*). +# This is an extra security measure. +# +#no-multicast-peers + +# Option to set the max time, in seconds, allowed for full allocation establishment. +# Default is 60 seconds. +# +#max-allocate-timeout=60 + +# Option to allow or ban specific ip addresses or ranges of ip addresses. +# If an ip address is specified as both allowed and denied, then the ip address is +# considered to be allowed. This is useful when you wish to ban a range of ip +# addresses, except for a few specific ips within that range. +# +# This can be used when you do not want users of the turn server to be able to access +# machines reachable by the turn server, but would otherwise be unreachable from the +# internet (e.g. when the turn server is sitting behind a NAT) +# +# Examples: +# denied-peer-ip=83.166.64.0-83.166.95.255 +# allowed-peer-ip=83.166.68.45 + +# File name to store the pid of the process. +# Default is /var/run/turnserver.pid (if superuser account is used) or +# /var/tmp/turnserver.pid . +# +#pidfile="/var/run/turnserver.pid" + +# Require authentication of the STUN Binding request. +# By default, the clients are allowed anonymous access to the STUN Binding functionality. +# +#secure-stun + +# Mobility with ICE (MICE) specs support. +# +#mobility + +# Allocate Address Family according +# If enabled then TURN server allocates address family according the TURN +# Client <=> Server communication address family. +# (By default coTURN works according RFC 6156.) +# !!Warning: Enabling this option breaks RFC6156 section-4.2 (violates use default IPv4)!! +# +#keep-address-family + + +# User name to run the process. After the initialization, the turnserver process +# will make an attempt to change the current user ID to that user. +# +#proc-user= + +# Group name to run the process. After the initialization, the turnserver process +# will make an attempt to change the current group ID to that group. +# +#proc-group= + +# Turn OFF the CLI support. +# By default it is always ON. +# See also options cli-ip and cli-port. +# +#no-cli + +#Local system IP address to be used for CLI server endpoint. Default value +# is 127.0.0.1. +# +#cli-ip=127.0.0.1 + +# CLI server port. Default is 5766. +# +#cli-port=5766 + +# CLI access password. Default is empty (no password). +# For the security reasons, it is recommended to use the encrypted +# for of the password (see the -P command in the turnadmin utility). +# +# Secure form for password 'qwerty': +# +#cli-password=$5$79a316b350311570$81df9cfb9af7f5e5a76eada31e7097b663a0670f99a3c07ded3f1c8e59c5658a +# +# Or unsecure form for the same password: +# +#cli-password=qwerty + +# Enable Web-admin support on https. By default it is Disabled. +# If it is enabled it also enables a http a simple static banner page +# with a small reminder that the admin page is available only on https. +# +#web-admin + +# Local system IP address to be used for Web-admin server endpoint. Default value is 127.0.0.1. +# +#web-admin-ip=127.0.0.1 + +# Web-admin server port. Default is 8080. +# +#web-admin-port=8080 + +# Web-admin server listen on STUN/TURN worker threads +# By default it is disabled for security resons! (Not recommended in any production environment!) +# +#web-admin-listen-on-workers + +# Server relay. NON-STANDARD AND DANGEROUS OPTION. +# Only for those applications when we want to run +# server applications on the relay endpoints. +# This option eliminates the IP permissions check on +# the packets incoming to the relay endpoints. +# +#server-relay + +# Maximum number of output sessions in ps CLI command. +# This value can be changed on-the-fly in CLI. The default value is 256. +# +#cli-max-output-sessions + +# Set network engine type for the process (for internal purposes). +# +#ne=[1|2|3] + +# Do not allow an TLS/DTLS version of protocol +# +#no-tlsv1 +#no-tlsv1_1 +#no-tlsv1_2 +EOF diff --git a/cdist/conf/type/__coturn/man.rst b/cdist/conf/type/__coturn/man.rst new file mode 100644 index 00000000..219da4ea --- /dev/null +++ b/cdist/conf/type/__coturn/man.rst @@ -0,0 +1,61 @@ +cdist-type__coturn(7) +===================== + +NAME +---- +cdist-type__coturn - Install and configure a coturn TURN server + + +DESCRIPTION +----------- +This (singleton) type install and configure a coturn TURN +server. + + +REQUIRED PARAMETERS +------------------- +None. + + +OPTIONAL PARAMETERS +------------------- +static_auth_secret + Secret used to access the TURN REST API. + +realm + Defailt realm. + +BOOLEAN PARAMETERS +------------------ +use_auth_secret + Allows TURN credentials to be accounted for a specific user id. + +no_tcp_relay + Disable TCP relay endpoints. + + +EXAMPLES +-------- + +.. code-block:: sh + + __coturn \ + --realm turn.domain.tld \ + --no_tcp_relay + + +SEE ALSO +-------- +- `coturn Github repository `_ + +AUTHORS +------- +Timothée Floure + + +COPYING +------- +Copyright \(C) 2020 Timothée Floure. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__coturn/manifest b/cdist/conf/type/__coturn/manifest new file mode 100755 index 00000000..915f587d --- /dev/null +++ b/cdist/conf/type/__coturn/manifest @@ -0,0 +1,55 @@ +#!/bin/sh -e +# +# 2020 Timothée Floure (timothee.floure@ungleich.ch) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# + +__package coturn + +# Optional parameters. +if [ -f "$__object/parameter/use_auth_secret" ]; then + export USE_AUTH_SECRET=1 +fi + +if [ -f "$__object/parameter/static_auth_secret" ]; then + static_auth_secret=$(cat "$__object/parameter/static_auth_secret") + export STATIC_AUTH_SECRET=$static_auth_secret +fi + +if [ -f "$__object/parameter/realm" ]; then + realm=$(cat "$__object/parameter/realm") + export REALM=$realm +fi + +if [ -f "$__object/parameter/no_tcp_relay" ]; then + no_tcp_relay=$(cat "$__object/parameter/no_tcp_relay") + export NO_TCP_RELAY=$no_tcp_relay +fi + +# Hardcoded. +coturn_config='/etc/turnserver.conf' + +# Generate and deploy configuration file. +mkdir -p "$__object/files" +"$__type/files/turnserver.conf.sh" > "$__object/files/turnserver.conf" + +__file $coturn_config \ + --source "$__object/files/turnserver.conf" \ + --state present + +# Restart coturn server. +require="__file/$coturn_config" __service coturn --action restart diff --git a/cdist/conf/type/__coturn/parameter/boolean b/cdist/conf/type/__coturn/parameter/boolean new file mode 100644 index 00000000..45f9e704 --- /dev/null +++ b/cdist/conf/type/__coturn/parameter/boolean @@ -0,0 +1,2 @@ +use_auth_secret +no_tcp_relay diff --git a/cdist/conf/type/__coturn/parameter/optional b/cdist/conf/type/__coturn/parameter/optional new file mode 100644 index 00000000..33218485 --- /dev/null +++ b/cdist/conf/type/__coturn/parameter/optional @@ -0,0 +1,2 @@ +static_auth_secret +realm diff --git a/cdist/conf/type/__apt_backports/singleton b/cdist/conf/type/__coturn/singleton similarity index 100% rename from cdist/conf/type/__apt_backports/singleton rename to cdist/conf/type/__coturn/singleton diff --git a/cdist/conf/type/__cron/man.rst b/cdist/conf/type/__cron/man.rst index e39bfb5c..d0694738 100644 --- a/cdist/conf/type/__cron/man.rst +++ b/cdist/conf/type/__cron/man.rst @@ -21,11 +21,6 @@ command OPTIONAL PARAMETERS ------------------- -**NOTE**: All time-related parameters (``--minute``, ``--hour``, ``--day_of_month`` -``--month`` and ``--day_of_week``) defaults to ``*``, which means to execute it -**always**. If you set ``--hour 0`` to execute the cronjob only at midnight, it -will execute **every** minute in the first hour of the morning all days. - state Either present or absent. Defaults to present. minute diff --git a/cdist/conf/type/__debconf_set_selections/explorer/state b/cdist/conf/type/__debconf_set_selections/explorer/state deleted file mode 100644 index f8a3f6c8..00000000 --- a/cdist/conf/type/__debconf_set_selections/explorer/state +++ /dev/null @@ -1,142 +0,0 @@ -#!/bin/sh -e -# -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Determine current debconf selections' state. -# Prints one of: -# present: all selections are already set as they should. -# different: one or more of the selections have a different value. -# absent: one or more of the selections are not (currently) defined. -# - -test -x /usr/bin/perl || { - # cannot find perl (no perl ~ no debconf) - echo 'absent' - exit 0 -} - -linesfile="${__object:?}/parameter/line" -test -s "${linesfile}" || { - if test -s "${__object:?}/parameter/file" - then - echo absent - else - echo present - fi - exit 0 -} - -# assert __type_explorer is set (because it is used by the Perl script) -: "${__type_explorer:?}" - -/usr/bin/perl -- - "${linesfile}" <<'EOF' -use strict; -use warnings "all"; - -use Fcntl qw(:DEFAULT :flock); - -use Debconf::Db; -use Debconf::Question; - -# Extract @known... arrays from debconf-set-selections -# These values are required to distinguish flags and values in the given lines. -# DC: I couldn't think of a more ugly solution to the problem… -my @knownflags; -my @knowntypes; -my $debconf_set_selections = '/usr/bin/debconf-set-selections'; -if (-e $debconf_set_selections) { - my $sed_known = 's/^my \(@known\(flags\|types\) = qw([a-z ]*);\).*$/\1/p'; - eval `sed -n '$sed_known' '$debconf_set_selections'`; -} - -sub mungeline ($) { - my $line = shift; - chomp $line; - $line =~ s/\r$//; - return $line; -} - -sub fatal { printf STDERR @_; exit 1; } - -my $state = 'present'; - -sub state { - my $new = shift; - if ($state eq 'present' - or ($state eq 'different' and $new eq 'absent')) { - $state = $new; - } -} - - -# Load Debconf DB but manually lock on the state explorer script, -# because Debconf aborts immediately if executed concurrently. -# This is not really an ideal solution because the Debconf DB could be locked by -# another process (e.g. apt-get), but no way to achieve this could be found. -# If you know how to, please provide a patch. -my $lockfile = "%ENV{'__type_explorer'}/state"; -if (open my $lock_fh, '+<', $lockfile) { - flock $lock_fh, LOCK_EX or die "Cannot lock $lockfile"; -} -{ - Debconf::Db->load(readonly => 'true'); -} - - -while (<>) { - # Read and process lines (taken from debconf-set-selections) - $_ = mungeline($_); - while (/\\$/ && ! eof) { - s/\\$//; - $_ .= mungeline(<>); - } - next if /^\s*$/ || /^\s*\#/; - - my ($owner, $label, $type, $content) = /^\s*(\S+)\s+(\S+)\s+(\S+)(?:\s(.*))?/ - or fatal "invalid line: %s\n", $_; - $content = '' unless defined $content; - - - # Compare is and should state - my $q = Debconf::Question->get($label); - - unless (defined $q) { - # probably a preseed - state 'absent'; - next; - } - - if (grep { $_ eq $q->type } @knownflags) { - # This line wants to set a flag, presumably. - if ($q->flag($q->type) ne $content) { - state 'different'; - } - } else { - # Otherwise, it's probably a value… - if ($q->value ne $content) { - state 'different'; - } - - unless (grep { $_ eq $owner } (split /, /, $q->owners)) { - state 'different'; - } - } -} - -printf "%s\n", $state; -EOF diff --git a/cdist/conf/type/__debconf_set_selections/gencode-remote b/cdist/conf/type/__debconf_set_selections/gencode-remote index 9ba28f09..e99aef40 100755 --- a/cdist/conf/type/__debconf_set_selections/gencode-remote +++ b/cdist/conf/type/__debconf_set_selections/gencode-remote @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2011-2014 Nico Schottelius (nico-cdist at schottelius.org) -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -18,37 +17,16 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # +# +# Setup selections +# -if test -f "${__object:?}/parameter/line" -then - filename="${__object:?}/parameter/line" -elif test -s "${__object:?}/parameter/file" -then - filename=$(cat "${__object:?}/parameter/file") - if test "${filename}" = '-' - then - filename="${__object:?}/stdin" - fi -else - printf 'Neither --line nor --file set.\n' >&2 - exit 1 +filename="$(cat "$__object/parameter/file")" + +if [ "$filename" = "-" ]; then + filename="$__object/stdin" fi -# setting no lines makes no sense -test -s "${filename}" || exit 0 - -state_is=$(cat "${__object:?}/explorer/state") - -if test "${state_is}" != 'present' -then - cat <<-CODE - debconf-set-selections <<'EOF' - $(cat "${filename}") - EOF - CODE - - awk ' - { - printf "set %s %s %s %s\n", $1, $2, $3, $4 - }' "${filename}" >>"${__messages_out:?}" -fi +echo "debconf-set-selections << __file-eof" +cat "$filename" +echo "__file-eof" diff --git a/cdist/conf/type/__debconf_set_selections/man.rst b/cdist/conf/type/__debconf_set_selections/man.rst index fd0040ae..58c25b81 100644 --- a/cdist/conf/type/__debconf_set_selections/man.rst +++ b/cdist/conf/type/__debconf_set_selections/man.rst @@ -8,33 +8,15 @@ cdist-type__debconf_set_selections - Setup debconf selections DESCRIPTION ----------- -On Debian and alike systems :strong:`debconf-set-selections`\ (1) can be used +On Debian and alike systems debconf-set-selections(1) can be used to setup configuration parameters. REQUIRED PARAMETERS ------------------- -cf. ``--line``. - - -OPTIONAL PARAMETERS -------------------- file - Use the given filename as input for :strong:`debconf-set-selections`\ (1) - If filename is ``-``, read from stdin. - - **This parameter is deprecated, because it doesn't work with state detection.** -line - A line in :strong:`debconf-set-selections`\ (1) compatible format. - This parameter can be used multiple times to set multiple options. - - (This parameter is actually required, but marked optional because the - deprecated ``--file`` is still accepted.) - - -BOOLEAN PARAMETERS ------------------- -None. + Use the given filename as input for debconf-set-selections(1) + If filename is "-", read from stdin. EXAMPLES @@ -42,29 +24,30 @@ EXAMPLES .. code-block:: sh - # Setup gitolite's gituser - __debconf_set_selections nslcd --line 'gitolite gitolite/gituser string git' + # Setup configuration for nslcd + __debconf_set_selections nslcd --file /path/to/file - # Setup configuration for nslcd from a file. - # NB: Multiple lines can be passed to --line, although this can be considered a hack. - __debconf_set_selections nslcd --line "$(cat "${__files:?}/preseed/nslcd.debconf")" + # Setup configuration for nslcd from another type + __debconf_set_selections nslcd --file "$__type/files/preseed/nslcd" + + __debconf_set_selections nslcd --file - << eof + gitolite gitolite/gituser string git + eof SEE ALSO -------- -- :strong:`cdist-type__update_alternatives`\ (7) -- :strong:`debconf-set-selections`\ (1) +:strong:`debconf-set-selections`\ (1), :strong:`cdist-type__update_alternatives`\ (7) AUTHORS ------- -| Nico Schottelius -| Dennis Camera +Nico Schottelius COPYING ------- -Copyright \(C) 2011-2014 Nico Schottelius, 2021 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright \(C) 2011-2014 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__debconf_set_selections/manifest b/cdist/conf/type/__debconf_set_selections/manifest deleted file mode 100755 index 0f4fb2e2..00000000 --- a/cdist/conf/type/__debconf_set_selections/manifest +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh -e -# -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -__package_apt debconf diff --git a/cdist/conf/type/__debconf_set_selections/parameter/deprecated/file b/cdist/conf/type/__debconf_set_selections/parameter/deprecated/file deleted file mode 100644 index 09db545a..00000000 --- a/cdist/conf/type/__debconf_set_selections/parameter/deprecated/file +++ /dev/null @@ -1 +0,0 @@ -'file' has been deprecated in favour of 'line' in order to provide idempotency. diff --git a/cdist/conf/type/__debconf_set_selections/parameter/optional_multiple b/cdist/conf/type/__debconf_set_selections/parameter/optional_multiple deleted file mode 100644 index a999a0c2..00000000 --- a/cdist/conf/type/__debconf_set_selections/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -line diff --git a/cdist/conf/type/__debconf_set_selections/parameter/optional b/cdist/conf/type/__debconf_set_selections/parameter/required similarity index 100% rename from cdist/conf/type/__debconf_set_selections/parameter/optional rename to cdist/conf/type/__debconf_set_selections/parameter/required diff --git a/cdist/conf/type/__directory/explorer/stat b/cdist/conf/type/__directory/explorer/stat index f817cb02..105d894f 100755 --- a/cdist/conf/type/__directory/explorer/stat +++ b/cdist/conf/type/__directory/explorer/stat @@ -30,10 +30,10 @@ fallback() { gid=$(echo "$ls_line" | awk '{ print $4 }') owner=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/passwd) - group=$(awk -F: -v gid="$gid" '$3 == gid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group) + group=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group) mode_text=$(echo "$ls_line" | awk '{ print $1 }') - mode=$(echo "$mode_text" | awk '{for(i=8;i>=0;--i){c=substr($1,10-i,1);k+=((c~/[rwxst]/)*2^i);if(!