[__opendkim*] address cdist-contrib #32 review

[__opendkim_genkey] add debian support
[__opendkim] add debian support
2024-05-29 15:50:26 +02:00 · 2024-05-21 16:32:29 +02:00 · 2024-05-21 16:32:29 +02:00
25 changed files with 761 additions and 1733 deletions
--- a/type/__jitsi_meet/manifest
+++ b/type/__jitsi_meet/manifest
@ -195,15 +195,6 @@ upstream jvb1 {
    keepalive 2;
 }
 EOF
-require="__directory${NGINX_ETC}/conf.d" __file "${NGINX_ETC}/conf.d/jicofo.conf" \
-  --mode 644 \
-  --source - << EOF
-upstream jicofo {
-    zone upstreams 64K;
-    server 127.0.0.1:8888;
-    keepalive 2;
-}
-EOF

 if [ -f "${__object}/parameter/secured-domains" ]; then
  SECURED_DOMAINS_STATE='present'
@ -254,9 +245,6 @@ videobridge {
            enabled = true
        }
    }
-    cc {
-        trust-bwe = false
-    }
 }
 EOFJVB

@ -276,7 +264,7 @@ if [ -f "${__object}/parameter/disable-prometheus-exporter" ]; then
 else
 	EXPORTER_STATE="present"
 fi
-__single_binary_service prometheus-jitsi-meet-exporter \
+__evilham_single_binary_service prometheus-jitsi-meet-exporter \
 	--state "${EXPORTER_STATE}" \
 	--do-not-manage-user \
 	--user "nobody" \
--- a/type/__jitsi_meet_domain/files/_update_jitsi_configurations.sh
+++ b/type/__jitsi_meet_domain/files/_update_jitsi_configurations.sh
@ -7,7 +7,7 @@

 # We could automate this, but are using it as an indicator for the
 # latest branch with which we conciliated changes.
-BRANCH="jitsi-meet_11031"
+BRANCH="jitsi-meet_8319"
 REPO="https://github.com/jitsi/jitsi-meet"

 get_url() {
--- a/type/__jitsi_meet_domain/files/config.js.sh
+++ b/type/__jitsi_meet_domain/files/config.js.sh
--- a/type/__jitsi_meet_domain/files/config.js.sh.orig
+++ b/type/__jitsi_meet_domain/files/config.js.sh.orig
--- a/type/__jitsi_meet_domain/files/interface_config.js.sh
+++ b/type/__jitsi_meet_domain/files/interface_config.js.sh
@ -52,6 +52,14 @@ var interfaceConfig = {
     */
    DISABLE_PRESENCE_STATUS: false,

+    /**
+     * Whether the ringing sound in the call/ring overlay is disabled. If
+     * {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_RINGING: false,
+
    /**
     * Whether the speech to text transcription subtitles panel is disabled.
     * If {@code undefined}, defaults to {@code false}.
@ -73,6 +81,8 @@ var interfaceConfig = {

    ENABLE_DIAL_OUT: true,

+    ENABLE_FEEDBACK_ANIMATION: false, // Enables feedback star animation.
+
    FILM_STRIP_MAX_HEIGHT: 120,

    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
@ -107,8 +117,8 @@ var interfaceConfig = {
    // Names of browsers which should show a warning stating the current browser
    // has a suboptimal experience. Browsers which are not listed as optimal or
    // unsupported are considered suboptimal. Valid values are:
-    // chrome, chromium, electron, firefox , safari, webkit
-    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'electron', 'safari', 'webkit' ],
+    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
+    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'nwjs', 'electron', 'safari' ],

    POLICY_LOGO: null,
    PROVIDER_NAME: 'Jitsi',
@ -121,7 +131,7 @@ var interfaceConfig = {
    RECENT_LIST_ENABLED: true,
    REMOTE_THUMBNAIL_RATIO: 1, // 1:1

-    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'shortcuts', 'sounds', 'more' ],
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds', 'more' ],

    /**
     * Specify which sharing features should be displayed. If the value is not set
@ -203,6 +213,17 @@ var interfaceConfig = {

    // NATIVE_APP_NAME: 'Jitsi Meet',

+    /**
+     * Specify Firebase dynamic link properties for the mobile apps.
+     */
+    // MOBILE_DYNAMIC_LINK: {
+    //    APN: 'org.jitsi.meet',
+    //    APP_CODE: 'w2atb',
+    //    CUSTOM_DOMAIN: undefined,
+    //    IBI: 'com.atlassian.JitsiMeet.ios',
+    //    ISI: '1165103905'
+    // },
+
    /**
     * Hide the logo on the deep linking pages.
     */
@ -216,7 +237,7 @@ var interfaceConfig = {
    /**
     * Specify custom URL for downloading f droid app.
     */
-    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/packages/org.jitsi.meet/',
+    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',

    // Connection indicators (
    // CONNECTION_INDICATOR_AUTO_HIDE_ENABLED,
--- a/type/__jitsi_meet_domain/files/interface_config.js.sh.orig
+++ b/type/__jitsi_meet_domain/files/interface_config.js.sh.orig
@ -41,6 +41,14 @@ var interfaceConfig = {
     */
    DISABLE_PRESENCE_STATUS: false,

+    /**
+     * Whether the ringing sound in the call/ring overlay is disabled. If
+     * {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_RINGING: false,
+
    /**
     * Whether the speech to text transcription subtitles panel is disabled.
     * If {@code undefined}, defaults to {@code false}.
@ -62,6 +70,8 @@ var interfaceConfig = {

    ENABLE_DIAL_OUT: true,

+    ENABLE_FEEDBACK_ANIMATION: false, // Enables feedback star animation.
+
    FILM_STRIP_MAX_HEIGHT: 120,

    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
@ -96,8 +106,8 @@ var interfaceConfig = {
    // Names of browsers which should show a warning stating the current browser
    // has a suboptimal experience. Browsers which are not listed as optimal or
    // unsupported are considered suboptimal. Valid values are:
-    // chrome, chromium, electron, firefox , safari, webkit
-    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'electron', 'safari', 'webkit' ],
+    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
+    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'nwjs', 'electron', 'safari' ],

    POLICY_LOGO: null,
    PROVIDER_NAME: 'Jitsi',
@ -110,7 +120,7 @@ var interfaceConfig = {
    RECENT_LIST_ENABLED: true,
    REMOTE_THUMBNAIL_RATIO: 1, // 1:1

-    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'shortcuts', 'sounds', 'more' ],
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds', 'more' ],

    /**
     * Specify which sharing features should be displayed. If the value is not set
@ -192,6 +202,17 @@ var interfaceConfig = {

    // NATIVE_APP_NAME: 'Jitsi Meet',

+    /**
+     * Specify Firebase dynamic link properties for the mobile apps.
+     */
+    // MOBILE_DYNAMIC_LINK: {
+    //    APN: 'org.jitsi.meet',
+    //    APP_CODE: 'w2atb',
+    //    CUSTOM_DOMAIN: undefined,
+    //    IBI: 'com.atlassian.JitsiMeet.ios',
+    //    ISI: '1165103905'
+    // },
+
    /**
     * Hide the logo on the deep linking pages.
     */
@ -205,7 +226,7 @@ var interfaceConfig = {
    /**
     * Specify custom URL for downloading f droid app.
     */
-    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/packages/org.jitsi.meet/',
+    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',

    // Connection indicators (
    // CONNECTION_INDICATOR_AUTO_HIDE_ENABLED,
--- a/type/__jitsi_meet_domain/files/jitsi-version
+++ b/type/__jitsi_meet_domain/files/jitsi-version
@ -1 +1 @@
-2.0.11031-1
+2.0.8319-1
--- a/type/__jitsi_meet_domain/files/nginx.sh
+++ b/type/__jitsi_meet_domain/files/nginx.sh
@ -12,11 +12,6 @@ JITSI_NGINX_CONFIG="$(cat <<EOF
 #    audio/wav            wav;
 #}
 # These upstreams are managed by __jitsi_meet
-#upstream jicofo {
-#    zone upstreams 64K;
-#    server 127.0.0.1:8888;
-#    keepalive 2;
-#}
 #upstream prosody {
 #    zone upstreams 64K;
 #    server 127.0.0.1:5280;
@ -38,22 +33,6 @@ JITSI_NGINX_CONFIG="$(cat <<EOF
 #    v7 v7;
 #    v8 v8;
 #}
-# Matches any URI or Referer with some matches and redacts the whole
-# query string. log_format and map must be at the http context level.
-#map \$request_uri \$loggable_uri {
-#    ~^(?P<path>[^?]*)\?.*(?:jwt|token)=  "\${path}?[params_redacted]";
-#    default \$request_uri;
-#}
-#
-#map \$http_referer \$loggable_referer {
-#    ~^(?P<url>[^?]*)\?.*(?:jwt|token)=  "\${url}?[params_redacted]";
-#    default \$http_referer;
-#}
-#
-#log_format jitsi_log '\$remote_addr - \$remote_user [\$time_local] '
-#    '"\$request_method \$loggable_uri \$server_protocol" '
-#    '\$status \$body_bytes_sent "\$loggable_referer" "\$http_user_agent"';
-
 server {
    listen 80;
    listen [::]:80;
@ -66,8 +45,8 @@ server {
    }
 }
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
    server_name ${DOMAIN};

    include snippets/acme-challenge.conf;
@ -83,24 +62,18 @@ server {

    add_header Strict-Transport-Security "max-age=63072000" always;
    set \$prefix "";
-    # Try the custom page for this domain, fallback to default page
-    set \$custom_index "index-${DOMAIN}.html";
-    # We expect this domain to be properly configured, the file should exist
-    set \$config_js_location "/etc/jitsi/meet/${DOMAIN}-config.js";

    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;

    root /usr/share/jitsi-meet;

-#   access_log /var/log/nginx/access.log jitsi_log;
-
    # ssi on with javascript for multidomain variables in config.js
    ssi on;
    ssi_types application/x-javascript application/javascript;

    # Try the custom page for this domain, fallback to default page
-    index \$custom_index index.html index.htm;
+    index index-${DOMAIN}.html index.html index.htm;
    error_page 404 /static/404.html;

    gzip on;
@ -109,10 +82,9 @@ server {
    gzip_proxied no-cache no-store private expired auth;
    gzip_min_length 512;

-    # include /etc/jitsi/meet/jaas/*.conf;
-
+    # We expect this domain to be properly configured, the file should exist
    location = /config.js {
-        alias \$config_js_location;
+        alias /etc/jitsi/meet/${DOMAIN}-config.js;
    }
    # We expect this domain to be properly configured, the file should exist
    location = /interface_config.js {
@ -138,13 +110,8 @@ server {
        proxy_set_header Host \$http_host;
    }

-    location ~ ^/_api/public/(.*)\$ {
-        autoindex off;
-        alias /etc/jitsi/meet/public/\$1;
-    }
-
    # ensure all static content can always be found first
-    location ~ ^/(libs|css|static|images|fonts|lang|sounds|.well-known)/(.*)\$
+    location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)\$
    {
        add_header 'Access-Control-Allow-Origin' '*';
        alias /usr/share/jitsi-meet/\$1/\$2;
@ -212,30 +179,11 @@ server {
    #    alias /usr/share/jitsi-meet/load-test/libs/\$1;
    #}

-    location = /_unlock {
-        add_header 'Access-Control-Allow-Origin' '*';
-        add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
-        add_header "Cache-Control" "no-cache, no-store";
-    }
-
-    location ~ ^/conference-request/v1([/].*)?\$ {
-        proxy_pass http://jicofo/conference-request/v1\$1;
-        add_header "Cache-Control" "no-cache, no-store";
-        add_header 'Access-Control-Allow-Origin' '*';
-        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
-        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Content-Type';
-    }
-    location ~ ^/([^/?&:'"]+)/conference-request/v1([/].*)?\$ {
-        rewrite ^/([^/?&:'"]+)/conference-request/v1([/].*)?\$ /conference-request/v1\$2;
-    }
-
    location ~ ^/([^/?&:'"]+)\$ {
-        set \$roomname "\$1";
        try_files \$uri @root_path;
    }

    location @root_path {
-        # rewrite ^/(.*)\$ /\$custom_index break;
        rewrite ^/(.*)\$ / break;
    }

@ -244,16 +192,9 @@ server {
        set \$subdomain "\$1.";
        set \$subdir "\$1/";

-        alias \$config_js_location;
+        alias /etc/jitsi/meet/jitsi-meet.example.com-config.js;
    }