(i%3))k+=(tolower(c)~/[lst]/)*2^(9+i/3)}printf("%04o",k)}') + mode=$(echo "$mode_text" | awk '{ k=0; for (i=0; i<=8; i++) k += ((substr($1, i+2, 1) ~ /[rwx]/) * 2^(8-i)); printf("%0o", k) }') printf 'type: %s\nowner: %d %s\ngroup: %d %s\nmode: %s %s\n' \ "$("$__type_explorer/type")" \ @@ -45,27 +45,56 @@ fallback() { # nothing to work with, nothing we could do [ -e "$destination" ] || exit 0 -command -v stat >/dev/null 2>&1 || { +if ! command -v stat >/dev/null +then fallback exit -} +fi -case $("$__explorer/os") -in - freebsd|netbsd|openbsd|macosx) - stat -f 'type: %HT +case $("$__explorer/os") in + "freebsd"|"netbsd"|"openbsd"|"macosx") + stat -f "type: %HT owner: %Du %Su group: %Dg %Sg -mode: %Mp%03Lp %Sp -' "$destination" | awk '/^type/ { print tolower($0); next } { print }' +mode: %Lp %Sp +" "$destination" | awk '/^type/ { print tolower($0); next } { print }' ;; + solaris) + ls1="$( ls -ld "$destination" )" + ls2="$( ls -ldn "$destination" )" + + if [ -f "$__object/parameter/mode" ] + then mode_should="$( cat "$__object/parameter/mode" )" + fi + + # yes, it is ugly hack, but if you know better way... + if [ -z "$( find "$destination" -perm "$mode_should" )" ] + then octets=888 + else octets="$( echo "$mode_should" | sed 's/^0//' )" + fi + + case "$( echo "$ls1" | cut -c1-1 )" in + -) echo 'type: regular file' ;; + d) echo 'type: directory' ;; + esac + + echo "owner: $( echo "$ls2" \ + | awk '{print $3}' ) $( echo "$ls1" \ + | awk '{print $3}' )" + + echo "group: $( echo "$ls2" \ + | awk '{print $4}' ) $( echo "$ls1" \ + | awk '{print $4}' )" + + echo "mode: $octets $( echo "$ls1" | awk '{print $1}' )" + ;; *) # NOTE: Do not use --printf here as it is not supported by BusyBox stat. # NOTE: BusyBox's stat might not support the "-c" option, in which case # we fall through to the shell fallback. - stat -c 'type: %F + stat -c "type: %F owner: %u %U group: %g %G -mode: %04a %A' "$destination" 2>/dev/null || fallback - ;; +mode: %a %A" "$destination" 2>/dev/null || fallback + ;; esac diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote index d9c00b56..374db47a 100755 --- a/cdist/conf/type/__directory/gencode-remote +++ b/cdist/conf/type/__directory/gencode-remote @@ -3,7 +3,6 @@ # 2011-2013 Nico Schottelius (nico-cdist at schottelius.org) # 2013 Steven Armstrong (steven-cdist armstrong.cc) # 2014 Daniel Heule (hda at sfs.biz) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -22,8 +21,8 @@ # destination="/$__object_id" -state_should=$(cat "$__object/parameter/state") -type=$(cat "$__object/explorer/type") +state_should="$(cat "$__object/parameter/state")" +type="$(cat "$__object/explorer/type")" stat_file="$__object/explorer/stat" # variable to keep track if we have to set directory attributes @@ -73,7 +72,7 @@ set_mode() { } case "$state_should" in - present|exists) + present) if [ "$type" != "directory" ]; then set_attributes=1 if [ "$type" != "none" ]; then @@ -84,10 +83,6 @@ case "$state_should" in fi echo "mkdir $mkdiropt '$destination'" echo "create" >> "$__messages_out" - elif [ "$state_should" = 'exists' ]; then - # The type is directory and --state exists. We are done and do not - # check or set the attributes. - exit 0 fi # Note: Mode - needs to happen last as a chown/chgrp can alter mode by @@ -97,11 +92,9 @@ case "$state_should" in value_should="$(cat "$__object/parameter/$attribute")" value_is="$(get_current_value "$attribute" "$value_should")" - # format mode in four digits => same as stat returns + # change 0xxx format to xxx format => same as stat returns if [ "$attribute" = mode ]; then - # Convert to four-digit octal number (printf interprets - # strings with leading 0s as octal!) - value_should=$(printf '%04o' "0${value_should}") + value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')" fi if [ "$set_attributes" = 1 ] || [ "$value_should" != "$value_is" ]; then @@ -110,26 +103,6 @@ case "$state_should" in fi done ;; - pre-exists) - case $type in - directory) - # all good - exit 0 - ;; - none) - printf 'Directory "%s" does not exist\n' "$destination" >&2 - exit 1 - ;; - file|symlink) - printf 'File "%s" exists and is a %s, but should be a directory\n' "$destination" "$type" >&2 - exit 1 - ;; - *) - printf 'File or directory "%s" is in an unknown state\n' "$destination" >&2 - exit 1 - ;; - esac - ;; absent) if [ "$type" = "directory" ]; then echo "rm -rf '$destination'" diff --git a/cdist/conf/type/__directory/man.rst b/cdist/conf/type/__directory/man.rst index 7755334c..74b00afe 100644 --- a/cdist/conf/type/__directory/man.rst +++ b/cdist/conf/type/__directory/man.rst @@ -19,18 +19,7 @@ None. OPTIONAL PARAMETERS ------------------- state - 'present', 'absent', 'exists' or 'pre-exists', defaults to 'present' where: - - present - the directory exists and the given attributes are set. - absent - the directory does not exist. - exists - the directory exists, but its attributes are not altered if it already - existed. - pre-exists - check that the directory exists and is indeed a directory, but do not - create or modify it. + 'present' or 'absent', defaults to 'present' group Group to chgrp to. @@ -47,7 +36,7 @@ BOOLEAN PARAMETERS parents Whether to create parents as well (mkdir -p behaviour). Warning: all intermediate directory permissions default - to whatever mkdir -p does. + to whatever mkdir -p does. Usually this means root:root, 0700. diff --git a/cdist/conf/type/__dot_file/man.rst b/cdist/conf/type/__dot_file/man.rst index ba7621a1..ae65eb95 100644 --- a/cdist/conf/type/__dot_file/man.rst +++ b/cdist/conf/type/__dot_file/man.rst @@ -25,9 +25,6 @@ user OPTIONAL PARAMETERS ------------------- -dirmode - forwarded to :strong:`__directory` type as mode - mode forwarded to :strong:`__file` type diff --git a/cdist/conf/type/__dot_file/manifest b/cdist/conf/type/__dot_file/manifest index 02dadf05..5e4957e5 100755 --- a/cdist/conf/type/__dot_file/manifest +++ b/cdist/conf/type/__dot_file/manifest @@ -19,7 +19,6 @@ set -eu user="$(cat "${__object}/parameter/user")" home="$(cat "${__object}/explorer/home")" primary_group="$(cat "${__object}/explorer/primary_group")" -dirmode="$(cat "${__object}/parameter/dirmode")" # Create parent directory. Type __directory has flag 'parents', but it # will leave us with root-owned directory in user home, which is not @@ -37,7 +36,6 @@ export CDIST_ORDER_DEPENDENCY for dir ; do __directory "${home}/${dir}" \ --group "${primary_group}" \ - --mode "${dirmode}" \ --owner "${user}" done diff --git a/cdist/conf/type/__dot_file/parameter/default/dirmode b/cdist/conf/type/__dot_file/parameter/default/dirmode deleted file mode 100644 index e9745d1f..00000000 --- a/cdist/conf/type/__dot_file/parameter/default/dirmode +++ /dev/null @@ -1 +0,0 @@ -0700 diff --git a/cdist/conf/type/__dot_file/parameter/optional b/cdist/conf/type/__dot_file/parameter/optional index 9f7f83fb..ccab9fa6 100644 --- a/cdist/conf/type/__dot_file/parameter/optional +++ b/cdist/conf/type/__dot_file/parameter/optional @@ -1,4 +1,3 @@ state mode source -dirmode diff --git a/cdist/conf/type/__download/explorer/remote_cmd_get b/cdist/conf/type/__download/explorer/remote_cmd_get deleted file mode 100755 index 9f1cd59c..00000000 --- a/cdist/conf/type/__download/explorer/remote_cmd_get +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh -e - -if [ -f "$__object/parameter/cmd-get" ] -then - cat "$__object/parameter/cmd-get" -elif - command -v curl > /dev/null -then - echo "curl -sSL -o - '%s'" -elif - command -v fetch > /dev/null -then - echo "fetch -o - '%s'" -else - echo "wget -O - '%s'" -fi diff --git a/cdist/conf/type/__download/explorer/remote_cmd_sum b/cdist/conf/type/__download/explorer/remote_cmd_sum deleted file mode 100755 index 84df663c..00000000 --- a/cdist/conf/type/__download/explorer/remote_cmd_sum +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh -e - -if [ ! -f "$__object/parameter/sum" ] -then - exit 0 -fi - -if [ -f "$__object/parameter/cmd-sum" ] -then - cat "$__object/parameter/cmd-sum" - exit 0 -fi - -sum_should="$( cat "$__object/parameter/sum" )" - -if echo "$sum_should" | grep -Fq ':' -then - sum_hash="$( echo "$sum_should" | cut -d : -f 1 )" -else - if echo "$sum_should" | grep -Eq '^[0-9]+\s[0-9]+$' - then - sum_hash='cksum' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{32}$' - then - sum_hash='md5' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{40}$' - then - sum_hash='sha1' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{64}$' - then - sum_hash='sha256' - else - echo 'hash format detection failed' >&2 - exit 1 - fi -fi - -os="$( "$__explorer/os" )" - -case "$sum_hash" in - cksum) - echo "cksum %s | awk '{print \$1\" \"\$2}'" - ;; - md5) - case "$os" in - freebsd) - echo "md5 -q %s" - ;; - *) - echo "md5sum %s | awk '{print \$1}'" - ;; - esac - ;; - sha1) - case "$os" in - freebsd) - echo "sha1 -q %s" - ;; - *) - echo "sha1sum %s | awk '{print \$1}'" - ;; - esac - ;; - sha256) - case "$os" in - freebsd) - echo "sha256 -q %s" - ;; - *) - echo "sha256sum %s | awk '{print \$1}'" - ;; - esac - ;; - *) - # we arrive here only if --sum is given with unknown format prefix - echo "unknown hash format: $sum_hash" >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__download/explorer/state b/cdist/conf/type/__download/explorer/state deleted file mode 100755 index 8c5d5ce1..00000000 --- a/cdist/conf/type/__download/explorer/state +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/sh -e - -if [ -f "$__object/parameter/destination" ] -then - dst="$( cat "$__object/parameter/destination" )" -else - dst="/$__object_id" -fi - -if [ ! -f "$dst" ] -then - echo 'absent' - exit 0 -fi - -if [ ! -f "$__object/parameter/sum" ] -then - echo 'present' - exit 0 -fi - -sum_should="$( cat "$__object/parameter/sum" )" - -if echo "$sum_should" | grep -Fq ':' -then - sum_should="$( echo "$sum_should" | cut -d : -f 2 )" -fi - -sum_cmd="$( "$__type_explorer/remote_cmd_sum" )" - -# shellcheck disable=SC2059 -sum_is="$( eval "$( printf "$sum_cmd" "'$dst'" )" )" - -if [ -z "$sum_is" ] -then - echo 'existing destination checksum failed' >&2 - exit 1 -fi - -if [ "$sum_is" = "$sum_should" ] -then - echo 'present' -else - echo 'mismatch' -fi diff --git a/cdist/conf/type/__download/gencode-local b/cdist/conf/type/__download/gencode-local deleted file mode 100755 index d1b0d0d5..00000000 --- a/cdist/conf/type/__download/gencode-local +++ /dev/null @@ -1,155 +0,0 @@ -#!/bin/sh -e - -download="$( cat "$__object/parameter/download" )" - -state_is="$( cat "$__object/explorer/state" )" - -if [ "$download" != 'local' ] || [ "$state_is" = 'present' ] -then - exit 0 -fi - -url="$( cat "$__object/parameter/url" )" - -if [ -f "$__object/parameter/destination" ] -then - dst="$( cat "$__object/parameter/destination" )" -else - dst="/$__object_id" -fi - -if [ -f "$__object/parameter/cmd-get" ] -then - cmd="$( cat "$__object/parameter/cmd-get" )" - -elif command -v curl > /dev/null -then - cmd="curl -sSL -o - '%s'" - -elif command -v fetch > /dev/null -then - cmd="fetch -o - '%s'" - -elif command -v wget > /dev/null -then - cmd="wget -O - '%s'" - -else - echo 'local download failed, no usable utility' >&2 - exit 1 -fi - -echo "download_tmp=\"\$( mktemp )\"" - -# shellcheck disable=SC2059 -printf "$cmd > \"\$download_tmp\"\n" "$url" - -if [ -f "$__object/parameter/sum" ] -then - sum_should="$( cat "$__object/parameter/sum" )" - - if [ -f "$__object/parameter/cmd-sum" ] - then - local_cmd_sum="$( cat "$__object/parameter/cmd-sum" )" - else - if echo "$sum_should" | grep -Fq ':' - then - sum_hash="$( echo "$sum_should" | cut -d : -f 1 )" - - sum_should="$( echo "$sum_should" | cut -d : -f 2 )" - else - if echo "$sum_should" | grep -Eq '^[0-9]+\s[0-9]+$' - then - sum_hash='cksum' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{32}$' - then - sum_hash='md5' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{40}$' - then - sum_hash='sha1' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{64}$' - then - sum_hash='sha256' - else - echo 'hash format detection failed' >&2 - exit 1 - fi - fi - - case "$sum_hash" in - cksum) - local_cmd_sum="cksum %s | awk '{print \$1\" \"\$2}'" - ;; - md5) - if command -v md5 > /dev/null - then - local_cmd_sum="md5 -q %s" - elif - command -v md5sum > /dev/null - then - local_cmd_sum="md5sum %s | awk '{print \$1}'" - fi - ;; - sha1) - if command -v sha1 > /dev/null - then - local_cmd_sum="sha1 -q %s" - elif - command -v sha1sum > /dev/null - then - local_cmd_sum="sha1sum %s | awk '{print \$1}'" - fi - ;; - sha256) - if command -v sha256 > /dev/null - then - local_cmd_sum="sha256 -q %s" - elif - command -v sha256sum > /dev/null - then - local_cmd_sum="sha256sum %s | awk '{print \$1}'" - fi - ;; - *) - # we arrive here only if --sum is given with unknown format prefix - echo "unknown hash format: $sum_hash" >&2 - exit 1 - ;; - esac - - if [ -z "$local_cmd_sum" ] - then - echo 'local checksum verification failed, no usable utility' >&2 - exit 1 - fi - fi - - # shellcheck disable=SC2059 - echo "sum_is=\"\$( $( printf "$local_cmd_sum" "\"\$download_tmp\"" ) )\"" - - echo "if [ \"\$sum_is\" != '$sum_should' ]; then" - - echo "echo 'local download checksum mismatch' >&2" - - echo "rm -f \"\$download_tmp\"" - - echo 'exit 1; fi' -fi - -if echo "$__target_host" | grep -Eq '^[0-9a-fA-F:]+$' -then - target_host="[$__target_host]" -else - target_host="$__target_host" -fi - -# shellcheck disable=SC2016 -printf '%s "$download_tmp" %s:%s\n' \ - "$__remote_copy" \ - "$target_host" \ - "$dst" - -echo "rm -f \"\$download_tmp\"" diff --git a/cdist/conf/type/__download/gencode-remote b/cdist/conf/type/__download/gencode-remote deleted file mode 100755 index e49bcec3..00000000 --- a/cdist/conf/type/__download/gencode-remote +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/sh -e - -download="$( cat "$__object/parameter/download" )" - -state_is="$( cat "$__object/explorer/state" )" - -if [ "$download" = 'remote' ] && [ "$state_is" != 'present' ] -then - cmd_get="$( cat "$__object/explorer/remote_cmd_get" )" - - url="$( cat "$__object/parameter/url" )" - - if [ -f "$__object/parameter/destination" ] - then - dst="$( cat "$__object/parameter/destination" )" - else - dst="/$__object_id" - fi - - echo "download_tmp=\"\$( mktemp )\"" - - # shellcheck disable=SC2059 - printf "$cmd_get > \"\$download_tmp\"\n" "$url" - - if [ -f "$__object/parameter/sum" ] - then - sum_should="$( cat "$__object/parameter/sum" )" - - if [ -f "$__object/parameter/cmd-sum" ] - then - remote_cmd_sum="$( cat "$__object/parameter/cmd-sum" )" - else - remote_cmd_sum="$( cat "$__object/explorer/remote_cmd_sum" )" - - if echo "$sum_should" | grep -Fq ':' - then - sum_should="$( echo "$sum_should" | cut -d : -f 2 )" - fi - fi - - # shellcheck disable=SC2059 - echo "sum_is=\"\$( $( printf "$remote_cmd_sum" "\"\$download_tmp\"" ) )\"" - - echo "if [ \"\$sum_is\" != '$sum_should' ]; then" - - echo "echo 'remote download checksum mismatch' >&2" - - echo "rm -f \"\$download_tmp\"" - - echo 'exit 1; fi' - fi - - echo "mv \"\$download_tmp\" '$dst'" -fi - -if [ -f "$__object/parameter/onchange" ] && [ "$state_is" != "present" ] -then - cat "$__object/parameter/onchange" -fi diff --git a/cdist/conf/type/__download/man.rst b/cdist/conf/type/__download/man.rst deleted file mode 100644 index c16510a9..00000000 --- a/cdist/conf/type/__download/man.rst +++ /dev/null @@ -1,101 +0,0 @@ -cdist-type__download(7) -======================= - -NAME ----- -cdist-type__download - Download a file - - -DESCRIPTION ------------ -By default type will try to use ``curl``, ``fetch`` or ``wget``. -If download happens in target (see ``--download``) then type will -fallback to (and install) ``wget``. - -If download happens in local machine, then environment variables like -``{http,https,ftp}_proxy`` etc can be used on cdist execution -(``http_proxy=foo cdist config ...``). - -To change downloaded file's owner, group or permissions, use ``require='__download/path/to/file' __file ...