-    ## Matches /(TENANT)/pwa-worker.js or /(TENANT)/manifest.json to rewrite to / and look for file
-    #location ~ ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)\$ {
-    #    set \$subdomain "\$1.";
-    #    set \$subdir "\$1/";
-    #    rewrite ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)\$ /\$2;
-    #}
-
    # BOSH for subdomains
    location ~ ^/([^/?&:'"]+)/http-bind {
        set \$subdomain "\$1.";
--- a/type/__jitsi_meet_domain/files/nginx.sh.orig
+++ b/type/__jitsi_meet_domain/files/nginx.sh.orig
@ -10,12 +10,11 @@ upstream prosody {
    server 127.0.0.1:5280;
    keepalive 2;
 }
-# Uncomment to enable colibri (JVB) WebSocket proxy (also requires websockets enabled in JVB config):
-# upstream jvb1 {
-#     zone upstreams 64K;
-#     server 127.0.0.1:9090;
-#     keepalive 2;
-# }
+upstream jvb1 {
+    zone upstreams 64K;
+    server 127.0.0.1:9090;
+    keepalive 2;
+}
 map $arg_vnode $prosody_node {
    default prosody;
    v1 v1;
@ -27,22 +26,6 @@ map $arg_vnode $prosody_node {
    v7 v7;
    v8 v8;
 }
-# Matches any URI or Referer with some matches and redacts the whole
-# query string. log_format and map must be at the http context level.
-map $request_uri $loggable_uri {
-    ~^(?P<path>[^?]*)\?.*(?:jwt|token)=  "${path}?[params_redacted]";
-    default $request_uri;
-}
-
-map $http_referer $loggable_referer {
-    ~^(?P<url>[^?]*)\?.*(?:jwt|token)=  "${url}?[params_redacted]";
-    default $http_referer;
-}
-
-log_format jitsi_log '$remote_addr - $remote_user [$time_local] '
-    '"$request_method $loggable_uri $server_protocol" '
-    '$status $body_bytes_sent "$loggable_referer" "$http_user_agent"';
-
 server {
    listen 80;
    listen [::]:80;
@ -60,8 +43,8 @@ server {
    }
 }
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
    server_name jitsi-meet.example.com;

    # Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration
@ -75,16 +58,12 @@ server {

    add_header Strict-Transport-Security "max-age=63072000" always;
    set $prefix "";
-    set $custom_index "";
-    set $config_js_location /etc/jitsi/meet/jitsi-meet.example.com-config.js;

    ssl_certificate /etc/jitsi/meet/jitsi-meet.example.com.crt;
    ssl_certificate_key /etc/jitsi/meet/jitsi-meet.example.com.key;

    root /usr/share/jitsi-meet;

-    access_log /var/log/nginx/access.log jitsi_log;
-
    # ssi on with javascript for multidomain variables in config.js
    ssi on;
    ssi_types application/x-javascript application/javascript;
@ -98,10 +77,8 @@ server {
    gzip_proxied no-cache no-store private expired auth;
    gzip_min_length 512;

-    include /etc/jitsi/meet/jaas/*.conf;
-
    location = /config.js {
-        alias $config_js_location;
+        alias /etc/jitsi/meet/jitsi-meet.example.com-config.js;
    }

    location = /external_api.js {
@ -115,13 +92,8 @@ server {
        proxy_set_header Host $http_host;
    }

-    location ~ ^/_api/public/(.*)$ {
-        autoindex off;
-        alias /etc/jitsi/meet/public/$1;
-    }
-
    # ensure all static content can always be found first
-    location ~ ^/(libs|css|static|images|fonts|lang|sounds|.well-known)/(.*)$
+    location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)$
    {
        add_header 'Access-Control-Allow-Origin' '*';
        alias /usr/share/jitsi-meet/$1/$2;
@ -151,14 +123,14 @@ server {
        tcp_nodelay on;
    }

-    # Uncomment to enable colibri (JVB) WebSocket proxy (also requires websockets enabled in JVB config):
-    # location ~ ^/colibri-ws/default-id/(.*) {
-    #     proxy_pass http://jvb1/colibri-ws/default-id/$1$is_args$args;
-    #     proxy_http_version 1.1;
-    #     proxy_set_header Upgrade $http_upgrade;
-    #     proxy_set_header Connection "upgrade";
-    #     tcp_nodelay on;
-    # }
+    # colibri (JVB) websockets for jvb1
+    location ~ ^/colibri-ws/default-id/(.*) {
+        proxy_pass http://jvb1/colibri-ws/default-id/$1$is_args$args;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        tcp_nodelay on;
+    }

    # load test minimal client, uncomment when used
    #location ~ ^/_load-test/([^/?&:'"]+)$ {
@ -169,30 +141,12 @@ server {
    #    alias /usr/share/jitsi-meet/load-test/libs/$1;
    #}

-    location = /_unlock {
-        add_header 'Access-Control-Allow-Origin' '*';
-        add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
-        add_header "Cache-Control" "no-cache, no-store";
-    }
-
-    location ~ ^/conference-request/v1(\/.*)?$ {
-        proxy_pass http://127.0.0.1:8888/conference-request/v1$1;
-        add_header "Cache-Control" "no-cache, no-store";
-        add_header 'Access-Control-Allow-Origin' '*';
-        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
-        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Content-Type';
-    }
-    location ~ ^/([^/?&:'"]+)/conference-request/v1(\/.*)?$ {
-        rewrite ^/([^/?&:'"]+)/conference-request/v1(\/.*)?$ /conference-request/v1$2;
-    }
-
    location ~ ^/([^/?&:'"]+)$ {
-        set $roomname "$1";
        try_files $uri @root_path;
    }

    location @root_path {
-        rewrite ^/(.*)$ /$custom_index break;
+        rewrite ^/(.*)$ / break;
    }

    location ~ ^/([^/?&:'"]+)/config.js$
@ -200,14 +154,7 @@ server {
        set $subdomain "$1.";
        set $subdir "$1/";

-        alias $config_js_location;
-    }
-
-    # Matches /(TENANT)/pwa-worker.js or /(TENANT)/manifest.json to rewrite to / and look for file
-    location ~ ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)$ {
-        set $subdomain "$1.";
-        set $subdir "$1/";
-        rewrite ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)$ /$2;
+        alias /etc/jitsi/meet/jitsi-meet.example.com-config.js;
    }

    # BOSH for subdomains
--- a/type/__jitsi_meet_domain/files/prosody.cfg.lua.sh
+++ b/type/__jitsi_meet_domain/files/prosody.cfg.lua.sh
@ -30,10 +30,6 @@ PROSODY_CONFIG="$(cat <<EOFPROSODY
 -- Managed remotely, changes will be lost
 ${PROSODY_MAIN_START}
 -- This will be managed by __jitsi_meet
-
-- We need this for prosody 13.0
-component_admins_as_room_owners = true
-
 plugin_paths = { "/usr/share/jitsi-meet/prosody-plugins/" }

 -- domain mapper options, must at least have domain base set to use the mapper
@ -74,11 +70,6 @@ unlimited_jids = {
    "${FOCUS_USER:?}@auth.${JITSI_HOST:?}",
    "jvb@auth.${JITSI_HOST:?}"
 }
-
-- https://prosody.im/doc/modules/mod_smacks
-smacks_max_unacked_stanzas = 5;
-smacks_hibernation_time = 60;
-smacks_max_old_sessions = 1;
 ${PROSODY_MAIN_END}

 ${PROSODY_DOMAIN_START}
@ -97,17 +88,23 @@ VirtualHost "${JITSI_DOMAIN:?}"
        key = "/etc/prosody/certs/${JITSI_DOMAIN:?}.key";
        certificate = "/etc/prosody/certs/${JITSI_DOMAIN:?}.crt";
    }
+    av_moderation_component = "avmoderation.${JITSI_DOMAIN:?}"
+    speakerstats_component = "speakerstats.${JITSI_DOMAIN:?}"
+    conference_duration_component = "conferenceduration.${JITSI_DOMAIN:?}"
+    end_conference_component = "endconference.${JITSI_DOMAIN:?}"
    -- we need bosh
    modules_enabled = {
        "bosh";
-        "websocket";
-        "smacks";
+        "pubsub";
        "ping"; -- Enable mod_ping
+        "speakerstats";
        "external_services";
-        "features_identity";
        "conference_duration";
+        "end_conference";
        "muc_lobby_rooms";
        "muc_breakout_rooms";
+        "av_moderation";
+        "room_metadata";
 ${PROSODY_WEBSOCKET}        "websocket";
 ${PROSODY_WEBSOCKET}        "smacks";
    }
@ -118,6 +115,7 @@ ${PROSODY_WEBSOCKET}        "smacks";
    c2s_require_encryption = false
    lobby_muc = "lobby.${JITSI_DOMAIN:?}"
    breakout_rooms_muc = "breakout.${JITSI_DOMAIN:?}"
+    room_metadata_component = "metadata.${JITSI_DOMAIN:?}"
    main_muc = "conference.${JITSI_DOMAIN:?}"
    -- muc_lobby_whitelist = { "recorder.${JITSI_DOMAIN:?}" } -- Here we can whitelist jibri to enter lobby enabled rooms

@ -125,18 +123,13 @@ Component "conference.${JITSI_DOMAIN:?}" "muc"
    restrict_room_creation = true
    storage = "memory"
    modules_enabled = {
-        "muc_hide_all";
        "muc_meeting_id";
        "muc_domain_mapper";
        "polls";
        --"token_verification";
        "muc_rate_limit";
-        "muc_password_whitelist";
    }
    admins = { "${FOCUS_USER:?}@auth.${JITSI_HOST:?}" }
-    muc_password_whitelist = {
-        "${FOCUS_USER:?}@auth.${JITSI_HOST:?}"
-    }
    muc_room_locking = false
    muc_room_default_public_jids = true

@ -144,7 +137,6 @@ Component "breakout.${JITSI_DOMAIN:?}" "muc"
    restrict_room_creation = true
    storage = "memory"
    modules_enabled = {
-        "muc_hide_all";
        "muc_meeting_id";
        "muc_domain_mapper";
        "muc_rate_limit";
@ -158,12 +150,13 @@ Component "breakout.${JITSI_DOMAIN:?}" "muc"
 Component "internal.auth.${JITSI_DOMAIN:?}" "muc"
    storage = "memory"
    modules_enabled = {
-        "muc_hide_all";
        "ping";
    }
    admins = { "${FOCUS_USER:?}@auth.${JITSI_HOST:?}", "jvb@auth.${JITSI_HOST:?}" }
    muc_room_locking = false
    muc_room_default_public_jids = true
+    -- https://prosody.im/doc/modules/mod_muc
+    muc_room_cache_size = 1000
 ${PROSODY_DOMAIN_END}
 ${PROSODY_MAIN_START}
 -- This will be managed by __jitsi_meet
@ -176,17 +169,8 @@ VirtualHost "auth.${JITSI_DOMAIN:?}"

    modules_enabled = {
        "limits_exception";
-        "smacks";
    }
    authentication = "internal_hashed"
-    smacks_hibernation_time = 15;
-
-VirtualHost "recorder.${JITSI_DOMAIN:?}"
-    modules_enabled = {
-      "smacks";
-    }
-    authentication = "internal_hashed"
-    smacks_max_old_sessions = 2000;
 ${PROSODY_MAIN_END}
 ${PROSODY_DOMAIN_START}
 -- This will be managed by __jitsi_meet_domain
@ -199,30 +183,28 @@ Component "focus.${JITSI_DOMAIN:?}" "client_proxy"
 Component "speakerstats.${JITSI_DOMAIN:?}" "speakerstats_component"
    muc_component = "conference.${JITSI_DOMAIN:?}"

+Component "conferenceduration.${JITSI_DOMAIN:?}" "conference_duration_component"
+    muc_component = "conference.${JITSI_DOMAIN:?}"
+
 Component "endconference.${JITSI_DOMAIN:?}" "end_conference"
    muc_component = "conference.${JITSI_DOMAIN:?}"

 Component "avmoderation.${JITSI_DOMAIN:?}" "av_moderation_component"
    muc_component = "conference.${JITSI_DOMAIN:?}"

-Component "filesharing.${JITSI_DOMAIN:?}" "filesharing_component"
-    muc_component = "conference.${JITSI_DOMAIN:?}"
-
 Component "lobby.${JITSI_DOMAIN:?}" "muc"
    storage = "memory"
    restrict_room_creation = true
    muc_room_locking = false
    muc_room_default_public_jids = true
    modules_enabled = {
-        "muc_hide_all";
        "muc_rate_limit";
+        "polls";
    }

 Component "metadata.${JITSI_DOMAIN:?}" "room_metadata_component"
    muc_component = "conference.${JITSI_DOMAIN:?}"
    breakout_rooms_component = "breakout.${JITSI_DOMAIN:?}"
-
-Component "polls.${JITSI_DOMAIN:?}" "polls_component"
 ${PROSODY_DOMAIN_END}

 ${PROSODY_SECUREDOMAIN_START}
--- a/type/__jitsi_meet_domain/files/prosody.cfg.lua.sh.orig
+++ b/type/__jitsi_meet_domain/files/prosody.cfg.lua.sh.orig
@ -1,6 +1,3 @@
-- We need this for prosody 13.0
-component_admins_as_room_owners = true
-
 plugin_paths = { "/usr/share/jitsi-meet/prosody-plugins/" }

 -- domain mapper options, must at least have domain base set to use the mapper
@ -15,7 +12,6 @@ external_services = {

 cross_domain_bosh = false;
 consider_bosh_secure = true;
-consider_websocket_secure = true;
 -- https_ports = { }; -- Remove this line to prevent listening on port 5284

 -- by default prosody 0.12 sends cors headers, if you want to disable it uncomment the following (the config is available on 0.12.1)
@ -39,11 +35,6 @@ unlimited_jids = {
    "jvb@auth.jitmeet.example.com"
 }