``. - - -REQUIRED PARAMETERS -------------------- -url - File's URL. - - -OPTIONAL PARAMETERS -------------------- -destination - Downloaded file's destination in target. If unset, ``$__object_id`` is used. - -sum - Supported formats: ``cksum`` output without file name, MD5, SHA1 and SHA256. - - Type tries to detect hash format with regexes, but prefixes - ``cksum:``, ``md5:``, ``sha1:`` and ``sha256:`` are also supported. - - Checksum have two purposes - state check and post-download verification. - In state check, if destination checksum mismatches, then content of URL - will be downloaded to temporary file. If downloaded temporary file's - checksum matches, then it will be moved to destination (overwritten). - - For local downloads it is expected that usable utilities for checksum - calculation exist in the system. - -download - If ``local`` (default), then file is downloaded to local storage and copied - to target host. If ``remote``, then download happens in target. - - For local downloads it is expected that usable utilities for downloading - exist in the system. Type will try to use ``curl``, ``fetch`` or ``wget``. - -cmd-get - Command used for downloading. - Command must output to ``stdout``. - Parameter will be used for ``printf`` and must include only one - format specification ``%s`` which will become URL. - For example: ``wget -O - '%s'``. - -cmd-sum - Command used for checksum calculation. - Command output and ``--sum`` parameter must match. - Parameter will be used for ``printf`` and must include only one - format specification ``%s`` which will become destination. - For example: ``md5sum '%s' | awk '{print $1}'``. - -onchange - Execute this command after download. - - -EXAMPLES --------- - -.. code-block:: sh - - __directory /opt/cpma - - require='__directory/opt/cpma' \ - __download /opt/cpma/cnq3.zip \ - --url https://cdn.playmorepromode.com/files/cnq3/cnq3-1.51.zip \ - --sum 46da3021ca9eace277115ec9106c5b46 - - require='__download/opt/cpma/cnq3.zip' \ - __unpack /opt/cpma/cnq3.zip \ - --backup-destination \ - --preserve-archive \ - --destination /opt/cpma/server - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2021 Ander Punnar. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__download/manifest b/cdist/conf/type/__download/manifest deleted file mode 100755 index 3d4c498b..00000000 --- a/cdist/conf/type/__download/manifest +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/sh -e - -if grep -Eq '^wget' "$__object/explorer/remote_cmd_get" -then - __package wget -fi diff --git a/cdist/conf/type/__download/parameter/default/download b/cdist/conf/type/__download/parameter/default/download deleted file mode 100644 index 40830374..00000000 --- a/cdist/conf/type/__download/parameter/default/download +++ /dev/null @@ -1 +0,0 @@ -local diff --git a/cdist/conf/type/__download/parameter/optional b/cdist/conf/type/__download/parameter/optional deleted file mode 100644 index e809ef78..00000000 --- a/cdist/conf/type/__download/parameter/optional +++ /dev/null @@ -1,6 +0,0 @@ -cmd-get -cmd-sum -destination -download -onchange -sum diff --git a/cdist/conf/type/__download/parameter/required b/cdist/conf/type/__download/parameter/required deleted file mode 100644 index 96cdd3b9..00000000 --- a/cdist/conf/type/__download/parameter/required +++ /dev/null @@ -1 +0,0 @@ -url diff --git a/cdist/conf/type/__dpkg_architecture/explorer/architecture b/cdist/conf/type/__dpkg_architecture/explorer/architecture deleted file mode 100755 index 03e7e386..00000000 --- a/cdist/conf/type/__dpkg_architecture/explorer/architecture +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -e -# __dpkg_architecture/explorer/architecture -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# Get the main architecture of this machine - - -# print or die in the gencode-remote -dpkg --print-architecture || true diff --git a/cdist/conf/type/__dpkg_architecture/explorer/foreign-architectures b/cdist/conf/type/__dpkg_architecture/explorer/foreign-architectures deleted file mode 100755 index a150d307..00000000 --- a/cdist/conf/type/__dpkg_architecture/explorer/foreign-architectures +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -e -# __dpkg_architecture/explorer/foreign-architectures -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# Print all additional architectures - - -# print or die in the gencode-remote -dpkg --print-foreign-architectures || true diff --git a/cdist/conf/type/__dpkg_architecture/gencode-remote b/cdist/conf/type/__dpkg_architecture/gencode-remote deleted file mode 100755 index 47fb24e7..00000000 --- a/cdist/conf/type/__dpkg_architecture/gencode-remote +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh -e -# __dpkg_architecture/gencode-remote -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - - -# Get parameter and explorer -state_should="$(cat "$__object/parameter/state")" -arch_wanted="$__object_id" -main_arch="$(cat "$__object/explorer/architecture")" - -# Exit here if dpkg do not work (empty explorer) -if [ -z "$main_arch" ]; then - echo "dpkg is not available or unable to detect a architecture!" >&2 - exit 1 -fi - - -# Check if requested architecture is the main one -if [ "$arch_wanted" = "$main_arch" ]; then - # higher than present; we can not remove it - state_is="present" - caution="yes" - -# Check if the architecture not already used -elif grep -qFx "$arch_wanted" "$__object/explorer/foreign-architectures"; then - state_is="present" - -# arch does not exist -else - state_is="absent" -fi - - -# Check what to do -if [ "$state_is" != "$state_should" ]; then - case "$state_should" in - present) - # print add code - printf "dpkg --add-architecture '%s'\n" "$arch_wanted" - # updating the index to make the new architecture available - echo "apt update" - - echo added >> "$__messages_out" - ;; - - absent) - if [ "$caution" ]; then - printf "can not remove the main arch '%s' of the system!\n" "$main_arch" >&2 - exit 1 - fi - - # removing all existing packages for the architecture - printf "apt purge '.*:%s'\n" "$arch_wanted" - # print remove code - printf "dpkg --remove-architecture '%s'\n" "$arch_wanted" - - echo removed >> "$__messages_out" - ;; - - *) - printf "state '%s' is unknown!\n" "$state_should" >&2 - exit 1 - ;; - esac -fi diff --git a/cdist/conf/type/__dpkg_architecture/man.rst b/cdist/conf/type/__dpkg_architecture/man.rst deleted file mode 100644 index fa196229..00000000 --- a/cdist/conf/type/__dpkg_architecture/man.rst +++ /dev/null @@ -1,103 +0,0 @@ -cdist-type__dpkg_architecture(7) -================================ - -NAME ----- -cdist-type__dpkg_architecture - Handles foreign architectures on debian-like -systems managed by `dpkg` - - -DESCRIPTION ------------ -This type handles foreign architectures on systems managed by -:strong:`dpkg`\ (1). The object id is the name of the architecture accepted by -`dpkg`, which should be added or removed. - -If the architecture is not setup on the system, it adds a new architecture as a -new foreign architecture in `dpkg`. Then, it updates the apt package index to -make packages from the new architecture available. - -If the architecture should be removed, it will remove it if it is not the base -architecture on where the system was installed on. Before it, it will purge -every package based on the "to be removed" architecture via `apt` to be able to -remove the selected architecture. - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -state - ``present`` or ``absent``. Defaults to ``present``. - - -MESSAGES --------- -added - Added the specified architecture - -removed - Removed the specified architecture - - -ABORTS ------- -Aborts in the following cases: - -If :strong:`dpkg`\ (1) is not available. It will abort with a proper error -message. - -If the architecture is the same as the base architecture the system is build -upon it (returned by ``dpkg --print-architecture``) and it should be removed. - -It will fail if it can not execute :strong:`apt`\ (8). It is assumed that it is -already installed. - - -EXAMPLES --------- - -.. code-block:: sh - - # add i386 (32 bit) architecture - __dpkg_architecture i386 - - # remove it again :) - __dpkg_architecture i386 --state absent - - -SEE ALSO --------- -`Multiarch on Debian systems `_ - -`How to setup multiarch on Debian `_ - -:strong:`dpkg`\ (1) -:strong:`cdist-type__package_dpkg`\ (7) -:strong:`cdist-type__package_apt`\ (7) - -Useful commands: - -.. code-block:: sh - - # base architecture installed on this system - dpkg --print-architecture - - # extra architectures added - dpkg --print-foreign-architectures - - -AUTHORS -------- -Matthias Stecher - - -COPYING -------- -Copyright \(C) 2020 Matthias Stecher. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -ublished by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__dpkg_architecture/parameter/default/state b/cdist/conf/type/__dpkg_architecture/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__dpkg_architecture/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__dpkg_architecture/parameter/optional b/cdist/conf/type/__dpkg_architecture/parameter/optional deleted file mode 100644 index ff72b5c7..00000000 --- a/cdist/conf/type/__dpkg_architecture/parameter/optional +++ /dev/null @@ -1 +0,0 @@ -state diff --git a/cdist/conf/type/__file/explorer/stat b/cdist/conf/type/__file/explorer/stat index 29b3c8a3..91c8cc84 100755 --- a/cdist/conf/type/__file/explorer/stat +++ b/cdist/conf/type/__file/explorer/stat @@ -31,10 +31,10 @@ fallback() { gid=$(echo "$ls_line" | awk '{ print $4 }') owner=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/passwd) - group=$(awk -F: -v gid="$gid" '$3 == gid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group) + group=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group) mode_text=$(echo "$ls_line" | awk '{ print $1 }') - mode=$(echo "$mode_text" | awk '{for(i=8;i>=0;--i){c=substr($1,10-i,1);k+=((c~/[rwxst]/)*2^i);if(!(i%3))k+=(tolower(c)~/[lst]/)*2^(9+i/3)}printf("%04o",k)}') + mode=$(echo "$mode_text" | awk '{ k=0; for (i=0; i<=8; i++) k += ((substr($1, i+2, 1) ~ /[rwx]/) * 2^(8-i)); printf("%0o", k) }') size=$(echo "$ls_line" | awk '{ print $5 }') links=$(echo "$ls_line" | awk '{ print $2 }') @@ -53,32 +53,64 @@ fallback() { [ -e "$destination" ] || exit 0 -command -v stat >/dev/null 2>&1 || { +if ! command -v stat >/dev/null +then fallback exit -} +fi case $("$__explorer/os") in freebsd|netbsd|openbsd|macosx) - stat -f 'type: %HT + stat -f "type: %HT owner: %Du %Su group: %Dg %Sg -mode: %Mp%03Lp %Sp +mode: %Lp %Sp size: %Dz links: %Dl -' "$destination" | awk '/^type/ { print tolower($0); next } { print }' +" "$destination" | awk '/^type/ { print tolower($0); next } { print }' ;; + solaris) + ls1="$( ls -ld "$destination" )" + ls2="$( ls -ldn "$destination" )" + + if [ -f "$__object/parameter/mode" ] + then mode_should="$( cat "$__object/parameter/mode" )" + fi + + # yes, it is ugly hack, but if you know better way... + if [ -z "$( find "$destination" -perm "$mode_should" )" ] + then octets=888 + else octets="$( echo "$mode_should" | sed 's/^0//' )" + fi + + case "$( echo "$ls1" | cut -c1-1 )" in + -) echo 'type: regular file' ;; + d) echo 'type: directory' ;; + esac + + echo "owner: $( echo "$ls2" \ + | awk '{print $3}' ) $( echo "$ls1" \ + | awk '{print $3}' )" + + echo "group: $( echo "$ls2" \ + | awk '{print $4}' ) $( echo "$ls1" \ + | awk '{print $4}' )" + + echo "mode: $octets $( echo "$ls1" | awk '{print $1}' )" + echo "size: $( echo "$ls1" | awk '{print $5}' )" + echo "links: $( echo "$ls1" | awk '{print $2}' )" + ;; *) # NOTE: Do not use --printf here as it is not supported by BusyBox stat. # NOTE: BusyBox's stat might not support the "-c" option, in which case # we fall through to the shell fallback. - stat -c 'type: %F + stat -c "type: %F owner: %u %U group: %g %G -mode: %04a %A +mode: %a %A size: %s -links: %h' "$destination" 2>/dev/null || fallback - ;; +links: %h" "$destination" 2>/dev/null || fallback + ;; esac diff --git a/cdist/conf/type/__file/gencode-local b/cdist/conf/type/__file/gencode-local index 231b6927..fb9f9a92 100755 --- a/cdist/conf/type/__file/gencode-local +++ b/cdist/conf/type/__file/gencode-local @@ -31,24 +31,12 @@ if [ "$state_should" = "pre-exists" ]; then exit 1 fi - case $type in - file) - # nothing to do - exit 0 - ;; - none) - printf 'File "%s" does not exist\n' "$destination" >&2 - exit 1 - ;; - directory|symlink) - printf 'File "%s" exists and is a %s, but should be a regular file\n' "$destination" "$type" >&2 - exit 1 - ;; - *) - printf 'File or directory "%s" is in an unknown state\n' "$destination" >&2 - exit 1 - ;; - esac + if [ "$type" = "file" ]; then + exit 0 # nothing to do + else + echo "File \"$destination\" does not exist" + exit 1 + fi fi upload_file= diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote index f7a528fd..b04c471e 100755 --- a/cdist/conf/type/__file/gencode-remote +++ b/cdist/conf/type/__file/gencode-remote @@ -55,36 +55,35 @@ set_owner() { } set_mode() { - echo "chmod '$1' '$destination'" - echo "chmod '$1'" >> "$__messages_out" - fire_onchange=1 + echo "chmod '$1' '$destination'" + echo "chmod '$1'" >> "$__messages_out" + fire_onchange=1 } case "$state_should" in - present|exists) - # Note: Mode - needs to happen last as a chown/chgrp can alter mode by - # clearing S_ISUID and S_ISGID bits (see chown(2)) - for attribute in group owner mode; do - if [ -f "$__object/parameter/$attribute" ]; then - value_should="$(cat "$__object/parameter/$attribute")" + present|exists|pre-exists) + # Note: Mode - needs to happen last as a chown/chgrp can alter mode by + # clearing S_ISUID and S_ISGID bits (see chown(2)) + for attribute in group owner mode; do + if [ -f "$__object/parameter/$attribute" ]; then + value_should="$(cat "$__object/parameter/$attribute")" - # format mode in four digits => same as stat returns - if [ "$attribute" = mode ]; then - # Convert to four-digit octal number (printf interprets - # strings with leading 0s as octal!) - value_should=$(printf '%04o' "0${value_should}") - fi - - value_is="$(get_current_value "$attribute" "$value_should")" - if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then - "set_$attribute" "$value_should" - fi + # change 0xxx format to xxx format => same as stat returns + if [ "$attribute" = mode ]; then + value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')" + fi + + value_is="$(get_current_value "$attribute" "$value_should")" + if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then + "set_$attribute" "$value_should" fi - done - if [ -f "$__object/files/set-attributes" ]; then - # set-attributes is created if file is created or uploaded in gencode-local - fire_onchange=1 fi + done + if [ -f "$__object/files/set-attributes" ]; then + # set-attributes is created if file is created or uploaded in gencode-local + fire_onchange=1 + fi + ;; absent) @@ -95,10 +94,6 @@ case "$state_should" in fi ;; - pre-exists) - : - ;; - *) echo "Unknown state: $state_should" >&2 exit 1 @@ -106,7 +101,7 @@ case "$state_should" in esac if [ -f "$__object/parameter/onchange" ]; then - if [ -n "$fire_onchange" ]; then - cat "$__object/parameter/onchange" - fi + if [ -n "$fire_onchange" ]; then + cat "$__object/parameter/onchange" + fi fi diff --git a/cdist/conf/type/__file/man.rst b/cdist/conf/type/__file/man.rst index 2f3b9e69..7a0603bb 100644 --- a/cdist/conf/type/__file/man.rst +++ b/cdist/conf/type/__file/man.rst @@ -50,13 +50,13 @@ state create or modify it group - Group to chgrp to. Defaults to ``root``. + Group to chgrp to. mode - Unix permissions, suitable for chmod. Defaults to a very secure ``0600``. + Unix permissions, suitable for chmod. owner - User to chown to. Defaults to ``root``. + User to chown to. source If supplied, copy this file from the host running cdist to the target. diff --git a/cdist/conf/type/__filesystem/explorer/lsblk b/cdist/conf/type/__filesystem/explorer/lsblk index d376c09f..9ae544ac 100644 --- a/cdist/conf/type/__filesystem/explorer/lsblk +++ b/cdist/conf/type/__filesystem/explorer/lsblk @@ -18,16 +18,16 @@ # along with cdist. If not, see . # -os=$("${__explorer:?}/os") +os=$("$__explorer/os") -if [ -f "${__object:?}/parameter/device" ]; then +if [ -f "$__object/parameter/device" ]; then blkdev="$(cat "$__object/parameter/device")" else - blkdev="${__object_id:?}" + blkdev="$__object_id" fi case "$os" in - alpine|centos|fedora|gentoo|redhat|suse|ubuntu) + centos|fedora|redhat|suse|gentoo) if [ ! -x "$(command -v lsblk)" ]; then echo "lsblk is required for __filesystem type" >&2 exit 1 diff --git a/cdist/conf/type/__git/explorer/group b/cdist/conf/type/__git/explorer/group index ab4396b1..3ddf9656 100644 --- a/cdist/conf/type/__git/explorer/group +++ b/cdist/conf/type/__git/explorer/group @@ -1,24 +1,5 @@ -#!/bin/sh -e +#!/bin/sh -destination="/${__object_id:?}/.git" +destination="/$__object_id/.git" -# shellcheck disable=SC2012 -group_gid=$(ls -ldn "${destination}" | awk '{ print $4 }') - -# NOTE: +1 because $((notanum)) prints 0. -if test $((group_gid + 1)) -ge 0 -then - group_should=$(cat "${__object:?}/parameter/group") - - if expr "${group_should}" : '[0-9]*$' >/dev/null - then - printf '%u\n' "${group_gid}" - else - if command -v getent > /dev/null - then - getent group "${group_gid}" | cut -d : -f 1 - else - awk -F: -v gid="${group_gid}" '$3 == gid { print $1 }' /etc/group - fi - fi -fi +stat --print "%G" "${destination}" 2>/dev/null || exit 0 diff --git a/cdist/conf/type/__git/explorer/owner b/cdist/conf/type/__git/explorer/owner index 4a4d0d13..4c3cd431 100644 --- a/cdist/conf/type/__git/explorer/owner +++ b/cdist/conf/type/__git/explorer/owner @@ -1,19 +1,5 @@ -#!