-- https://prosody.im/doc/modules/mod_smacks
-smacks_max_unacked_stanzas = 5;
-smacks_hibernation_time = 60;
-smacks_max_old_sessions = 1;
-
 VirtualHost "jitmeet.example.com"
    authentication = "jitsi-anonymous" -- do not delete me
    -- Properties below are modified by jitsi-meet-tokens package config
@ -58,21 +49,28 @@ VirtualHost "jitmeet.example.com"
        key = "/etc/prosody/certs/jitmeet.example.com.key";
        certificate = "/etc/prosody/certs/jitmeet.example.com.crt";
    }
+    av_moderation_component = "avmoderation.jitmeet.example.com"
+    speakerstats_component = "speakerstats.jitmeet.example.com"
+    conference_duration_component = "conferenceduration.jitmeet.example.com"
+    end_conference_component = "endconference.jitmeet.example.com"
    -- we need bosh
    modules_enabled = {
        "bosh";
-        "websocket";
-        "smacks";
+        "pubsub";
        "ping"; -- Enable mod_ping
+        "speakerstats";
        "external_services";
-        "features_identity";
        "conference_duration";
+        "end_conference";
        "muc_lobby_rooms";
        "muc_breakout_rooms";
+        "av_moderation";
+        "room_metadata";
    }
    c2s_require_encryption = false
    lobby_muc = "lobby.jitmeet.example.com"
    breakout_rooms_muc = "breakout.jitmeet.example.com"
+    room_metadata_component = "metadata.jitmeet.example.com"
    main_muc = "conference.jitmeet.example.com"
    -- muc_lobby_whitelist = { "recorder.jitmeet.example.com" } -- Here we can whitelist jibri to enter lobby enabled rooms

@ -80,17 +78,13 @@ Component "conference.jitmeet.example.com" "muc"
    restrict_room_creation = true
    storage = "memory"
    modules_enabled = {
-        "muc_hide_all";
        "muc_meeting_id";
        "muc_domain_mapper";
+        "polls";
        --"token_verification";
        "muc_rate_limit";
-        "muc_password_whitelist";
    }
    admins = { "focusUser@auth.jitmeet.example.com" }
-    muc_password_whitelist = {
-        "focusUser@auth.jitmeet.example.com"
-    }
    muc_room_locking = false
    muc_room_default_public_jids = true

@ -98,7 +92,6 @@ Component "breakout.jitmeet.example.com" "muc"
    restrict_room_creation = true
    storage = "memory"
    modules_enabled = {
-        "muc_hide_all";
        "muc_meeting_id";
        "muc_domain_mapper";
        "muc_rate_limit";
@ -112,7 +105,6 @@ Component "breakout.jitmeet.example.com" "muc"
 Component "internal.auth.jitmeet.example.com" "muc"
    storage = "memory"
    modules_enabled = {
-        "muc_hide_all";
        "ping";
    }
    admins = { "focusUser@auth.jitmeet.example.com", "jvb@auth.jitmeet.example.com" }
@ -122,17 +114,8 @@ Component "internal.auth.jitmeet.example.com" "muc"
 VirtualHost "auth.jitmeet.example.com"
    modules_enabled = {
        "limits_exception";
-        "smacks";
    }
    authentication = "internal_hashed"
-    smacks_hibernation_time = 15;
-
-VirtualHost "recorder.jitmeet.example.com"
-    modules_enabled = {
-      "smacks";
-    }
-    authentication = "internal_hashed"
-    smacks_max_old_sessions = 2000;

 -- Proxy to jicofo's user JID, so that it doesn't have to register as a component.
 Component "focus.jitmeet.example.com" "client_proxy"
@ -141,27 +124,25 @@ Component "focus.jitmeet.example.com" "client_proxy"
 Component "speakerstats.jitmeet.example.com" "speakerstats_component"
    muc_component = "conference.jitmeet.example.com"

+Component "conferenceduration.jitmeet.example.com" "conference_duration_component"
+    muc_component = "conference.jitmeet.example.com"
+
 Component "endconference.jitmeet.example.com" "end_conference"
    muc_component = "conference.jitmeet.example.com"

 Component "avmoderation.jitmeet.example.com" "av_moderation_component"
    muc_component = "conference.jitmeet.example.com"

-Component "filesharing.jitmeet.example.com" "filesharing_component"
-    muc_component = "conference.jitmeet.example.com"
-
 Component "lobby.jitmeet.example.com" "muc"
    storage = "memory"
    restrict_room_creation = true
    muc_room_locking = false
    muc_room_default_public_jids = true
    modules_enabled = {
-        "muc_hide_all";
        "muc_rate_limit";
+        "polls";
    }

 Component "metadata.jitmeet.example.com" "room_metadata_component"
    muc_component = "conference.jitmeet.example.com"
    breakout_rooms_component = "breakout.jitmeet.example.com"
-
-Component "polls.jitmeet.example.com" "polls_component"
--- a/type/__opendkim/files/opendkim.conf.sh
+++ b/type/__opendkim/files/opendkim.conf.sh
@ -63,3 +63,11 @@ if [ "$USERID" ];
 then
 	printf "UserID %s\n" "$USERID"
 fi
+
+if [ "$PIDFILE" ];
+then
+	printf "PidFile %s\n" "$PIDFILE"
+fi
+
+# Custom user configuration, if any (passed via --custom-config):
+$CUSTOM_CONFIG
--- a/type/__opendkim/man.rst
+++ b/type/__opendkim/man.rst
@ -14,8 +14,8 @@ installation and basic configuration of an instance of OpenDKIM.
 Note that this type does not generate or ensure that a key is present: use
 `cdist-type__opendkim-genkey(7)` for that.

-Note that this type is currently only implemented for Alpine Linux and FreeBSD.
-Please contribute an implementation if you can.
+Note that this type is currently only implemented for Alpine Linux, Debian and
+FreeBSD. Please contribute an implementation if you can.


 REQUIRED PARAMETERS
@ -45,7 +45,6 @@ custom-config
  The string following this parameter is appended as-is in the configuration, to
  enable more complex configurations.

-
 BOOLEAN PARAMETERS
 ------------------
 syslog
--- a/type/__opendkim/manifest
+++ b/type/__opendkim/manifest
@ -21,15 +21,21 @@
 os=$(cat "${__global:?}/explorer/os")

 CFG_DIR="/etc/opendkim"
+CFG_FILE="$CFG_DIR/opendkim.conf"
 service="opendkim"
 case "$os" in
 'alpine')
 	:
 	;;
+'debian')
+	CFG_DIR="/etc/dkimkeys"
+	CFG_FILE="/etc/opendkim.conf"
+	;;
 'freebsd')
 	CFG_DIR="/usr/local/etc/mail"
+	CFG_FILE="$CFG_DIR/opendkim.conf"
+
 	service="milter-opendkim"
-	start_service="milteropendkim"
 	;;
 *)
 	printf "__opendkim does not yet support %s.\n" "$os" >&2
@ -71,31 +77,49 @@ if [ -f "${__object:?}/parameter/userid" ]; then
 	export USERID
 fi

+# Custom configuration handling.
+if [ -f "${__object:?}/parameter/custom-config" ]; then
+	CUSTOM_CONFIG="$(cat "${__object:?}/parameter/custom-config")"
+	export CUSTOM_CONFIG
+fi
+
+# Debian: set configuration specific to debian packaging if no explicit value
+# is requested.
+if [ "$os" = "debian" ]; then
+	# In Debian, opendkim runs as user "opendkim". A umask of 007 is required when
+	# using a local socket with MTAs that access the socket as a non-privileged
+	# user (for example, Postfix). You may need to add user "postfix" to group
+	# "opendkim" in that case.
+
+	# We only set UserID if it is not provided via custom configuration.
+	if [ -z "$USERID" ] && echo "$CUSTOM_CONFIG" | grep -Eq '^UserID\s+\w+$'; then
+		export USERID="opendkim"
+	fi
+
+	if [ -z "$UMASK" ] && echo "$CUSTOM_CONFIG" | grep -Eq '^UMask\s+\w+$'; then
+		export UMASK="007"
+	fi
+
+	if ! echo "$CUSTOM_CONFIG" | grep -Eq '^PidFile\s+\w+$'; then
+		export PIDFILE="/run/opendkim/opendkim.pid"
+	fi
+fi
+
 # Boolean parameters
 [ -f "${__object:?}/parameter/syslog" ] && export SYSLOG=yes

 # Generate and deploy configuration file.
 source_file="${__object:?}/files/opendkim.conf"
-target_file="${CFG_DIR}/opendkim.conf"
+target_file="${CFG_FILE}"

 mkdir -p "${__object:?}/files"

 "${__type:?}/files/opendkim.conf.sh" >"$source_file"

-# Add user custom config
-if [ -f "${__object:?}/parameter/custom-config" ]; then
-	echo "# Custom user config" >>"$source_file"
-	cat "${__object:?}/parameter/custom-config" >>"$source_file"
-fi
-
 require="__package/opendkim" __file "$target_file" \
 	--source "$source_file" --mode 0644

-# Due to the way rc.conf works on *BSD, we find ourselves in the awkward
-# situation, where a service's name can contain a '-' symbol, but the
-# rc.conf setting to enable a service at boot cannot.
-# Unless start_service has been defined before, these two match.
-require="__package/opendkim" __start_on_boot "${start_service:-${service}}"
+require="__package/opendkim" __start_on_boot "${service}"

 # Ensure Key and Signing tables exist and have proper permissions
 key_table="${CFG_DIR}/KeyTable"
@ -110,7 +134,7 @@ require="__package/opendkim" \
 	--mode 444

 require="__file${target_file} __file${key_table}
-		__file${signing_table} __start_on_boot/${start_service:-${service}}" \
+		__file${signing_table} __start_on_boot/${service}" \
 	__check_messages opendkim \
 		--pattern "^__file${target_file}" \
 		--execute "service ${service} restart"
--- a/type/__opendkim_genkey/explorer/key-state
+++ b/type/__opendkim_genkey/explorer/key-state
@ -1,12 +1,22 @@
 #!/bin/sh -e
-DIRECTORY="/var/db/dkim/"
+
+os=$( "${__explorer:?}/os" )
+
+case "$os" in
+'debian')
+	DIRECTORY="/etc/dkimkeys/"
+;;
+*)
+	DIRECTORY="/var/db/dkim/"
+;;
+esac
+
 if [ -f "${__object:?}/parameter/directory" ];
 then
 	# Be forgiving about a lack of trailing slash
 	DIRECTORY="$(sed -E 's!([^/])$!\1/!' < "${__object:?}/parameter/directory")"
 fi

-
 KEY_ID="$(echo "${__object_id:?)}" | tr '/' '_')"
 DEFAULT_PATH="${DIRECTORY:?}${KEY_ID:?}.private"
 if [ -s "${DEFAULT_PATH}" ]; then
--- a/type/__opendkim_genkey/man.rst
+++ b/type/__opendkim_genkey/man.rst
@ -22,7 +22,7 @@ associating any given `sigkey` values to this key.
 Take into account that if you use this type without the `--domain` and
 `--selector` parameters, the `$__object_id` must be in form `$domain/$selector`.

-Currently, this type is only implemented for Alpine Linux and FreeBSD.
+Currently, this type is only implemented for Alpine Linux, Debian and FreeBSD.
 Please contribute an implementation if you can.

 NOTE: the name of the key file under `--directory` will default to
--- a/type/__opendkim_genkey/manifest
+++ b/type/__opendkim_genkey/manifest
@ -21,12 +21,20 @@

 os=$(cat "${__global:?}/explorer/os")

-CFG_DIR="/etc/opendkim"
-user="opendkim"
-group="opendkim"
 case "$os" in
 'alpine')
-	:
+	CFG_DIR="/etc/opendkim"
+	user="opendkim"
+	group="opendkim"
+
+	__package opendkim-utils
+;;
+'debian')
+	CFG_DIR="/etc/dkimkeys"
+	user="opendkim"
+	group="opendkim"
+
+	__package opendkim-tools
 ;;
 'freebsd')
 	CFG_DIR="/usr/local/etc/mail"
@ -35,8 +43,8 @@ case "$os" in
 ;;
 *)
 	cat <<- EOF >&2
-	__opendkim_genkey currently only supports Alpine Linux and FreeBSD.
-	Please contribute an implementation for $os if you can.
+	__opendkim_genkey does not support $os (yet).
+	Please contribute an implementation if you can.
 	EOF
 	exit 1
 ;;
@ -78,13 +86,6 @@ printf '%s' "${group:?}" > "${__object:?}/group"
 printf '%s' "${DOMAIN:?}" > "${__object:?}/domain"
 printf '%s' "${SELECTOR:?}" > "${__object:?}/selector"

-DIRECTORY="/var/db/dkim/"
-if [ -f "${__object:?}/parameter/directory" ];
-then
-	# Be forgiving about a lack of trailing slash
-	DIRECTORY="$(sed -E 's!([^/])$!\1/!' < "${__object:?}/parameter/directory")"
-fi
-
 SIGKEY="${DOMAIN:?}"
 if [ -f "${__object:?}/parameter/sigkey" ];
 then
@ -96,24 +97,18 @@ then
 	SIGDOMAIN="$(cat "${__object:?}/parameter/sigdomain")"
 fi

-# Ensure the key-container directory exists with the proper permissions
-__directory "${DIRECTORY}" \
-	--mode 0750 \
-	--owner "${user}" --group "${group}"
-
-# OS-specific code
-case "$os" in
-'alpine')
-	# This is needed for opendkim-genkey
-	__package opendkim-utils
-;;
-esac
+KEY_STATE="$(cut -f 1 "${__object:?}/explorer/key-state")"
+KEY_LOCATION="$(cut -f 2- "${__object:?}/explorer/key-state")"

+keys_dir=$(dirname "${KEY_LOCATION:?}")
 key_table="${CFG_DIR}/KeyTable"
 signing_table="${CFG_DIR}/SigningTable"

-KEY_STATE="$(cut -f 1 "${__object:?}/explorer/key-state")"
-KEY_LOCATION="$(cut -f 2- "${__object:?}/explorer/key-state")"
+# Ensure the key-container directory exists with the proper permissions
+__directory "${keys_dir}" \
+	--mode 0750 \
+	--owner "${user}" \
+	--group "${group}"

 __line "__opendkim_genkey/${__object_id:?}" \
 	--file "${key_table}" \
--- a/type/__single_binary_service/man.rst
+++ b/type/__single_binary_service/man.rst
@ -27,6 +27,22 @@ This type supports services managed by `__runit(7)` when `systemd` is not
 the init system being used.