/bin/sh -e +#!/bin/sh -destination="/${__object_id:?}/.git" +destination="/$__object_id/.git" -# shellcheck disable=SC2012 -owner_uid=$(ls -ldn "${destination}" | awk '{ print $3 }') - -# NOTE: +1 because $((notanum)) prints 0. -if test $((owner_uid + 1)) -ge 0 -then - owner_should=$(cat "${__object:?}/parameter/owner") - - if expr "${owner_should}" : '[0-9]*$' >/dev/null - then - printf '%u\n' "${owner_uid}" - else - printf '%s\n' "$(id -u -n "${owner_uid}")" - fi -fi +stat --print "%U" "${destination}" 2>/dev/null || exit 0 diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest index 0d944482..d145c4c3 100755 --- a/cdist/conf/type/__grafana_dashboard/manifest +++ b/cdist/conf/type/__grafana_dashboard/manifest @@ -15,7 +15,7 @@ case $os in # Differntation not needed anymore apt_source_distribution=stable ;; - 10*|11*) + 10*) # Differntation not needed anymore apt_source_distribution=stable ;; diff --git a/cdist/conf/type/__group/gencode-remote b/cdist/conf/type/__group/gencode-remote index ff63e218..6091c548 100755 --- a/cdist/conf/type/__group/gencode-remote +++ b/cdist/conf/type/__group/gencode-remote @@ -88,7 +88,7 @@ if [ "$state" = "present" ]; then fi done if [ "$os" = "freebsd" ]; then - echo pw groupadd "$name" "$@" + echo pw groupadd "$@" "$name" else echo groupadd "$@" "$name" fi diff --git a/cdist/conf/type/__haproxy_dualstack/files/http b/cdist/conf/type/__haproxy_dualstack/files/http deleted file mode 100644 index 0508a465..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/http +++ /dev/null @@ -1,8 +0,0 @@ -frontend http - bind BIND@:80 - mode http - option httplog - default_backend http - -backend http - mode http diff --git a/cdist/conf/type/__haproxy_dualstack/files/https b/cdist/conf/type/__haproxy_dualstack/files/https deleted file mode 100644 index 73deac46..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/https +++ /dev/null @@ -1,10 +0,0 @@ -frontend https - bind BIND@:443 - mode tcp - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_ssl_hello_type 1 } - default_backend https - -backend https - mode tcp diff --git a/cdist/conf/type/__haproxy_dualstack/files/imaps b/cdist/conf/type/__haproxy_dualstack/files/imaps deleted file mode 100644 index b1ec3793..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/imaps +++ /dev/null @@ -1,12 +0,0 @@ -frontend imaps - bind BIND@:143 - bind BIND@:993 - - mode tcp - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_ssl_hello_type 1 } - default_backend imaps - -backend imaps - mode tcp diff --git a/cdist/conf/type/__haproxy_dualstack/files/smtps b/cdist/conf/type/__haproxy_dualstack/files/smtps deleted file mode 100644 index dce6ed4a..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/smtps +++ /dev/null @@ -1,12 +0,0 @@ -frontend smtps - bind BIND@:25 - bind BIND@:465 - - mode tcp - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_ssl_hello_type 1 } - default_backend smtps - -backend smtps - mode tcp diff --git a/cdist/conf/type/__haproxy_dualstack/man.rst b/cdist/conf/type/__haproxy_dualstack/man.rst deleted file mode 100644 index 6c131cbe..00000000 --- a/cdist/conf/type/__haproxy_dualstack/man.rst +++ /dev/null @@ -1,121 +0,0 @@ -cdist-type__haproxy_dualstack(7) -================================ - - -NAME ----- -cdist-type__haproxy_dualstack - Proxy services from a dual-stack server - - -DESCRIPTION ------------ -This (singleton) type installs and configures haproxy to act as a dual-stack -proxy for single-stack services. - -This can be useful to add IPv4 support to IPv6-only services while only using -one IPv4 for many such services. - -By default this type uses the plain TCP proxy mode, which means that there is no -need for TLS termination on this host when SNI is supported. -This also means that proxied services will not receive the client's IP address, -but will see the proxy's IP address instead (that of `$__target_host`). - -This can be solved by using the PROXY protocol, but do take into account that, -e.g. nginx cannot serve both regular HTTP(S) and PROXY protocols on the same -port, so you will need to use other ports for that. - -As a recommendation in this type: use TCP ports 8080 and 591 respectively to -serve HTTP and HTTPS using the PROXY protocol. - -See the EXAMPLES for more details. - - -OPTIONAL PARAMETERS -------------------- -v4proxy - Proxy incoming IPv4 connections to the equivalent IPv6 endpoint. - In its simplest use, it must be a NAME with an `AAAA` DNS entry, which is - the IP address actually providing the proxied services. - The full format of this argument is: - `[proxy:]NAME[[:PROTOCOL_1=PORT_1]...[:PROTOCOL_N=PORT_N]]` - Where starting with `proxy:` determines that the PROXY protocol must be - used and each `:PROTOCOL=PORT` (e.g. `:http=8080` or `:https=591`) is a PORT - override for the given PROTOCOL (see `--protocol`), if not present the - PROTOCOL's default port will be used. - - -v6proxy - Proxy incoming IPv6 connections to the equivalent IPv4 endpoint. - In its simplest use, it must be a NAME with an `A` DNS entry, which is - the IP address actually providing the proxied services. - See `--v4proxy` for more options and details. - -protocol - Can be passed multiple times or as a space-separated list of protocols. - Currently supported protocols are: `http`, `https`, `imaps`, `smtps`. - This defaults to: `http https imaps smtps`. - - -EXAMPLES --------- - -.. code-block:: sh - - # Proxy the IPv6-only services so IPv4-only clients can access them - # This uses HAProxy's TCP mode for http, https, imaps and smtps - __haproxy_dualstack \ - --v4proxy ipv6.chat \ - --v4proxy matrix.ungleich.ch - - # Proxy the IPv6-only HTTP(S) services so IPv4-only clients can access them - # Note this means that the backend IPv6-only server will only see - # the IPv6 address of the haproxy host managed by cdist, which can be - # troublesome if this information is relevant for analytics/security/... - # See the PROXY example below - __haproxy_dualstack \ - --protocol http --protocol https \ - --v4proxy ipv6.chat \ - --v4proxy matrix.ungleich.ch - - # Use the PROXY protocol to proxy the IPv6-only HTTP(S) services enabling - # IPv4-only clients to access them while maintaining the client's IP address - __haproxy_dualstack \ - --protocol http --protocol https \ - --v4proxy proxy:ipv6.chat:http=8080:https=591 \ - --v4proxy proxy:matrix.ungleich.ch:http=8080:https=591 - # Note however that the PROXY protocol is not compatible with regular - # HTTP(S) protocols, so your nginx will have to listen on different ports - # with the PROXY settings. - # Note that you will need to restrict access to the 8080 port to prevent - # Client IP spoofing. - # This can be something like: - # server { - # # listen for regular HTTP connections - # listen [::]:80 default_server; - # listen 80 default_server; - # # listen for PROXY HTTP connections - # listen [::]:8080 proxy_protocol; - # # Accept the Client's IP from the PROXY protocol - # real_ip_header proxy_protocol; - # } - - -SEE ALSO --------- -- https://www.haproxy.com/blog/enhanced-ssl-load-balancing-with-server-name-indication-sni-tls-extension/ -- https://www.haproxy.com/blog/haproxy/proxy-protocol/ -- https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/ - - -AUTHORS -------- -ungleich -Evilham - - -COPYING -------- -Copyright \(C) 2021 ungleich glarus ag. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__haproxy_dualstack/manifest b/cdist/conf/type/__haproxy_dualstack/manifest deleted file mode 100644 index d110eea6..00000000 --- a/cdist/conf/type/__haproxy_dualstack/manifest +++ /dev/null @@ -1,155 +0,0 @@ -#!/bin/sh -eu - -__package haproxy -require="__package/haproxy" __start_on_boot haproxy - -tmpdir="$__object/files" -mkdir "$tmpdir" -configtmp="$__object/files/haproxy.cfg" - -os=$(cat "$__global/explorer/os") -case $os in - freebsd) - CONFIG_FILE="/usr/local/etc/haproxy.conf" - cat < "$configtmp" -global - maxconn 4000 - user nobody - group nogroup - daemon - -EOF - - ;; - *) - CONFIG_FILE="/etc/haproxy/haproxy.cfg" - cat < "$configtmp" -global - log [::1] local2 - chroot /var/lib/haproxy - pidfile /var/run/haproxy.pid - maxconn 4000 - user haproxy - group haproxy - daemon - - # turn on stats unix socket - stats socket /var/lib/haproxy/stats - -EOF - ;; -esac - -cat <> "$configtmp" -defaults - retries 3 - log global - timeout http-request 10s - timeout queue 1m - timeout connect 10s - timeout client 1m - timeout server 1m - timeout http-keep-alive 10s - timeout check 10s -EOF - -dig_cmd="$(command -v dig || true)" -get_ip() { - # Usage: get_ip (ipv4|ipv6) NAME - # uses "dig" if available, else fallback to "host" - case $1 in - ipv4) - if [ -n "${dig_cmd}" ]; then - ${dig_cmd} +short A "$2" - else - host -t A "$2" | cut -d ' ' -f 4 | grep -v 'found:' - fi - ;; - ipv6) - if [ -n "${dig_cmd}" ]; then - ${dig_cmd} +short AAAA "$2" - else - host -t AAAA "$2" | cut -d ' ' -f 5 | grep -v 'NXDOMAIN' - fi - ;; - esac -} - -PROTOCOLS="$(cat "$__object/parameter/protocol")" - -for proxy in v4proxy v6proxy; do - param=$__object/parameter/$proxy - # no backend? skip generating code - if [ ! -f "$param" ]; then - continue - fi - - # turn backend name into bind parameter: v4backend -> ipv4@ - bind=$(echo $proxy | sed -e 's/^/ip/' -e 's/proxy//') - - case $bind in - ipv4) - backendproto=ipv6 - ;; - ipv6) - backendproto=ipv4 - ;; - esac - - for proto in ${PROTOCOLS}; do - # Add protocol "header" - printf "\n# %s %s \n" "${bind}" "${proto}" >> "$configtmp" - - sed -e "s/BIND/$bind/" \ - -e "s/\(frontend[[:space:]].*\)/\1$bind/" \ - -e "s/\(backend[[:space:]].*\)/\\1$bind/" \ - "$__type/files/$proto" >> "$configtmp" - - while read -r hostdefinition; do - if echo "$hostdefinition" | grep -qE '^proxy:'; then - # Proxy protocol was requested - host="$(echo "$hostdefinition" | sed -E 's/^proxy:([^:]+).*$/\1/')" - send_proxy=" send-proxy" - else - # Just use tcp proxy mode - host="$hostdefinition" - send_proxy="" - fi - if echo "$hostdefinition" | grep -qE ":${proto}="; then - # Use custom port definition if requested - port="$(echo "$hostdefinition" | sed -E "s/^(.*:)?${proto}=([0-9]+).*$/:\2/")" - else - # Else use the default - port="" - fi - servername=$host - - res=$(get_ip "$bind" "$servername") - - if [ -z "$res" ]; then - echo "$servername does not resolve - aborting config" >&2 - exit 1 - fi - - # Treat protocols without TLS+SNI specially - if [ "$proto" = http ]; then - echo " use-server $servername if { hdr(host) -i $host }" >> "$configtmp" - else - echo " use-server $servername if { req_ssl_sni -i $host }" >> "$configtmp" - fi - - # Create the "server" itself. - # Note that port and send_proxy will be empty unless - # they were requested by the type user - echo " server $servername ${backendproto}@${host}${port}${send_proxy}" >> "$configtmp" - - done < "$param" - done -done - -# Create config file -require="__package/haproxy" __file ${CONFIG_FILE} --source "$configtmp" --mode 0644 - -require="__file${CONFIG_FILE}" __check_messages "haproxy_reload" \ - --pattern "^__file${CONFIG_FILE}" \ - --execute "service haproxy reload || service haproxy restart" diff --git a/cdist/conf/type/__haproxy_dualstack/parameter/default/protocol b/cdist/conf/type/__haproxy_dualstack/parameter/default/protocol deleted file mode 100644 index dc8bb7bf..00000000 --- a/cdist/conf/type/__haproxy_dualstack/parameter/default/protocol +++ /dev/null @@ -1 +0,0 @@ -http https imaps smtps diff --git a/cdist/conf/type/__haproxy_dualstack/parameter/optional_multiple b/cdist/conf/type/__haproxy_dualstack/parameter/optional_multiple deleted file mode 100644 index 8c482bd4..00000000 --- a/cdist/conf/type/__haproxy_dualstack/parameter/optional_multiple +++ /dev/null @@ -1,3 +0,0 @@ -protocol -v4proxy -v6proxy diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote index c1a97ac8..ae224611 100755 --- a/cdist/conf/type/__hostname/gencode-remote +++ b/cdist/conf/type/__hostname/gencode-remote @@ -20,27 +20,26 @@ # along with cdist. If not, see . # -os=$(cat "${__global:?}/explorer/os") -name_running=$(cat "${__global:?}/explorer/hostname") -has_hostnamectl=$(cat "${__object:?}/explorer/has_hostnamectl") +os=$(cat "$__global/explorer/os") +name_running=$(cat "$__global/explorer/hostname") +has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl") -if test -s "${__object:?}/parameter/name" +if test -s "$__object/parameter/name" then - name_should=$(cat "${__object:?}/parameter/name") + name_should=$(cat "$__object/parameter/name") else - case ${os} + case $os in # RedHat-derivatives and BSDs - (centos|fedora|redhat|scientific|freebsd|macosx|netbsd|openbsd) + centos|fedora|redhat|scientific|freebsd|macosx|netbsd|openbsd) # Hostname is FQDN - name_should=${__target_host:?} - ;; - (*) + name_should="${__target_host}" + ;; + *) # Hostname is only first component of FQDN - name_should=${__target_host:?} - name_should=${name_should%%.*} - ;; + name_should="${__target_host%%.*}" + ;; esac fi @@ -48,46 +47,43 @@ fi ################################################################################ # Check if the (running) hostname is already correct # -test "${name_running}" != "${name_should}" || exit 0 +test "$name_running" != "$name_should" || exit 0 ################################################################################ # Setup hostname # -echo 'changed' >>"${__messages_out:?}" +echo 'changed' >>"$__messages_out" # Use the good old way to set the hostname. -case ${os} +case $os in - (alpine|debian|devuan|ubuntu) + alpine|debian|devuan|ubuntu) echo 'hostname -F /etc/hostname' - ;; - (archlinux) + ;; + archlinux) echo 'command -v hostnamectl >/dev/null 2>&1' \ - "&& hostnamectl set-hostname '${name_should}'" \ - "|| hostname '${name_should}'" - ;; - (centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|void) - echo "hostname '${name_should}'" - ;; - (openwrt) - echo "echo '${name_should}' >/proc/sys/kernel/hostname" - ;; - (macosx) - echo "scutil --set HostName '${name_should}'" - ;; - (solaris) - echo "uname -S '${name_should}'" - ;; - (slackware|suse) + "&& hostnamectl set-hostname '$name_should'" \ + "|| hostname '$name_should'" + ;; + centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|void) + echo "hostname '$name_should'" + ;; + macosx) + echo "scutil --set HostName '$name_should'" + ;; + solaris) + echo "uname -S '$name_should'" + ;; + slackware|suse|opensuse-leap) # We do not read from /etc/HOSTNAME, because the running # hostname is the first component only while the file contains # the FQDN. - echo "hostname '${name_should}'" - ;; - (*) + echo "hostname '$name_should'" + ;; + *) # Fall back to set the hostname using hostnamectl, if available. - if test -n "${has_hostnamectl}" + if test -n "$has_hostnamectl" then # Don't use hostnamectl as the primary means to set the hostname for # systemd systems, because it cannot be trusted to work reliably and @@ -98,8 +94,7 @@ in echo "test \"\$(hostname)\" = \"\$(cat /etc/hostname)\"" \ " || hostname -F /etc/hostname" else - printf "echo 'Unsupported OS: %s' >&2\n" "${os}" - printf 'exit 1\n' + printf "echo 'Unsupported OS: %s' >&2\nexit 1\n" "$os" fi - ;; + ;; esac diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest index b80aa2ef..e1e356a0 100755 --- a/cdist/conf/type/__hostname/manifest +++ b/cdist/conf/type/__hostname/manifest @@ -20,49 +20,69 @@ # along with cdist. If not, see . # +not_supported() { + echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 + echo "Please contribute an implementation for it if you can." >&2 + exit 1 +} + set_hostname_systemd() { echo "$1" | __file /etc/hostname --source - } -os=$(cat "${__global:?}/explorer/os") +os=$(cat "$__global/explorer/os") +os_version=$(cat "$__global/explorer/os_version") +os_major=$(echo "$os_version" | grep -o '^[0-9][0-9]*' || true) -max_len=$(cat "${__object:?}/explorer/max_len") -has_hostnamectl=$(cat "${__object:?}/explorer/has_hostnamectl") +max_len=$(cat "$__object/explorer/max_len") +has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl") -if test -s "${__object:?}/parameter/name" +if test -s "$__object/parameter/name" then - name_should=$(cat "${__object:?}/parameter/name") + name_should=$(cat "$__object/parameter/name") else - case ${os} + case $os in # RedHat-derivatives and BSDs - (centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|slackware|suse) + centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|slackware) # Hostname is FQDN - name_should=${__target_host:?} - ;; + name_should="${__target_host}" + ;; + suse|opensuse-leap) + # Classic SuSE stores the FQDN in /etc/HOSTNAME, while + # systemd does not. The running hostname is the first + # component in both cases. + # In versions before 15.x, the FQDN is stored in /etc/hostname. + if test -n "$has_hostnamectl" && test "$os_major" -ge 15 \ + && test "$os_major" -ne 42 + then + name_should="${__target_host%%.