+REQUIRED PARAMETERS
+-------------------
+checksum
+    This will be passed verbatim to `__download(7)`.
+    Use something like `sha256:...`.
+
+url
+    This will be passed verbatim to `__download(7)`.
+
+version
+    This type will use a thumbstone file with a "version" number to track
+    whether or not a service must be updated.
+    This thumbstone file is placed under
+    `/usr/local/bin/.${__object_id}.cdist.version`.
+
+
 BOOLEAN PARAMETERS
 ------------------
 unpack
@ -43,36 +59,12 @@ do-not-manage-user

 OPTIONAL PARAMETERS
 -------------------
-version
-    Required when installing a service.
-    This type will use a thumbstone file with a "version" number to track
-    whether or not a service must be updated.
-    This thumbstone file is placed under
-    `/usr/local/bin/.${__object_id}.cdist.version`.
-
-checksum
-    This will be passed verbatim to `__download(7)`.
-    Use something like `sha256:...`.
-    Required if using `--url`.
-
-config-file-destination
-    The remote path in which to locate the service's configuration.
-    Defaults to `ETC_DIR/${__object_id}.conf`.
-
 config-file-source
    If present, this file's contents will be placed under
    `/etc/${__object_id}.conf` with permissions `0440` and ownership assigned to
    `--user` and `--group`.
    If `-` is passed, this type's `stdin` will be used.

-local-source
-    A file on the cdist controller that will be used instead of downloading
-    the binary.
-
-url
-    This will be passed verbatim to `__download(7)`.
-    When used, you must specify `--checksum` as well.
-
 user
    The user under which the service will run. Defaults to `root`.
    If this user is not `root` and `--do-not-manage-user` is not present,
@ -138,10 +130,6 @@ unpack-extension
 working-directory
    If set, the working directory with which the service will be started.

-working-directory-permissions
-    The permissions that will be set for the working directory.
-    Defaults to `0750`.
-

 OPTIONAL MULTIPLE PARAMETERS
 ----------------------------
--- a/type/__single_binary_service/manifest
+++ b/type/__single_binary_service/manifest
@ -1,4 +1,4 @@
-#!/bin/sh -eu
+#!/bin/sh -e
 SERVICE_NAME="${__object_id}"

 OS="$(cat "${__global}/explorer/os")"
@ -32,7 +32,7 @@ case "${INIT}" in
 		service_command="sv %s ${SERVICE_NAME}"
 	;;
 	*)
-		echo "Init system '${INIT}' is currently not supported." >&2
+		echo "Init system ${INIT}' is currently not supported." >&2
 		exit 1
 	;;
 esac
@ -44,7 +44,7 @@ BIN_DIR="/usr/local/bin"
 __directory "${BIN_DIR}" \
 	--state "exists" \
 	--mode 0755
-export require="${require:-} __directory${BIN_DIR}"
+export require="${require} __directory${BIN_DIR}"

 STATE="$(cat "${__object}/parameter/state")"
 USER="$(cat "${__object}/parameter/user")"
@ -86,36 +86,18 @@ fi

 SERVICE_DEFINITION="$(cat "${__object}/parameter/service-definition" 2>/dev/null || true)"

-CHECKSUM="$(cat "${__object}/parameter/checksum")"
-SHOULD_VERSION="$(cat "${__object}/parameter/version" 2>/dev/null || true)"
+WORKING_DIRECTORY_PATH="$(cat "${__object}/parameter/working-directory" 2>/dev/null || true)"
+if [ -n "${WORKING_DIRECTORY_PATH}" ]; then
+	WORKING_DIRECTORY_SYSTEMD="WorkingDirectory=${WORKING_DIRECTORY_PATH}"
+	WORKING_DIRECTORY_RUNIT="cd '${WORKING_DIRECTORY_PATH}'"
+fi
+
 DOWNLOAD_URL="$(cat "${__object}/parameter/url")"
-LOCAL_SOURCE="$(cat "${__object}/parameter/local-source")"
-if [ "${STATE}" = "present" ] && [ -z "${SHOULD_VERSION}" ]; then
-	cat >&1 <<-EOM
-	When installing a service, --version must be specified.
-	EOM
-	exit 1
-fi
-if [ "${STATE}" = "present" ] && [ -z "${DOWNLOAD_URL}${LOCAL_SOURCE}" ]; then
-	cat >&1 <<-EOM
-	Exactly one of --url or --local-source must be specified.
-	EOM
-	exit 1
-fi
-if [ -n "${DOWNLOAD_URL}" ] && [ -z "${CHECKSUM}" ]; then
-	cat >&1 <<-EOM
-	You must specify --checksum when using --url.
-	EOM
-	exit 1
-fi
-if [ "${LOCAL_SOURCE}" = "-" ]; then
-	LOCAL_SOURCE="${__object}/stdin"
-fi
+CHECKSUM="$(cat "${__object}/parameter/checksum")"
+SHOULD_VERSION="$(cat "${__object}/parameter/version")"

 # Create a user for the service if it is not root
 USER_HOME_DIR="/root"
-require_user_created=""
-service_require=""
 if [ "${USER}" != "root" ] && \
 		[ ! -f "${__object}/parameter/do-not-manage-user" ]; then
 	if [ "${STATE}" = "absent" ]; then
@ -126,45 +108,24 @@ if [ "${USER}" != "root" ] && \
 	if [ "${USER_HOME_DIR}" != "/nonexistent" ]; then
 		USER_CREATE_HOME="--create-home"
 	fi
-	require="${require} ${user_require:-}" __user "${USER}" \
+	require="${require} ${user_require}" __user "${USER}" \
 		--system \
 		--state "${STATE}" \
 		--home "${USER_HOME_DIR}" \
 		--comment "cdist-managed service user" \
 		${USER_CREATE_HOME}
-	require_user_created="__user/${USER}"
 	# Track dependencies
-	service_require="${service_require} ${require_user_created}"
-fi
-
-# Adapt directory permissions when necessary
-WORKING_DIRECTORY_PERMISSIONS="$(cat "${__object}/parameter/working-directory-permissions")"
-WORKING_DIRECTORY_PATH="$(cat "${__object}/parameter/working-directory" 2>/dev/null || true)"
-if [ -n "${WORKING_DIRECTORY_PATH}" ]; then
-	WORKING_DIRECTORY_SYSTEMD="WorkingDirectory=${WORKING_DIRECTORY_PATH}"
-	WORKING_DIRECTORY_RUNIT="cd '${WORKING_DIRECTORY_PATH}'"
-	require="${require_user_created}" __directory \
-		"${WORKING_DIRECTORY_PATH}" --state present \
-		--mode "${WORKING_DIRECTORY_PERMISSIONS}" \
-		--owner "${USER}" --group "${GROUP}"
+	service_require="${service_require} __user/${USER}"
 fi

 # Place config file if necessary
-CONFIG_FILE_DEST="$(cat "${__object}/parameter/config-file-destination" 2>/dev/null || true)"
-if [ -z "${CONFIG_FILE_DEST}" ]; then
-	CONFIG_FILE_DEST="${ETC_DIR}/${SERVICE_NAME}.conf"
-else
-	require="${require_user_created}" __directory \
-		"$(dirname "${WORKING_DIRECTORY_PATH}")" --state present \
-		--mode "${WORKING_DIRECTORY_PERMISSIONS}" \
-		--owner "${USER}" --group "${GROUP}"
-fi
+CONFIG_FILE_DEST="${ETC_DIR}/${SERVICE_NAME}.conf"
 CONFIG_FILE_SOURCE="$(cat "${__object}/parameter/config-file-source" 2>/dev/null || true)"
 if [ "${CONFIG_FILE_SOURCE}" = "-" ]; then
 	CONFIG_FILE_SOURCE="${__object}/stdin"
 fi
 if [ -n "${CONFIG_FILE_SOURCE}" ] && [ "${STATE}" = "present" ]; then
-	require="${require} ${require_user_created}" __file \
+	require="${require} __user/${USER}" __file \
 		"${CONFIG_FILE_DEST}" \
 		--owner "${USER}" \
 		--group "${GROUP}" \
@ -203,7 +164,7 @@ Group=${GROUP}
 ExecStart=${SERVICE_EXEC}
 Restart=always
 EnvironmentFile=${SYSTEMD_ENV_FILE}
-${WORKING_DIRECTORY_SYSTEMD:-}
+${WORKING_DIRECTORY_SYSTEMD}

 [Install]
 WantedBy=multi-user.target
@ -300,23 +261,15 @@ EOF
 		UNPACK_EXTENSION="$(cat "${__object}/parameter/unpack-extension")"
 		UNPACK_ARGS="$(cat "${__object}/parameter/unpack-args" \
 			2>/dev/null || true)"
-		# Place packed file
-		if [ -n "${DOWNLOAD_URL}" ]; then
-			__download "${TMP_PATH}${UNPACK_EXTENSION}" \
-				--url "${DOWNLOAD_URL}" \
-				--download remote \
-				--sum "${CHECKSUM}"
-			require_place_file="__download${TMP_PATH}${UNPACK_EXTENSION}"
-		else
-			# TODO: this doesn't use CHECKSUM
-			__file "${TMP_PATH}${UNPACK_EXTENSION}" \
-				--source "${LOCAL_SOURCE}"
-			require_place_file="__file${TMP_PATH}${UNPACK_EXTENSION}"
-		fi
+		# Download packed file
+		__download "${TMP_PATH}${UNPACK_EXTENSION}" \
+			--url "${DOWNLOAD_URL}" \
+			--download remote \
+			--sum "${CHECKSUM}"

 		# Unpack file and also perform service upgrade
 		# shellcheck disable=SC2086
-		require="${require_place_file}" \
+		require="__download${TMP_PATH}${UNPACK_EXTENSION}" \
 			__unpack "${TMP_PATH}${UNPACK_EXTENSION}" \
 			${UNPACK_ARGS} \
 			--destination "${TMP_PATH}"
@ -324,20 +277,14 @@ EOF
 	else
 		# Create temp directory
 		__directory "${TMP_PATH}"
-		# Place in temp directory with the specified binary name
-		if [ -n "${DOWNLOAD_URL}" ]; then
-			require="__directory${TMP_PATH}" __download \
-				"${TMP_PATH}/${BINARY}" \
-				--url "${DOWNLOAD_URL}" \
-				--download remote \
-				--sum "${CHECKSUM}"
-			version_bump_require="__download${TMP_PATH}/${BINARY}"
-		else
-			require="__directory${TMP_PATH}" __file \
-				"${TMP_PATH}/${BINARY}" \
-				--source "${LOCAL_SOURCE}"
-			version_bump_require="__file${TMP_PATH}/${BINARY}"
-		fi
+		# Download binary directoy to the temp directory with the
+		# specified binary name
+		require="__directory${TMP_PATH}" __download \
+			"${TMP_PATH}/${BINARY}" \
+			--url "${DOWNLOAD_URL}" \
+			--download remote \
+			--sum "${CHECKSUM}"
+		version_bump_require="__download${TMP_PATH}/${BINARY}"
 	fi

 	# Perform update of cdist-managed version file
--- a/type/__single_binary_service/parameter/default/checksum
+++ b/type/__single_binary_service/parameter/default/checksum
--- a/type/__single_binary_service/parameter/default/local-source
+++ b/type/__single_binary_service/parameter/default/local-source
--- a/type/__single_binary_service/parameter/default/url
+++ b/type/__single_binary_service/parameter/default/url
--- a/type/__single_binary_service/parameter/default/working-directory-permissions
+++ b/type/__single_binary_service/parameter/default/working-directory-permissions
@ -1 +0,0 @@
-0750
--- a/type/__single_binary_service/parameter/optional
+++ b/type/__single_binary_service/parameter/optional
@ -1,20 +1,14 @@
-checksum
 config-file-source
-config-file-destination
 env
 user
 group
 state
 binary
-local-source
 service-args
 service-exec
 service-description
 service-definition
 unpack-extension
 unpack-args
-url
 user-home-dir
-version
 working-directory
-working-directory-permissions
--- a/type/__single_binary_service/parameter/required
+++ b/type/__single_binary_service/parameter/required
@ -0,0 +1,3 @@
+url
+checksum
+version
Author	SHA1	Message	Date
Timothée Floure	d8afc76fdf	[__opendkim*] address cdist-contrib #32 review	2024-05-29 15:50:26 +02:00
Timothée Floure	40d7b4354e	[__opendkim_genkey] add debian support	2024-05-21 16:32:29 +02:00
Timothée Floure	d97fb9a434	[__opendkim] add debian support	2024-05-21 16:32:29 +02:00