*}" + else + name_should="${__target_host}" + fi + ;; *) # Hostname is only first component of FQDN on all other systems. - name_should=${__target_host:?} - name_should=${name_should%%.*} - ;; + name_should="${__target_host%%.*}" + ;; esac fi -if test -n "${max_len}" && test "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}" +if test -n "$max_len" && test "$(printf '%s' "$name_should" | wc -c)" -gt "$max_len" then printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2 exit 1 fi -case ${os} +case $os in - (alpine|debian|devuan|ubuntu|void) - echo "${name_should}" | __file /etc/hostname --source - - ;; - (archlinux) - if test -n "${has_hostnamectl}" + alpine|debian|devuan|ubuntu|void) + echo "$name_should" | __file /etc/hostname --source - + ;; + archlinux) + if test -n "$has_hostnamectl" then - set_hostname_systemd "${name_should}" + set_hostname_systemd "$name_should" else echo 'Ancient ArchLinux variants without hostnamectl are not supported.' >&2 exit 1 @@ -77,8 +97,8 @@ in # --value "\"$name_should\"" fi ;; - (centos|fedora|redhat|scientific) - if test -z "${has_hostnamectl}" + centos|fedora|redhat|scientific) + if test -z "$has_hostnamectl" then # Only write to /etc/sysconfig/network on non-systemd versions. # On systemd-based versions this entry is ignored. @@ -86,83 +106,59 @@ in --file /etc/sysconfig/network \ --delimiter '=' --exact_delimiter \ --key HOSTNAME \ - --value "\"${name_should}\"" + --value "\"$name_should\"" else - set_hostname_systemd "${name_should}" + set_hostname_systemd "$name_should" fi - ;; - (gentoo) + ;; + gentoo) # Only write to /etc/conf.d/hostname on OpenRC-based installations. # On systemd use hostnamectl(1) in gencode-remote. - if test -z "${has_hostnamectl}" + if test -z "$has_hostnamectl" then __key_value '/etc/conf.d/hostname:hostname' \ --file /etc/conf.d/hostname \ --delimiter '=' --exact_delimiter \ --key 'hostname' \ - --value "\"${name_should}\"" + --value "\"$name_should\"" else set_hostname_systemd "$name_should" fi - ;; - (freebsd) + ;; + freebsd) __key_value '/etc/rc.conf:hostname' \ --file /etc/rc.conf \ --delimiter '=' --exact_delimiter \ --key 'hostname' \ - --value "\"${name_should}\"" - ;; - (macosx) + --value "\"$name_should\"" + ;; + macosx) # handled in gencode-remote - ;; - (netbsd) + : + ;; + netbsd) __key_value '/etc/rc.conf:hostname' \ --file /etc/rc.conf \ --delimiter '=' --exact_delimiter \ --key 'hostname' \ - --value "\"${name_should}\"" + --value "\"$name_should\"" # To avoid confusion, ensure that the hostname is only stored once. __file /etc/myname --state absent - ;; - (openbsd) - echo "${name_should}" | __file /etc/myname --source - - ;; - (openwrt) - __uci system.@system[0].hostname --value "${name_should}" - # --transaction hostname - ;; - (slackware) + ;; + openbsd) + echo "$name_should" | __file /etc/myname --source - + ;; + slackware) # We write the FQDN into /etc/HOSTNAME. But /etc/rc.d/rc.M will only # read the first component from this file and set it as the running # hostname on boot. - echo "${name_should}" | __file /etc/HOSTNAME --source - - ;; - (solaris) - echo "${name_should}" | __file /etc/nodename --source - - ;; - (suse) - if test -s "${__global:?}/explorer/os_release" - then - # shellcheck source=/dev/null - os_version=$(. "${__global:?}/explorer/os_release" && echo "${VERSION}") - else - os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global:?}/explorer/os_version") - fi - os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)') - - # Classic SuSE stores the FQDN in /etc/HOSTNAME, while - # systemd does not. The running hostname is the first - # component in both cases. - # In versions before 15.x, the FQDN is stored in /etc/hostname. - if test -n "${has_hostnamectl}" \ - && test "${os_major}" -ge 15 \ - && test "${os_major}" -ne 42 - then - # strip away everything but the first part from $name_should - name_should=${name_should%%.*} - fi - + echo "$name_should" | __file /etc/HOSTNAME --source - + ;; + solaris) + echo "$name_should" | __file /etc/nodename --source - + ;; + suse|opensuse-leap) # Modern SuSE provides /etc/HOSTNAME as a symlink for # backwards-compatibility. Unfortunately it cannot be used # here as __file does not follow the symlink. @@ -171,25 +167,23 @@ in # not work correctly on openSUSE 12.x which provides # hostnamectl but not /etc/hostname. - if test -n "${has_hostnamectl}" -a "${os_major}" -gt 12 + if test -n "$has_hostnamectl" -a "$os_major" -gt 12 then - hostname_file=/etc/hostname + hostname_file='/etc/hostname' else - hostname_file=/etc/HOSTNAME + hostname_file='/etc/HOSTNAME' fi - echo "${name_should}" | __file "${hostname_file}" --source - - ;; - (*) + echo "$name_should" | __file "$hostname_file" --source - + ;; + *) # On other operating systems we fall back to systemd's # hostnamectl if available… - if test -n "${has_hostnamectl}" + if test -n "$has_hostnamectl" then - set_hostname_systemd "${name_should}" + set_hostname_systemd "$name_should" else - echo "Your operating system (${os}) is currently not supported by this type (${__type##*/})." >&2 - echo "Please contribute an implementation for it if you can." >&2 - exit 1 + not_supported fi - ;; + ;; esac diff --git a/cdist/conf/type/__hosts/man.rst b/cdist/conf/type/__hosts/man.rst index 1ac706cb..bece7967 100644 --- a/cdist/conf/type/__hosts/man.rst +++ b/cdist/conf/type/__hosts/man.rst @@ -25,10 +25,6 @@ ip state is ``present``, this parameter is mandatory, if state is ``absent``, this parameter is silently ignored. -alias - An alias for the hostname. - This parameter can be specified multiple times (once per alias). - EXAMPLES -------- @@ -40,8 +36,6 @@ EXAMPLES # previously configured via __hosts. __hosts happy --state absent - __hosts srv1.example.com --ip 192.168.0.42 --alias srv1 - SEE ALSO -------- @@ -49,14 +43,13 @@ SEE ALSO AUTHORS ------- -| Dmitry Bogatov -| Dennis Camera + +Dmitry Bogatov COPYING ------- -Copyright \(C) 2015-2016 Dmitry Bogatov, 2019 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright (C) 2015,2016 Dmitry Bogatov. Free use of this software is granted +under the terms of the GNU General Public License version 3 or later +(GPLv3+). diff --git a/cdist/conf/type/__hosts/manifest b/cdist/conf/type/__hosts/manifest index 8103ebd5..c536b83b 100755 --- a/cdist/conf/type/__hosts/manifest +++ b/cdist/conf/type/__hosts/manifest @@ -1,42 +1,29 @@ #!/bin/sh -e -# # Copyright (C) 2015 Bogatov Dmitry -# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify +# This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # -# cdist is distributed in the hope that it will be useful, +# This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . -# +set -ue -set -e +hostname="$__object_id" +state="$(cat "$__object/parameter/state")" +marker="# __hosts/$hostname" -hostname=$__object_id -state=$(cat "${__object}/parameter/state") -marker="# __hosts/${hostname}" +set -- "__hosts/$hostname" --file /etc/hosts --state "$state" -if test "${state}" != 'absent' -then - ip=$(cat "${__object}/parameter/ip") - if test -s "${__object}/parameter/alias" - then - aliases=$(while read -r a; do printf '\t%s' "$a"; done <"$__object/parameter/alias") - fi - - set -- --line "$(printf '%s\t%s%s %s' \ - "${ip}" "${hostname}" "${aliases}" "${marker}")" +if [ "$state" = absent ] ; then + __line "$@" --regex "$marker" else - set -- --regex "$(echo "${marker}" | sed -e 's/\./\\./')$" + ip="$(cat "$__object/parameter/ip")" + __line "$@" --line "$ip $hostname $marker" fi - -__line "/etc/hosts:${hostname}" --file /etc/hosts --state "${state}" "$@" diff --git a/cdist/conf/type/__hosts/parameter/optional_multiple b/cdist/conf/type/__hosts/parameter/optional_multiple deleted file mode 100644 index d077ed80..00000000 --- a/cdist/conf/type/__hosts/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -alias diff --git a/cdist/conf/type/__hwclock/explorer/timedatectl_localrtc b/cdist/conf/type/__hwclock/explorer/timedatectl_localrtc deleted file mode 100755 index 8239122e..00000000 --- a/cdist/conf/type/__hwclock/explorer/timedatectl_localrtc +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Prints the LocalRTC property using timedatectl on systemd-based systems. -# - -command -v timedatectl >/dev/null 2>&1 || exit 0 - -# NOTE: Older versions of timedatectl do not support `timedatectl show' -timedatectl --no-pager status \ -| awk -F': ' '$1 ~ "RTC in local TZ$" { sub(/[ \t]*$/, "", $2); print $2 }' diff --git a/cdist/conf/type/__hwclock/gencode-remote b/cdist/conf/type/__hwclock/gencode-remote deleted file mode 100755 index 5995fb23..00000000 --- a/cdist/conf/type/__hwclock/gencode-remote +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -mode=$(cat "${__object:?}/parameter/mode") - -timedatectl_localrtc=$(cat "${__object:?}/explorer/timedatectl_localrtc") -adjtime_mode=$(cat "${__object:?}/explorer/adjtime_mode") - - -case ${mode} -in - (localtime) - adjtime_str=LOCAL - local_rtc_str=yes - ;; - (UTC|utc) - adjtime_str=UTC - local_rtc_str=no - ;; - (*) - printf 'Invalid value for --mode: %s\n' "${mode}" >&2 - printf 'Acceptable values are: localtime, utc.\n' >&2 - exit 1 -esac - - -if test -n "${timedatectl_localrtc}" -then - # systemd - timedatectl_should=${local_rtc_str} - if test "${timedatectl_localrtc}" != "${timedatectl_should}" - then - printf 'timedatectl set-local-rtc %s\n' "${timedatectl_should}" - fi -elif test -n "${adjtime_mode}" -then - # others (update /etc/adjtime if present) - if test "${adjtime_mode}" != "${adjtime_str}" - then - # Update /etc/adjtime (3rd line is clock mode) - # adjtime(5) https://man7.org/linux/man-pages/man5/adjtime.5.html - # FIXME: Should maybe add third line if adjfile only contains two lines - printf "sed -i '3c\\\\\\n%s\\n' /etc/adjtime\\n" "${adjtime_str}" - fi -fi diff --git a/cdist/conf/type/__hwclock/man.rst b/cdist/conf/type/__hwclock/man.rst deleted file mode 100644 index 65eb648f..00000000 --- a/cdist/conf/type/__hwclock/man.rst +++ /dev/null @@ -1,63 +0,0 @@ -cdist-type__hwclock(7) -====================== - -NAME ----- -cdist-type__hwclock - Manage the hardware real time clock. - - -DESCRIPTION ------------ -This type can be used to control how the hardware clock is used by the operating -system. - - -REQUIRED PARAMETERS -------------------- -mode - What mode the hardware clock is in. - - Acceptable values: - - localtime - The hardware clock is set to local time (common for systems also running - Windows.) - UTC - The hardware clock is set to UTC (common on UNIX systems.) - - -OPTIONAL PARAMETERS -------------------- -None. - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Make the operating system treat the time read from the hwclock as UTC. - __hwclock --mode UTC - - -SEE ALSO --------- -:strong:`hwclock`\ (8) - - -AUTHORS -------- -Dennis Camera - - -COPYING -------- -Copyright \(C) 2020 Dennis Camera. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__hwclock/manifest b/cdist/conf/type/__hwclock/manifest deleted file mode 100755 index 7d9ab88f..00000000 --- a/cdist/conf/type/__hwclock/manifest +++ /dev/null @@ -1,222 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# TODO: Consider supporting BADYEAR - -os=$(cat "${__global:?}/explorer/os") -mode=$(cat "${__object:?}/parameter/mode") - -has_systemd_timedatectl=$(test -s "${__object:?}/explorer/timedatectl_localrtc" && echo true || echo false) - - -case ${mode} -in - (localtime) - local_clock=true - ;; - (UTC|utc) - local_clock=false - ;; - (*) - printf 'Invalid value for --mode: %s\n' "${mode}" >&2 - printf 'Acceptable values are: UTC, localtime.\n' >&2 - exit 1 -esac - - -case ${os} -in - (alpine|gentoo) - if ! $has_systemd_timedatectl - then - # NOTE: Gentoo also supports systemd, in which case /etc/conf.d is - # not used. So we check for systemd presence here and only - # update /etc/conf.d if systemd is not installed. - # https://wiki.gentoo.org/wiki/System_time#Hardware_clock - - export CDIST_ORDER_DEPENDENCY=true - __file /etc/conf.d/hwclock --state present \ - --owner root --group root --mode 0644 - __key_value /etc/conf.d/hwclock:clock \ - --file /etc/conf.d/hwclock \ - --key clock \ - --delimiter '=' --exact_delimiter \ - --value "\"$($local_clock && echo local || echo UTC)\"" - unset CDIST_ORDER_DEPENDENCY - fi - ;; - (centos|fedora|redhat|scientific) - os_version=$(cat "${__global:?}/explorer/os_version") - os_major=$(expr "${os_version}" : '.* release \([0-9]*\)') - case ${os} - in - (centos|scientific) - update_sysconfig=$(test "${os_major}" -lt 6 && echo true || echo false) - ;; - (fedora) - update_sysconfig=$(test "${os_major}" -lt 10 && echo true || echo false) - ;; - (redhat|*) - case ${os_version} - in - ('Red Hat Enterprise Linux'*) - update_sysconfig=$(test "${os_major}" -lt 6 && echo true || echo false) - ;; - ('Red Hat Linux'*) - update_sysconfig=true - ;; - (*) - printf 'Could not determine Red Hat distribution.\n' >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - ;; - esac - ;; - esac - - if ${update_sysconfig:?} - then - export CDIST_ORDER_DEPENDENCY=true - __file /etc/sysconfig/clock --state present \ - --owner root --group root --mode 0644 - __key_value /etc/sysconfig/clock:UTC \ - --file /etc/sysconfig/clock \ - --key UTC \ - --delimiter '=' --exact_delimiter \ - --value "$($local_clock && echo false || echo true)" - unset CDIST_ORDER_DEPENDENCY - fi - ;; - (debian|devuan|ubuntu) - os_major=$(sed 's/[^0-9].*$//' "${__global:?}/explorer/os_version") - - case ${os} - in - (debian) - if test "${os_major}" -ge 7 - then - update_rcS=false - elif test "${os_major}" -ge 3 - then - update_rcS=true - else - # Debian 2.2 should be supportable using rcS. - # Debian 2.1 uses the ancient GMT key. - # Debian 1.3 does not have rcS. - printf "Your operating system (Debian %s) is currently not supported by this type (%s)\n" \ - "$(cat "${__global:?}/explorer/os_version")" "${__type##*/}" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - fi - ;; - (devuan) - update_rcS=false - ;; - (ubuntu) - update_rcS=$(test "${os_major}" -lt 16 && echo true || echo false) - ;; - esac - - if ${update_rcS} - then - export CDIST_ORDER_DEPENDENCY=true - __file /etc/default/rcS --state present \ - --owner root --group root --mode 0644 - __key_value /etc/default/rcS:UTC \ - --file /etc/default/rcS \ - --key UTC \ - --delimiter '=' --exact_delimiter \ - --value "$($local_clock && echo no || echo yes)" - unset CDIST_ORDER_DEPENDENCY - fi - ;; - (freebsd) - # cf. adjkerntz(8) - __file /etc/wall_cmos_clock \ - --state "$($local_clock && echo present || echo absent)" \ - --owner root --group wheel --mode 0444 - ;; - (netbsd) - # https://wiki.netbsd.org/guide/boot/#index9h2 - __key_value /etc/rc.conf:rtclocaltime \ - --file /etc/rc.conf \ - --key rtclocaltime \ - --delimiter '=' --exact_delimiter \ - --value "$($local_clock && echo YES || echo NO)" - ;; - (slackware) - __file /etc/hardwareclock --owner root --group root --mode 0644 \ - --source - <<-EOF - # /etc/hardwareclock - # - # Tells how the hardware clock time is stored. - # This file is managed by cdist. - - $($local_clock && echo localtime || echo UTC) - EOF - ;; - (suse) - if test -s "${__global:?}/explorer/os_release" - then - # shellcheck source=/dev/null - os_version=$(. "${__global:?}/explorer/os_release" && echo "${VERSION}") - else - os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global:?}/explorer/os_version") - fi - os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)') - - # TODO: Consider using `yast2 timezone set hwclock' instead - if expr "${os_major}" \< 12 - then - # Starting with SuSE 12 (first systemd-based version) - # /etc/sysconfig/clock does not contain the HWCLOCK line - # anymore. - # With SuSE 13, it has been reduced to TIMEZONE configuration. - __key_value /etc/sysconfig/clock:HWCLOCK \ - --file /etc/sysconfig/clock \ - --delimiter '=' --exact_delimiter \ - --key HWCLOCK \ - --value "$($local_clock && echo '"--localtime"' || echo '"-u"')" - fi - ;; - (void) - export CDIST_ORDER_DEPENDENCY=true - __file /etc/rc.conf \ - --owner root --group root --mode 0644 \ - --state present - __key_value /etc/rc.conf:HARDWARECLOCK \ - --file /etc/rc.conf \ - --delimiter '=' --exact_delimiter \ - --key HARDWARECLOCK \ - --value "\"$($local_clock && echo localtime || echo UTC)\"" - unset CDIST_ORDER_DEPENDENCY - ;; - (*) - if ! $has_systemd_timedatectl - then - printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - fi - ;; -esac - -# NOTE: timedatectl set-local-rtc for systemd is in gencode-remote -# NOTE: /etc/adjtime is also updated in gencode-remote diff --git a/cdist/conf/type/__hwclock/parameter/required b/cdist/conf/type/__hwclock/parameter/required deleted file mode 100644 index 17ab372f..00000000 --- a/cdist/conf/type/__hwclock/parameter/required +++ /dev/null @@ -1 +0,0 @@ -mode diff --git a/cdist/conf/type/__iptables_apply/files/init-script b/cdist/conf/type/__iptables_apply/files/init-script index e42017ae..d9c79ef7 100644 --- a/cdist/conf/type/__iptables_apply/files/init-script +++ b/cdist/conf/type/__iptables_apply/files/init-script @@ -1,4 +1,7 @@ #!/bin/sh +# Nico Schottelius +# Zürisee, Mon Sep 2 18:38:27 CEST 2013 +# ### BEGIN INIT INFO # Provides: iptables # Required-Start: $local_fs $remote_fs @@ -11,72 +14,34 @@ # and saves/restores previous status ### END INIT INFO -# Originally written by: -# Nico Schottelius -# Zürisee, Mon Sep 2 18:38:27 CEST 2013 -# -# 2013 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Matthias Stecher (matthiasstecher at gmx.de) -# -# This file is distributed with cdist and licenced under the -# GNU GPLv3+ WITHOUT ANY WARRANTY. - - -# Read files and execute the content with the given commands -# -# Arguments: -# 1: Directory -# 2..n: Commands which should be used to execute the file content -gothrough() { - cd "$1" || return - shift - - # iterate through all rules and continue if it's not a file - for rule in *; do - [ -f "$rule" ] || continue - echo "Appling iptables rule $rule ..." - - # execute it with all commands specificed - ruleparam="$(cat "$rule")" - for cmd in "$@"; do - # Command and Rule should be split. - # shellcheck disable=SC2046 - command $cmd $ruleparam - done - done -} - -# Shortcut for iptables command to do IPv4 and v6 -# only applies to the "reset" target -iptables() { - command iptables "$@" - command ip6tables "$@" -} basedir=/etc/iptables.d -status4="${basedir}/.pre-start" -status6="${basedir}/.pre-start6" +status="${basedir}/.pre-start" case $1 in start) # Save status - iptables-save > "$status4" - ip6tables-save > "$status6" + iptables-save > "$status" # Apply our ruleset - gothrough "$basedir" iptables - #gothrough "$basedir/v4" iptables # conflicts with $basedir - gothrough "$basedir/v6" ip6tables - gothrough "$basedir/all" iptables ip6tables + cd "$basedir" || exit + count="$(find . ! -name . -prune | wc -l)" + + # Only do something if there are rules + if [ "$count" -ge 1 ]; then + for rule in *; do + echo "Applying iptables rule $rule ..." + # Rule should be split. + # shellcheck disable=SC2046 + iptables $(cat "$rule") + done + fi ;; stop) # Restore from status before, if there is something to restore - if [ -f "$status4" ]; then - iptables-restore < "$status4" - fi - if [ -f "$status6" ]; then - ip6tables-restore < "$status6" + if [ -f "$status" ]; then + iptables-restore < "$status" fi ;; restart) diff --git a/cdist/conf/type/__iptables_apply/man.rst b/cdist/conf/type/__iptables_apply/man.rst index 3bef92cc..76e1f6bf 100644 --- a/cdist/conf/type/__iptables_apply/man.rst +++ b/cdist/conf/type/__iptables_apply/man.rst @@ -10,24 +10,7 @@ DESCRIPTION ----------- This cdist type deploys an init script that triggers the configured rules and also re-applies them on -configuration. Rules are written from __iptables_rule -into the folder ``/etc/iptables.d/``. - -It reads all rules from the base folder as rules for IPv4. -Rules in the subfolder ``v6/`` are IPv6 rules. Rules in -the subfolder ``all/`` are applied to both rule tables. All -files contain the arguments for a single ``iptables`` and/or -``ip6tables`` command. - -Rules are applied in the following order: -1. All IPv4 rules -2. All IPv6 rules -2. All rules that should be applied to both tables - -The order of the rules that will be applied are definite -from the result the shell glob returns, which should be -alphabetical. If rules must be applied in a special order, -prefix them with a number like ``02-some-rule``. +configuration. REQUIRED PARAMETERS @@ -41,7 +24,7 @@ None EXAMPLES -------- -None (__iptables_apply is used by __iptables_rule automatically) +None (__iptables_apply is used by __iptables_rule) SEE ALSO @@ -52,13 +35,11 @@ SEE ALSO AUTHORS ------- Nico Schottelius -Matthias Stecher COPYING ------- -Copyright \(C) 2013 Nico Schottelius. -Copyright \(C) 2020 Matthias Stecher. -You can redistribute it and/or modify it under the terms of the GNU -General Public License as published by the Free Software Foundation, -either version 3 of the License, or (at your option) any later version. +Copyright \(C) 2013 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__iptables_rule/man.rst b/cdist/conf/type/__iptables_rule/man.rst index afb71e01..92d8859f 100644 --- a/cdist/conf/type/__iptables_rule/man.rst +++ b/cdist/conf/type/__iptables_rule/man.rst @@ -11,10 +11,6 @@ DESCRIPTION This cdist type allows you to manage iptable rules in a distribution independent manner. -See :strong:`cdist-type__iptables_apply`\ (7) for the -execution order of these rules. It will be executed -automaticly to apply all rules non-volaite. - REQUIRED PARAMETERS ------------------- @@ -29,24 +25,6 @@ state 'present' or 'absent', defaults to 'present' -BOOLEAN PARAMETERS ------------------- -All rules without any of these parameters will be treated like ``--v4`` because -of backward compatibility. - -v4 - Explicitly set it as rule for IPv4. If IPv6 is set, too, it will be - threaten like ``--all``. Will be the default if nothing else is set. - -v6 - Explicitly set it as rule for IPv6. If IPv4 is set, too, it will be - threaten like ``--all``. - -all - Set the rule for both IPv4 and IPv6. It will be saved separately from the - other rules. - - EXAMPLES -------- @@ -70,16 +48,6 @@ EXAMPLES --state absent - # IPv4-only rule for ICMPv4 - __iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT" - # IPv6-only rule for ICMPv6 - __iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT" - - # doing something for the dual stack - __iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT" - __iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT" - - SEE ALSO -------- :strong:`cdist-type__iptables_apply`\ (7), :strong:`iptables`\ (8) @@ -88,13 +56,11 @@ SEE ALSO AUTHORS ------- Nico Schottelius -Matthias Stecher COPYING ------- -Copyright \(C) 2013 Nico Schottelius. -Copyright \(C) 2020 Matthias Stecher. -You can redistribute it and/or modify it under the terms of the GNU -General Public License as published by the Free Software Foundation, -either version 3 of the License, or (at your option) any later version. +Copyright \(C) 2013 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__iptables_rule/manifest b/cdist/conf/type/__iptables_rule/manifest index d4394c25..ed78787f 100755 --- a/cdist/conf/type/__iptables_rule/manifest +++ b/cdist/conf/type/__iptables_rule/manifest @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2013 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Matthias Stecher (matthiasstecher at gmx.de) # # This file is part of cdist. # @@ -25,36 +24,12 @@ base_dir=/etc/iptables.d name="$__object_id" state="$(cat "$__object/parameter/state")" -if [ -f "$__object/parameter/v4" ]; then - only_v4="yes" - # $specific_dir is $base_dir -fi -if [ -f "$__object/parameter/v6" ]; then - only_v6="yes" - specific_dir="$base_dir/v6" -fi -# If rules should be set for both protocols -if { [ "$only_v4" = "yes" ] && [ "$only_v6" = "yes" ]; } || - [ -f "$__object/parameter/all" ]; then - - # all to a specific directory - specific_dir="$base_dir/all" -fi - -# set rule directory based on if it's the base or subdirectory -rule_dir="${specific_dir:-$base_dir}" - ################################################################################ # Basic setup # __directory "$base_dir" --state present -# sub-directory if required -if [ "$specific_dir" ]; then - require="__directory/$base_dir" __directory "$specific_dir" --state present -fi - # Have apply do the real job require="$__object_name" __iptables_apply @@ -62,15 +37,6 @@ require="$__object_name" __iptables_apply # The rule # -for dir in "$base_dir" "$base_dir/v6" "$base_dir/all"; do - # defaults to absent except the directory that should contain the file - if [ "$rule_dir" = "$dir" ]; then - curr_state="$state" - else - curr_state="absent" - fi - - require="__directory/$rule_dir" __file "$dir/$name" \ - --source "$__object/parameter/rule" \ - --state "$curr_state" -done +require="__directory/$base_dir" __file "$base_dir/${name}" \ + --source "$__object/parameter/rule" \ + --state "$state" diff --git a/cdist/conf/type/__iptables_rule/parameter/boolean b/cdist/conf/type/__iptables_rule/parameter/boolean deleted file mode 100644 index 76882272..00000000 --- a/cdist/conf/type/__iptables_rule/parameter/boolean +++ /dev/null @@ -1,3 +0,0 @@ -all -v4 -v6 diff --git a/cdist/conf/type/__key_value/explorer/state b/cdist/conf/type/__key_value/explorer/state index d24600af..7b2de1df 100755 --- a/cdist/conf/type/__key_value/explorer/state +++ b/cdist/conf/type/__key_value/explorer/state @@ -40,9 +40,7 @@ else fi export key state delimiter value exact_delimiter -awk_bin=$(PATH=$(getconf PATH 2>/dev/null) && command -v awk || echo awk) - -"${awk_bin}" -f - "$file" <<"AWK_EOF" +awk -f - "$file" <<"AWK_EOF" BEGIN { state=ENVIRON["state"] key=ENVIRON["key"] diff --git a/cdist/conf/type/__key_value/files/remote_script.sh b/cdist/conf/type/__key_value/files/remote_script.sh index faf080cb..f7a1add5 100644 --- a/cdist/conf/type/__key_value/files/remote_script.sh +++ b/cdist/conf/type/__key_value/files/remote_script.sh @@ -24,10 +24,7 @@ if [ -f "$file" ]; then else touch "$file" fi - -awk_bin=$(PATH=$(getconf PATH 2>/dev/null) && command -v awk || echo awk) - -"${awk_bin}" -f - "$file" >"$tmpfile" <<"AWK_EOF" +awk -f - "$file" >"$tmpfile" <<"AWK_EOF" BEGIN { # import variables in a secure way .. state=ENVIRON["state"] diff --git a/cdist/conf/type/__key_value/gencode-remote b/cdist/conf/type/__key_value/gencode-remote index 1174400e..13cc27c7 100755 --- a/cdist/conf/type/__key_value/gencode-remote +++ b/cdist/conf/type/__key_value/gencode-remote @@ -25,7 +25,7 @@ state_should="$(cat "$__object/parameter/state")" state_is="$(cat "$__object/explorer/state")" fire_onchange='' -if [ "$state_is" = "$state_should" ]; then +if [ "$state_is" = "$state_should" ]; then exit 0 fi diff --git a/cdist/conf/type/__letsencrypt_cert/explorer/certbot-path b/cdist/conf/type/__letsencrypt_cert/explorer/certbot-path new file mode 100755 index 00000000..3c6076df --- /dev/null +++ b/cdist/conf/type/__letsencrypt_cert/explorer/certbot-path @@ -0,0 +1,3 @@ +#!/bin/sh -e + +command -v certbot 2>/dev/null || true diff --git a/cdist/conf/type/__letsencrypt_cert/explorer/certificate-data b/cdist/conf/type/__letsencrypt_cert/explorer/certificate-data deleted file mode 100755 index ff62e742..00000000 --- a/cdist/conf/type/__letsencrypt_cert/explorer/certificate-data +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/sh -e -certbot_path="$(command -v certbot 2>/dev/null || true)" -# Defaults -certificate_exists="no" -certificate_is_test="no" - -if [ -n "${certbot_path}" ]; then - # Find python executable that has access to certbot's module - python_path=$(sed -n '1s/^#! *//p' "${certbot_path}") - - # Use a lock for cdist due to certbot not exiting with failure - # or having any flags for concurrent use. - _certbot() { - ${python_path} - 2>/dev/null <> /dev/stderr - exit 1 - ;; - esac - - hook_contents_tail="$(cat < "${existing_domains}" - certificate_is_test="$(_explorer_var certificate_is_test)" + existing_domains="${__object}/explorer/certificate-domains" + certificate_is_test=$(cat "${__object}/explorer/certificate-is-test") sort -uo "${requested_domains}" "${requested_domains}" sort -uo "${existing_domains}" "${existing_domains}" diff --git a/cdist/conf/type/__letsencrypt_cert/man.rst b/cdist/conf/type/__letsencrypt_cert/man.rst index 43be8424..c4ffc6bc 100644 --- a/cdist/conf/type/__letsencrypt_cert/man.rst +++ b/cdist/conf/type/__letsencrypt_cert/man.rst @@ -1,33 +1,16 @@ cdist-type__letsencrypt_cert(7) =============================== - NAME ---- cdist-type__letsencrypt_cert - Get an SSL certificate from Let's Encrypt - DESCRIPTION ----------- Automatically obtain a Let's Encrypt SSL certificate using Certbot. -This type attempts to setup automatic renewals always. In many Linux -distributions, that is the case out of the box, see: -https://certbot.eff.org/docs/using.html#automated-renewals - -For Alpine Linux and Arch Linux, we setup a system-wide cronjob that -attempts to renew certificates daily. - -If you are using FreeBSD, we configure periodic(8) as recommended by -the port mantainer, so there will be a weekly attempt at renewal. - -If your OS is not mentioned here or on Certbot's docs as having -support for automated renewals, please make sure you check your OS -and possibly patch this type so the system-wide cronjob is installed. - - REQUIRED PARAMETERS ------------------- @@ -38,7 +21,6 @@ object id admin-email Where to send Let's Encrypt emails like "certificate needs renewal". - OPTIONAL PARAMETERS ------------------- @@ -54,80 +36,36 @@ webroot The path to your webroot, as set up in your webserver config. If this parameter is not present, Certbot will be run in standalone mode. - OPTIONAL MULTIPLE PARAMETERS ---------------------------- +renew-hook + Renew hook command directly passed to Certbot in cron job. + domain Domains to be included in the certificate. When specified then object id is not used as a domain. -deploy-hook - Command to be executed only when the certificate associated with this - ``$__object_id`` is issued or renewed. - You can specify it multiple times, but any failure will prevent further - commands from being executed. - - For this command, the - shell variable ``$RENEWED_LINEAGE`` will point to the - config live subdirectory (for example, - ``/etc/letsencrypt/live/${__object_id}``) containing the - new certificates and keys; the shell variable - ``$RENEWED_DOMAINS`` will contain a space-delimited list - of renewed certificate domains (for example, - ``example.com www.example.com``) - -pre-hook - Command to be run in a shell before obtaining any - certificates. - You can specify it multiple times, but any failure will prevent further - commands from being executed. - - Note these run regardless of which certificate is attempted, you may want to - manage these system-wide hooks with ``__file`` in - ``/etc/letsencrypt/renewal-hooks/pre/``. - - Intended primarily for renewal, where it - can be used to temporarily shut down a webserver that - might conflict with the standalone plugin. This will - only be called if a certificate is actually to be - obtained/renewed. - -post-hook - Command to be run in a shell after attempting to - obtain/renew certificates. - You can specify it multiple times, but any failure will prevent further - commands from being executed. - - Note these run regardless of which certificate was attempted, you may want to - manage these system-wide hooks with ``__file`` in - ``/etc/letsencrypt/renewal-hooks/post/``. - - Can be used to deploy - renewed certificates, or to restart any servers that - were stopped by --pre-hook. This is only run if an - attempt was made to obtain/renew a certificate. - - BOOLEAN PARAMETERS ------------------ +automatic-renewal + Install a cron job, which attempts to renew certificates daily. + staging Obtain a test certificate from a staging server. - MESSAGES -------- change - Certificate was changed. + Certificte was changed. create - Certificate was created. + Certificte was created. remove - Certificate was removed. - + Certificte was removed. EXAMPLES -------- @@ -137,7 +75,8 @@ EXAMPLES # use object id as domain __letsencrypt_cert example.com \ --admin-email root@example.com \ - --deploy-hook "service nginx reload" \ + --automatic-renewal \ + --renew-hook "service nginx reload" \ --webroot /data/letsencrypt/root .. code-block:: sh @@ -146,10 +85,11 @@ EXAMPLES # and example.com needs to be included again with domain parameter __letsencrypt_cert example.com \ --admin-email root@example.com \ + --automatic-renewal \ --domain example.com \ --domain foo.example.com \ --domain bar.example.com \ - --deploy-hook "service nginx reload" \ + --renew-hook "service nginx reload" \ --webroot /data/letsencrypt/root AUTHORS @@ -159,13 +99,11 @@ AUTHORS | Kamila Součková | Darko Poljak | Ľubomír Kučera -| Evilham - COPYING ------- -Copyright \(C) 2017-2021 Nico Schottelius, Kamila Součková, Darko Poljak and +Copyright \(C) 2017-2018 Nico Schottelius, Kamila Součková, Darko Poljak and Ľubomír Kučera. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest old mode 100644 new mode 100755 index 638a99e0..68ecf9d4 --- a/cdist/conf/type/__letsencrypt_cert/manifest +++ b/cdist/conf/type/__letsencrypt_cert/manifest @@ -1,20 +1,18 @@ #!/bin/sh -certbot_fullpath="$(grep "^certbot_path:" "${__object:?}/explorer/certificate-data" | cut -d ':' -f 2-)" -state=$(cat "${__object}/parameter/state") -os="$(cat "${__global:?}/explorer/os")" +certbot_fullpath="$(cat "${__object:?}/explorer/certbot-path")" if [ -z "${certbot_fullpath}" ]; then + os="$(cat "${__global:?}/explorer/os")" os_version="$(cat "${__global}/explorer/os_version")" - # Use this, very common value, as a default. It is OS-dependent - certbot_fullpath="/usr/bin/certbot" + case "$os" in - archlinux) - __package certbot - ;; - alpine) - __package certbot - ;; + archlinux) + __package certbot + ;; + alpine) + __package certbot + ;; debian) case "$os_version" in 8*) @@ -41,7 +39,7 @@ if [ -z "${certbot_fullpath}" ]; then require="__apt_source/stretch-backports" __package_apt certbot \ --target-release stretch-backports ;; - 10*|11*) + 10*) __package_apt certbot ;; @@ -50,7 +48,9 @@ if [ -z "${certbot_fullpath}" ]; then exit 1 ;; esac - ;; + + certbot_fullpath=/usr/bin/certbot + ;; devuan) case "$os_version" in jessie) @@ -83,13 +83,13 @@ if [ -z "${certbot_fullpath}" ]; then exit 1 ;; esac + + certbot_fullpath=/usr/bin/certbot ;; freebsd) - __package py37-certbot - certbot_fullpath="/usr/local/bin/certbot" - ;; - ubuntu) - __package certbot + __package py27-certbot + + certbot_fullpath=/usr/local/bin/certbot ;; *) echo "Unsupported os: $os" >&2 @@ -98,61 +98,18 @@ if [ -z "${certbot_fullpath}" ]; then esac fi -# Other OS-dependent values that we want to set every time -LE_DIR="/etc/letsencrypt" -certbot_cronjob_state="absent" -case "$os" in - archlinux|alpine) - certbot_cronjob_state="present" - ;; - freebsd) - LE_DIR="/usr/local/etc/letsencrypt" - # FreeBSD uses periodic(8) instead of crontabs for this - __line "periodic.conf_weekly_certbot" \ - --file "/etc/periodic.conf" \ - --regex "^(#[[:space:]]*)?weekly_certbot_enable=.*" \ - --state "replace" \ - --line 'weekly_certbot_enable="YES"' - ;; - *) - ;; -esac +if [ -f "${__object}/parameter/automatic-renewal" ]; then + renew_hook_param="${__object}/parameter/renew-hook" + renew_hook="" + if [ -f "${renew_hook_param}" ]; then + while read -r hook; do + renew_hook="${renew_hook} --renew-hook \"${hook}\"" + done < "${renew_hook_param}" + fi -# This is only necessary in certain OS -__cron letsencrypt-certbot \ - --user root \ - --command "${certbot_fullpath} renew -q" \ - --hour 0 \ - --minute 47 \ - --state "${certbot_cronjob_state}" - -# Ensure hook directories -HOOKS_DIR="${LE_DIR}/renewal-hooks" -__directory "${LE_DIR}" --mode 0755 -require="__directory/${LE_DIR}" __directory "${HOOKS_DIR}" --mode 0755 - -if [ -f "${__object}/parameter/domain" ]; then - domains="$(sort "${__object}/parameter/domain")" -else - domains="${__object_id}" + __cron letsencrypt-certbot \ + --user root \ + --command "${certbot_fullpath} renew -q ${renew_hook}" \ + --hour 0 \ + --minute 47 fi - -# Install hooks as needed -for hook in deploy pre post; do - # Using something unique and specific to this object - hook_file="${HOOKS_DIR}/${hook}/${__object_id}.cdist.sh" - - # This defines hook_contents - # shellcheck source=cdist/conf/type/__letsencrypt_cert/files/gen_hook.sh - . "${__type}/files/gen_hook.sh" - - # Ensure hook directory exists - require="__directory/${HOOKS_DIR}" __directory "${HOOKS_DIR}/${hook}" \ - --mode 0755 - require="__directory/${HOOKS_DIR}/${hook}" __file "${hook_file}" \ - --mode 0555 \ - --source '-' \ - --state "${hook_state}" <> "$__messages_out" remove=1 else diff --git a/cdist/conf/type/__line/man.rst b/cdist/conf/type/__line/man.rst index 70490f68..f76cab64 100644 --- a/cdist/conf/type/__line/man.rst +++ b/cdist/conf/type/__line/man.rst @@ -31,7 +31,7 @@ file line Specifies the line which should be absent or present. - Must be present, if state is 'present' or 'replace'. + Must be present, if state is 'present'. Ignored if regex is given and state is 'absent'. regex @@ -41,13 +41,10 @@ regex If state is 'absent', ensure all lines matching the regular expression are absent. - If state is 'replace', ensure all lines matching the regular expression - are exactly 'line'. - The regular expression is interpreted by awk's match function. state - 'present', 'absent' or 'replace', defaults to 'present'. + 'present' or 'absent', defaults to 'present' onchange The code to run if line is added, removed or updated. @@ -102,12 +99,6 @@ EXAMPLES --line '-session required pam_exec.so debug log=/tmp/classify.log /usr/local/libexec/classify' \ --after '^session[[:space:]]+include[[:space:]]+password-auth-ac$' - # Uncomment as needed and set a value in a configuration file. - __line /etc/example.conf \ - --line 'SomeSetting SomeValue' \ - --regex '^(#[[:space:]]*)?SomeSetting[[:space:]]' \ - --state replace - SEE ALSO -------- diff --git a/cdist/conf/type/__link/man.rst b/cdist/conf/type/__link/man.rst index 2e81aea9..fe0ce425 100644 --- a/cdist/conf/type/__link/man.rst +++ b/cdist/conf/type/__link/man.rst @@ -18,7 +18,7 @@ source Specifies the link source. type - Specifies the link type: Either hard or symbolic. + Specifies the link type: Either hard or symoblic. OPTIONAL PARAMETERS diff --git a/cdist/conf/type/__locale/deprecated b/cdist/conf/type/__locale/deprecated deleted file mode 100644 index 5a06b28e..00000000 --- a/cdist/conf/type/__locale/deprecated +++ /dev/null @@ -1 +0,0 @@ -This type is deprecated. Please use __localedef instead. diff --git a/cdist/conf/type/__locale/gencode-remote b/cdist/conf/type/__locale/gencode-remote index 4639cef8..1feb9884 100755 --- a/cdist/conf/type/__locale/gencode-remote +++ b/cdist/conf/type/__locale/gencode-remote @@ -23,15 +23,6 @@ locale="$__object_id" -state_is=$(cat "$__object/explorer/state") -state_should=$(cat "$__object/parameter/state") - -# short circuit if there is nothing to do -if [ "$state_is" = "$state_should" ]; then - exit 0 -fi - - # Hardcoded, create a pull request with # branching on $os in case it is at another location alias=/usr/share/locale/locale.alias @@ -44,6 +35,8 @@ charmap=$(echo "$locale" | cut -d . -f 2) # W-T-F! locale_remove=$(echo "$locale" | sed 's/UTF-8/utf8/') +state=$(cat "$__object/parameter/state") + os=$(cat "$__global/explorer/os") # Nothing to be done on alpine @@ -53,7 +46,7 @@ case "$os" in ;; esac -case "$state_should" in +case "$state" in present) echo localedef -A "$alias" -f "$charmap" -i "$input" "$locale" ;; @@ -61,7 +54,7 @@ case "$state_should" in echo localedef --delete-from-archive "$locale_remove" ;; *) - echo "Unsupported state: $state_should" >&2 + echo "Unsupported state: $state" >&2 exit 1 ;; esac diff --git a/cdist/conf/type/__locale_system/manifest b/cdist/conf/type/__locale_system/manifest index 4b996ebc..80f7401b 100755 --- a/cdist/conf/type/__locale_system/manifest +++ b/cdist/conf/type/__locale_system/manifest @@ -3,7 +3,6 @@ # 2012-2016 Steven Armstrong (steven-cdist at armstrong.cc) # 2016 Carlos Ortigoza (carlos.ortigoza at ungleich.ch) # 2016 Nico Schottelius (nico.schottelius at ungleich.ch) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -24,171 +23,17 @@ # Configure system-wide locale by modifying i18n file. # -version_ge() { - awk -F '[^0-9.]' -v target="${1:?}" ' - function max(x, y) { return x > y ? x : y } - BEGIN { - getline - nx = split($1, x, ".") - ny = split(target, y, ".") - for (i = 1; i <= max(nx, ny); ++i) { - diff = int(x[i]) - int(y[i]) - if (diff == 0) continue - exit (diff < 0) - } - }' -} - - -key=$__object_id -onchange_cmd= # none, by default -quote_value=false - -catval() { - # shellcheck disable=SC2059 - printf "$($quote_value && echo '"%s"' || echo '%s')" "$(cat "$1")" -} - -state_should=$(cat "${__object}/parameter/state") - os=$(cat "$__global/explorer/os") -case $os -in - debian) - if version_ge 4 <"${__global}/explorer/os_version" - then - # Debian 4 (etch) and later - locale_conf="/etc/default/locale" - else - locale_conf="/etc/environment" - fi - ;; - devuan) +case "$os" in + debian|ubuntu) locale_conf="/etc/default/locale" ;; - ubuntu) - if version_ge 6.10 <"${__global}/explorer/os_version" - then - # Ubuntu 6.10 (edgy) and later - locale_conf="/etc/default/locale" - else - locale_conf="/etc/environment" - fi - ;; archlinux) locale_conf="/etc/locale.conf" ;; - centos|redhat|scientific) - # shellcheck source=/dev/null - version_id=$(. "${__global}/explorer/os_release" && echo "${VERSION_ID:-0}") - if echo "${version_id}" | version_ge 7 - then - locale_conf="/etc/locale.conf" - else - locale_conf="/etc/sysconfig/i18n" - fi - ;; - fedora) - # shellcheck source=/dev/null - version_id=$(. "${__global}/explorer/os_release" && echo "${VERSION_ID:-0}") - if echo "${version_id}" | version_ge 18 - then - locale_conf="/etc/locale.conf" - quote_value=false - else - locale_conf="/etc/sysconfig/i18n" - fi - ;; - gentoo) - case $(cat "${__global}/explorer/init") - in - (*openrc*) - locale_conf="/etc/env.d/02locale" - onchange_cmd="env-update --no-ldconfig" - quote_value=true - ;; - (systemd) - locale_conf="/etc/locale.conf" - ;; - esac - ;; - freebsd|netbsd) - # NetBSD doesn't have a separate configuration file to set locales. - # In FreeBSD locales could be configured via /etc/login.conf but parsing - # that would be annoying, so the shell login file will have to do. - # "Non-POSIX" shells like csh will not be updated here. - - locale_conf="/etc/profile" - quote_value=true - value="$(catval "${__object}/parameter/value"); export ${key}" - ;; - solaris) - locale_conf="/etc/default/init" - locale_conf_group="sys" - - if version_ge 5.11 <"${__global}/explorer/os_version" - then - # mode on Oracle Solaris 11 is actually 0444, - # but the write bit makes sense, IMO - locale_conf_mode=0644 - - # Oracle Solaris 11.2 and later uses SMF to store environment info. - # This is a hack, but I didn't feel like modifying the whole type - # just for some Oracle nonsense. - # 11.3 apparently added nlsadm(1m), but it is missing from 11.2. - # Illumos continues to use /etc/default/init - # NOTE: Remember not to use "cool" POSIX features like -q or -e with - # Solaris grep. - release_regex='Oracle Solaris 11.[2-9][0-9]*' - case $state_should - in - (present) - svccfg_cmd="svccfg -s svc:/system/environment:init setprop environment/${key} = astring: '$(cat "${__object}/parameter/value")'" - ;; - (absent) - svccfg_cmd="svccfg -s svc:/system/environment:init delprop environment/${key}" - ;; - esac - refresh_cmd='svcadm refresh svc:/system/environment' - onchange_cmd="grep '${release_regex}' /etc/release >&- || exit 0; ${svccfg_cmd:-:} && ${refresh_cmd}" - else - locale_conf_mode=0555 - fi - ;; - slackware) - # NOTE: lang.csh (csh config) is ignored here. - locale_conf="/etc/profile.d/lang.sh" - locale_conf_mode=0755 - key="export ${__object_id}" - ;; - suse) - if test -s "${__global}/explorer/os_release" - then - # shellcheck source=/dev/null - os_version=$(. "${__global}/explorer/os_release" && echo "${VERSION}") - else - os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global}/explorer/os_version") - fi - os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)') - - # https://documentation.suse.com/sles/15-SP2/html/SLES-all/cha-suse.html#sec-suse-l10n - if expr "${os_major}" '>=' 15 \& "${os_major}" != 42 - then - # It seems that starting with SuSE 15 the systemd /etc/locale.conf - # is the preferred way to set locales, although - # /etc/sysconfig/language is still available. - # Older documentation doesn't mention /etc/locale.conf, even though - # is it created when localectl is used. - locale_conf="/etc/locale.conf" - else - locale_conf="/etc/sysconfig/language" - quote_value=true - key="RC_${__object_id}" - fi - ;; - voidlinux) - locale_conf="/etc/locale.conf" + redhat|centos) + locale_conf="/etc/sysconfig/i18n" ;; *) echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 @@ -197,16 +42,14 @@ in ;; esac -__file "${locale_conf}" --state exists \ - --owner "${locale_conf_owner:-0}" \ - --group "${locale_conf_group:-0}" \ - --mode "${locale_conf_mode:-0644}" +__file "$locale_conf" \ + --owner root --group root --mode 644 \ + --state exists -require="__file/${locale_conf}" \ -__key_value "${locale_conf}:${key#export }" \ - --file "${locale_conf}" \ - --key "${key}" \ - --delimiter '=' --exact_delimiter \ - --state "${state_should}" \ - --value "${value:-$(catval "${__object}/parameter/value")}" \ - --onchange "${onchange_cmd}" +require="__file/$locale_conf" \ + __key_value "$locale_conf:$__object_id" \ + --file "$locale_conf" \ + --key "$__object_id" \ + --delimiter = \ + --state "$(cat "$__object/parameter/state")" \ + --value "$(cat "$__object/parameter/value")" diff --git a/cdist/conf/type/__localedef/explorer/state b/cdist/conf/type/__localedef/explorer/state deleted file mode 100755 index 3ba57661..00000000 --- a/cdist/conf/type/__localedef/explorer/state +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# This explorer determines if the locale is defined on the target system. -# Will print nothing on error. -# -# Possible output: -# present: -# the main locale (and possibly aliases) is present -# absent: -# neither the main locale nor any aliases are present -# alias-present: -# the main locale is absent, but at least one of its aliases is present -# - -# Hardcoded, create a pull request in case it is at another location for -# some other distro. (cf. gencode-remote) -aliasfile='/usr/share/locale/locale.alias' - -command -v locale >/dev/null 2>&1 || exit 0 - -locales=$(locale -a) - -parse_locale() { - # This function will split locales into their parts. Locale strings are - # usually of the form: [language[_territory][.codeset][@modifier]] - # For simplicity, language and territory are not separated by this function. - # Old Linux systems were also using "english" or "german" as locale strings. - # Usage: parse_locale locale_str lang_var codeset_var modifier_var - eval "${2:?}"="$(expr "$1" : '\([^.@]*\)')" - eval "${3:?}"="$(expr "$1" : '[^.]*\.\([^@]*\)')" - eval "${4:?}"="$(expr "$1" : '.*@\(.*\)$')" -} - -format_locale() { - # Usage: format_locale language codeset modifier - printf '%s' "$1" - test -z "$2" || printf '.%s' "$2" - test -z "$3" || printf '@%s' "$3" - printf '\n' -} - -gnu_normalize_codeset() { - # reimplementation of glibc/locale/programs/localedef.c normalize_codeset() - echo "$*" | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]' -} - -locale_available() ( - echo "${locales}" | grep -qxF "$1" || { - # glibc uses "normalized" locale names in archives. - # If a locale is stored in an archive, the normalized name will be - # printed by locale, so that needs to be checked, too. - localename=$( - parse_locale "$1" _lang _codeset _modifier \ - && format_locale "${_lang:?}" "$(gnu_normalize_codeset "${_codeset?}")" \ - "${_modifier?}") - echo "${locales}" | grep -qxF "${localename}" - } -) - -if locale_available "${__object_id:?}" -then - echo present -else - # NOTE: locale.alias can be symlinked. - if test -e "${aliasfile}" - then - # Check if one of the aliases of the locale is defined - baselocale=$( - parse_locale "${__object_id:?}" _lang _codeset _modifiers \ - && format_locale "${_lang}" "${_codeset}") - while read -r _alias _localename - do - if test "${_localename}" = "${baselocale}" \ - && echo "${locales}" | grep -qxF "${_alias}" - then - echo alias-present - exit 0 - fi - done <"${aliasfile}" - fi - - echo absent -fi diff --git a/cdist/conf/type/__localedef/files/lib/glibc.sh b/cdist/conf/type/__localedef/files/lib/glibc.sh deleted file mode 100644 index 6ace80d4..00000000 --- a/cdist/conf/type/__localedef/files/lib/glibc.sh +++ /dev/null @@ -1,5 +0,0 @@ -# -*- mode: sh; indent-tabs-mode: t -*- - -gnu_normalize_codeset() { - echo "$*" | tr -cd '[:alnum:]' | tr '[:upper:]' '[:lower:]' -} diff --git a/cdist/conf/type/__localedef/files/lib/locale.sh b/cdist/conf/type/__localedef/files/lib/locale.sh deleted file mode 100644 index b5e61374..00000000 --- a/cdist/conf/type/__localedef/files/lib/locale.sh +++ /dev/null @@ -1,20 +0,0 @@ -# -*- mode: sh; indent-tabs-mode:t -*- - -parse_locale() { - # This function will split locales into their parts. Locale strings are - # usually of the form: [language[_territory][.codeset][@modifier]] - # For simplicity, language and territory are not separated by this function. - # Old Linux systems were also using "english" or "german" as locale strings. - # Usage: parse_locale locale_str lang_var codeset_var modifier_var - eval "${2:?}"="$(expr "$1" : '\([^.@]*\)')" - eval "${3:?}"="$(expr "$1" : '[^.]*\.\([^@]*\)')" - eval "${4:?}"="$(expr "$1" : '.*@\(.*\)$')" -} - -format_locale() { - # Usage: format_locale language codeset modifier - printf '%s' "$1" - test -z "$2" || printf '.%s' "$2" - test -z "$3" || printf '@%s' "$3" - printf '\n' -} diff --git a/cdist/conf/type/__localedef/gencode-remote b/cdist/conf/type/__localedef/gencode-remote deleted file mode 100755 index 4538151f..00000000 --- a/cdist/conf/type/__localedef/gencode-remote +++ /dev/null @@ -1,136 +0,0 @@ -#!/bin/sh -e -# -# 2013-2019 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Manage system locales using localedef(1). -# - -# shellcheck source=cdist/conf/type/__localedef/files/lib/locale.sh -. "${__type:?}/files/lib/locale.sh" -# shellcheck source=cdist/conf/type/__localedef/files/lib/glibc.sh -. "${__type:?}/files/lib/glibc.sh" - -state_is=$(cat "${__object:?}/explorer/state") -state_should=$(cat "${__object:?}/parameter/state") - -test "${state_should}" = 'present' -o "${state_should}" = 'absent' || { - printf 'Invalid state: %s\n' "${state_should}" >&2 - exit 1 -} - -# NOTE: If state explorer fails (e.g. locale(1) missing), the following check -# will always fail and let definition/removal run. -if test "${state_is}" = "${state_should}" -then - exit 0 -fi - -locale=${__object_id:?} -os=$(cat "${__global:?}/explorer/os") - -if expr "${locale}" : '.*/' >/dev/null -then - printf 'Paths as locales are not supported.\n' >&2 - printf '__object_id is: %s\n' "${locale}" >&2 - exit 1 -fi - -: "${lang=}" "${codeset=}" "${modifier=}" # declare variables for shellcheck -parse_locale "${locale}" lang codeset modifier - - -case ${os} -in - (alpine|openwrt) - printf '%s does not support locales.\n' "${os}" >&2 - exit 1 - ;; - (archlinux|debian|devuan|ubuntu|suse|centos|fedora|redhat|scientific) - # FIXME: The code below only works for glibc-based installations. - - # NOTE: Hardcoded, create a pull request in case it is at another - # location for some opther distro. - # NOTE: locale.alias can be symlinked (e.g. Debian) - aliasfile='/usr/share/locale/locale.alias' - - case ${state_should} - in - (present) - input=$(format_locale "${lang}" '' "${modifier}") - cat <<-EOF - set -- - if test -e '${aliasfile}' - then - set -- -A '${aliasfile}' - fi - - localedef -i '${input}' -f '${codeset}' "\$@" '${locale}' - EOF - ;; - (absent) - main_localename=$(format_locale "${lang}" "$(gnu_normalize_codeset "${codeset}")" "${modifier}") - - cat <<-EOF - while read -r _alias _localename - do - if test "\${_localename}" = '$(format_locale "${lang}" "${codeset}")' - then - localedef --delete-from-archive "\${_alias}" - fi - done <'${aliasfile}' - EOF - - if test "${state_is}" = present - then - printf "localedef --delete-from-archive '%s'\n" "${main_localename}" - fi - ;; - esac - ;; - (freebsd) - case ${state_should} - in - (present) - if expr "$(grep -oe '^[0-9]*' "${__global:?}/explorer/os_version")" '>=' 11 >/dev/null - then - # localedef(1) is available with FreeBSD >= 11 - printf "localedef -i '%s' -f '%s' '%s'\n" "${input}" "${codeset}" "${locale}" - else - printf 'localedef(1) was added to FreeBSD starting with version 11.\n' >&2 - printf 'Please upgrade your FreeBSD installation to use %s.\n' "${__type##*/}" >&2 - exit 1 - fi - ;; - (absent) - printf "rm -R '/usr/share/locale/%s'\n" "${locale}" - ;; - esac - ;; - (netbsd|openbsd) - # NetBSD/OpenBSD are missing localedef(1). - # We also do not delete defined locales because they can't be recreated. - echo "${os} is lacking localedef(1). Locale management unavailable." >&2 - exit 1 - ;; - (*) - echo "Your operating system (${os}) is currently not supported by this type (${__type##*/})." >&2 - echo "Please contribute an implementation for it if you can." >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__localedef/man.rst b/cdist/conf/type/__localedef/man.rst deleted file mode 100644 index 454ce9d1..00000000 --- a/cdist/conf/type/__localedef/man.rst +++ /dev/null @@ -1,60 +0,0 @@ -cdist-type__localedef(7) -======================== - -NAME ----- -cdist-type__localedef - Define and remove system locales - - -DESCRIPTION ------------ -This cdist type allows you to define locales on the system using -:strong:`localedef`\ (1) or remove them. -On systems that don't support definition of new locales, the type will raise an -error. - -**NB:** This type respects the glibc ``locale.alias`` file, -i.e. it defines alias locales or deletes aliases of a locale when it is removed. -It is not possible, however, to use alias names to define locales or only remove -certain aliases of a locale. - - -OPTIONAL PARAMETERS -------------------- -state - ``present`` or ``absent``. Defaults to ``present``. - - -EXAMPLES --------- - -.. code-block:: sh - - # Add locale de_CH.UTF-8 - __localedef de_CH.UTF-8 - - # Same as above, but more explicit - __localedef de_CH.UTF-8 --state present - - # Remove colourful British English - __localedef en_GB.UTF-8 --state absent - - -SEE ALSO --------- -:strong:`locale`\ (1), -:strong:`localedef`\ (1), -:strong:`cdist-type__locale_system`\ (7) - - -AUTHORS -------- -| Dennis Camera -| Nico Schottelius - - -COPYING -------- -Copyright \(C) 2013-2019 Nico Schottelius, 2020 Dennis Camera. Free use of this -software is granted under the terms of the GNU General Public License version 3 -or later (GPLv3+). diff --git a/cdist/conf/type/__localedef/manifest b/cdist/conf/type/__localedef/manifest deleted file mode 100755 index 3ab3ad8c..00000000 --- a/cdist/conf/type/__localedef/manifest +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/sh -e -# -# 2013-2019 Nico Schottelius (nico-cdist at schottelius.org) -# 2015 David Hürlimann (david at ungleich.ch) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Install required packages. -# - -case $(cat "${__global:?}/explorer/os") -in - (debian|devuan) - __package_apt locales --state present - ;; -esac diff --git a/cdist/conf/type/__localedef/parameter/default/state b/cdist/conf/type/__localedef/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__localedef/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__localedef/parameter/optional b/cdist/conf/type/__localedef/parameter/optional deleted file mode 100644 index ff72b5c7..00000000 --- a/cdist/conf/type/__localedef/parameter/optional +++ /dev/null @@ -1 +0,0 @@ -state diff --git a/cdist/conf/type/__matrix_riot/files/config.json.sh b/cdist/conf/type/__matrix_riot/files/config.json.sh new file mode 100755 index 00000000..d15d4862 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/files/config.json.sh @@ -0,0 +1,56 @@ +#!/bin/sh +# +# Upstream configuration guide/documentation: +# https://github.com/vector-im/riot-web/blob/develop/docs/config.md + +generate_embedded_pages () { + if [ $EMBED_HOMEPAGE ]; then + cat << EOF + "embeddedPages": { + "homeUrl": "home.html" + }, +EOF + fi +} + +cat << EOF +{ + "default_server_config": { + "m.homeserver": { + "base_url": "$DEFAULT_SERVER_URL", + "server_name": "$DEFAULT_SERVER_NAME" + }, + "m.identity_server": { + "base_url": "https://vector.im" + } + }, + "brand": "$BRAND", + "defaultCountryCode": "$DEFAULT_COUNTRY_CODE", + "integrations_ui_url": "https://scalar.vector.im/", + "integrations_rest_url": "https://scalar.vector.im/api", + "integrations_widgets_urls": [ + "https://scalar.vector.im/_matrix/integrations/v1", + "https://scalar.vector.im/api", + "https://scalar-staging.vector.im/_matrix/integrations/v1", + "https://scalar-staging.vector.im/api", + "https://scalar-staging.riot.im/scalar/api" + ], + "bug_report_endpoint_url": "https://riot.im/bugreports/submit", + "roomDirectory": { + "servers": [ + $ROOM_DIRECTORY_SERVERS + ] + }, + $(generate_embedded_pages) + "terms_and_conditions_links": [ + { + "url": "$PRIVACY_POLICY_URL", + "text": "Privacy Policy" + }, + { + "url": "$COOKIE_POLICY_URL", + "text": "Cookie Policy" + } + ] +} +EOF diff --git a/cdist/conf/type/__matrix_riot/gencode-remote b/cdist/conf/type/__matrix_riot/gencode-remote new file mode 100755 index 00000000..b8935588 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/gencode-remote @@ -0,0 +1,74 @@ +#!/bin/sh -e +# +# 2019 Timothée Floure (timothee.floure@ungleich.ch) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# + +VERSION=$(cat "$__object/parameter/version") +INSTALL_DIR=$(cat "$__object/parameter/install_dir") +OWNER=$(cat "$__object/parameter/owner") + +src="riot-v$VERSION" +archive="$src.tar.gz" +config='config.json' +homepage='home.html' +url="https://github.com/vector-im/riot-web/releases/download/v$VERSION/$archive" + +# tar and curl are installed by the __matrix-riot manifest. mktemp is usually +# provided by coreutils and assumed installed. +cat << EOF +set -e + +# Ensure that coreutils is installed. +if [ ! -x \$(which mktemp) ]; then + echo "mktemp is not available on the remote host." >&2 + exit 1 +fi + +# Create temporary working directory. +tmpdir=\$(mktemp -d) +cd \$tmpdir + +# Download and extract sources. +curl -L '$url' > $archive +tar xf $archive + +# Backup configuration deployed by __matrix_riot. +cp '$INSTALL_DIR/$config' '$config' + +# Backup homepage deployed by __matrix_riot +if [ -f '$INSTALL_DIR/$homepage' ]; then + cp '$INSTALL_DIR/$homepage' '$homepage' +fi + +# Deploy sources and restore configuration. +rm -r '$INSTALL_DIR' +mv '$src' '$INSTALL_DIR' +cp '$config' '$INSTALL_DIR/$config' + +# Restore homepage if available. +if [ -f '$homepage' ]; then + cp '$homepage' '$INSTALL_DIR/$homepage' +fi + +# Chown deployed files to requested owner. +chown -R '$OWNER' '$INSTALL_DIR' + +# Remove temporary working directory. +cd / +rm -r \$tmpdir +EOF diff --git a/cdist/conf/type/__matrix_riot/man.rst b/cdist/conf/type/__matrix_riot/man.rst new file mode 100644 index 00000000..c8d80024 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/man.rst @@ -0,0 +1,72 @@ +cdist-type__matrix_riot(7) +====================== + +NAME +---- +cdist-type__matrix_riot - Install and configure Riot, a web Matrix client. + + +DESCRIPTION +----------- +This type install and configure the Riot web client. + + +REQUIRED PARAMETERS +------------------- +install_dir + Root directory of Riot's static files. + +version + Release of Riot to install. + +OPTIONAL PARAMETERS +------------------- +default_server_name + Name of matrix homeserver to connect to, defaults to 'matrix.org'. + +default_server_url + URL of matrix homeserver to connect to, defaults to 'https://matrix-client.matrix.org'. + +owner + Owner of the deployed files, passed to `chown`. Defaults to 'root'. + +brand + Web UI branding, defaults to 'Riot'. + +default_country_code + ISO 3166 alpha2 country code to use when showing country selectors, such as + phone number inputs. Defaults to GB. + +privacy_policy_url + Defaults to 'https://riot.im/privacy'. + +cookie_policy_url + Defaults to 'https://matrix.org/docs/guides/riot_im_cookie_policy'. + +homepage + Path to custom Riot homepage, displayed once logged in. + +EXAMPLES +-------- + +.. code-block:: sh + + __matrix_riot my-riot --install_dir /var/www/riot-web --version 1.5.6 + + +SEE ALSO +-------- +- `cdist-type__matrix_synapse(7) `_ + + +AUTHORS +------- +Timothée Floure + + +COPYING +------- +Copyright \(C) 2019 Timothée Floure. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__matrix_riot/manifest b/cdist/conf/type/__matrix_riot/manifest new file mode 100755 index 00000000..703e8b6f --- /dev/null +++ b/cdist/conf/type/__matrix_riot/manifest @@ -0,0 +1,68 @@ +#!/bin/sh -e +# +# 2019 Timothée Floure (timothee.floure@ungleich.ch) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# + +INSTALL_DIR=$(cat "$__object/parameter/install_dir") + +default_server_name=$(cat "$__object/parameter/default_server_name") +brand=$(cat "$__object/parameter/brand") +default_country_code=$(cat "$__object/parameter/default_country_code") +room_directory_servers=$(cat "$__object/parameter/room_directory_servers") +privacy_policy_url=$(cat "$__object/parameter/privacy_policy_url") +cookie_policy_url=$(cat "$__object/parameter/cookie_policy_url") + +export DEFAULT_SERVER_NAME=$default_server_name +export BRAND=$brand +export DEFAULT_COUNTRY_CODE=$default_country_code +export ROOM_DIRECTORY_SERVERS=$room_directory_servers +export PRIVACY_POLICY_URL=$privacy_policy_url +export COOKIE_POLICY_URL=$cookie_policy_url + +if [ -f "$__object/parameter/homepage" ]; then + export EMBED_HOMEPAGE=1 + homepage=$(cat "$__object/parameter/homepage") +fi + +# Owner of the uploaded files. +owner=$(cat "$__object/parameter/owner") + +# Ensure that curl and tar are installed, as they will be required by the +# gencode-remote script. +__package curl --state present +__package tar --state present + +# Generate and deploy configuration file. +mkdir -p "$__object/files" +"$__type/files/config.json.sh" > "$__object/files/config.json" + +# Install the config.json configuration file. The application's sources are +# downloaded and deployed by gencode-remote. +__directory "$INSTALL_DIR" \ + --owner "$owner" --mode 0755 --parents \ + --state present +require="__directory/$INSTALL_DIR" __file "$INSTALL_DIR/config.json" \ + --source "$__object/files/config.json" \ + --mode 0664 \ + --state present +if [ $EMBED_HOMEPAGE ]; then + require="__directory/$INSTALL_DIR" __file "$INSTALL_DIR/home.html" \ + --source "$homepage" \ + --mode 0664 \ + --state present +fi diff --git a/cdist/conf/type/__matrix_riot/parameter/default/brand b/cdist/conf/type/__matrix_riot/parameter/default/brand new file mode 100644 index 00000000..e8095bb8 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/brand @@ -0,0 +1 @@ +Riot diff --git a/cdist/conf/type/__matrix_riot/parameter/default/cookie_policy_url b/cdist/conf/type/__matrix_riot/parameter/default/cookie_policy_url new file mode 100644 index 00000000..04e9c2b7 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/cookie_policy_url @@ -0,0 +1 @@ +https://matrix.org/docs/guides/riot_im_cookie_policy diff --git a/cdist/conf/type/__matrix_riot/parameter/default/default_country_code b/cdist/conf/type/__matrix_riot/parameter/default/default_country_code new file mode 100644 index 00000000..30ac4a3b --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/default_country_code @@ -0,0 +1 @@ +GB diff --git a/cdist/conf/type/__matrix_riot/parameter/default/default_server_name b/cdist/conf/type/__matrix_riot/parameter/default/default_server_name new file mode 100644 index 00000000..5528ffdd --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/default_server_name @@ -0,0 +1 @@ +matrix.org diff --git a/cdist/conf/type/__matrix_riot/parameter/default/default_server_url b/cdist/conf/type/__matrix_riot/parameter/default/default_server_url new file mode 100644 index 00000000..2cb92277 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/default_server_url @@ -0,0 +1 @@ +https://matrix-client.matrix.org diff --git a/cdist/conf/type/__matrix_riot/parameter/default/owner b/cdist/conf/type/__matrix_riot/parameter/default/owner new file mode 100644 index 00000000..d8649da3 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/owner @@ -0,0 +1 @@ +root diff --git a/cdist/conf/type/__matrix_riot/parameter/default/privacy_policy_url b/cdist/conf/type/__matrix_riot/parameter/default/privacy_policy_url new file mode 100644 index 00000000..4cdd12c1 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/privacy_policy_url @@ -0,0 +1 @@ +https://riot.im/privacy diff --git a/cdist/conf/type/__matrix_riot/parameter/default/room_directory_servers b/cdist/conf/type/__matrix_riot/parameter/default/room_directory_servers new file mode 100644 index 00000000..4ea73ad5 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/default/room_directory_servers @@ -0,0 +1 @@ +"matrix.org" diff --git a/cdist/conf/type/__matrix_riot/parameter/optional b/cdist/conf/type/__matrix_riot/parameter/optional new file mode 100644 index 00000000..c5e949fe --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/optional @@ -0,0 +1,9 @@ +default_server_url +default_server_name +brand +default_country_code +privacy_policy_url +cookie_policy_url +room_directory_servers +owner +homepage diff --git a/cdist/conf/type/__matrix_riot/parameter/required b/cdist/conf/type/__matrix_riot/parameter/required new file mode 100644 index 00000000..a76477e9 --- /dev/null +++ b/cdist/conf/type/__matrix_riot/parameter/required @@ -0,0 +1,2 @@ +version +install_dir diff --git a/cdist/conf/type/__matrix_synapse/files/homeserver.yaml.sh b/cdist/conf/type/__matrix_synapse/files/homeserver.yaml.sh new file mode 100755 index 00000000..01f328d9 --- /dev/null +++ b/cdist/conf/type/__matrix_synapse/files/homeserver.yaml.sh @@ -0,0 +1,1651 @@ +#!/bin/sh + +# NOTE: this template has been generated using the +# matrix-synapse-1.5.1-1.fc31.noarch Fedora package for use with CDIST. + +generate_database () { + if [ "$DATABASE_ENGINE" = "sqlite3" ]; then + cat << EOF +database: + # The database engine name + name: "$DATABASE_ENGINE" + # Arguments to pass to the engine + args: + # Path to the database + database: "$DATABASE_NAME" +EOF + else +cat << EOF +database: + # The database engine name + name: "$DATABASE_ENGINE" + # Arguments to pass to the engine + args: + database: "$DATABASE_NAME" + host: "$DATABASE_HOST" + user: "$DATABASE_USER" + password: "$DATABASE_PASSWORD" +EOF + fi +} + +generate_password_providers () { + if [ "$ENABLE_LDAP_AUTH" = "true" ]; then + cat <