Merge branch 'zobel-salsa'

diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index eae4051..e78f982 100644 (file)
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -134,7 +134,7 @@ roles:
       fastly-backend: false
     lobos.debian.org:
       service-hostname: lobos.security.backend.mirrors.debian.org
-      fastly-backend: true
+      fastly-backend: false
       onion_v4_address: 212.211.132.250
     santoro.debian.org:
       fastly-backend: false

diff --git a/manifests/site.pp b/manifests/site.pp
index 8162575..b0bd0f9 100644 (file)
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -62,8 +62,6 @@ node default {
        if $::kernel == 'Linux' {
                include linux
                include acpi
-       } elsif $::kernel == 'GNU/kFreeBSD' {
-               include kfreebsd
        }
 
        if $::mta == 'exim4' {

diff --git a/modules/acpi/manifests/init.pp b/modules/acpi/manifests/init.pp
index 2a4fc15..a3902ef 100644 (file)
--- a/modules/acpi/manifests/init.pp
+++ b/modules/acpi/manifests/init.pp
@@ -1,26 +1,24 @@
 class acpi {
-       if ! ($::debarchitecture in ['kfreebsd-amd64', 'kfreebsd-i386']) {
-               if (versioncmp($::lsbmajdistrelease, '8') >= 0) {
-                       package { 'acpid':
-                               ensure => purged
-                       }
+       if (versioncmp($::lsbmajdistrelease, '8') >= 0) {
+               package { 'acpid':
+                       ensure => purged
+               }
 
-                       package { 'acpi-support-base':
-                               ensure => purged
-                       }
-               } elsif ($::kvmdomain) {
-                       package { 'acpid':
-                               ensure => installed
-                       }
+               package { 'acpi-support-base':
+                       ensure => purged
+               }
+       } elsif ($::kvmdomain) {
+               package { 'acpid':
+                       ensure => installed
+               }
 
-                       service { 'acpid':
-                               ensure  => running,
-                               require => Package['acpid'],
-                       }
+               service { 'acpid':
+                       ensure  => running,
+                       require => Package['acpid'],
+               }
 
-                       package { 'acpi-support-base':
-                               ensure => installed
-                       }
+               package { 'acpi-support-base':
+                       ensure => installed
                }
        }
 }

diff --git a/modules/bacula/templates/default.bacula-fd.erb b/modules/bacula/templates/default.bacula-fd.erb
index 96b2455..3d9206f 100644 (file)
--- a/modules/bacula/templates/default.bacula-fd.erb
+++ b/modules/bacula/templates/default.bacula-fd.erb
@@ -9,12 +9,7 @@
 ENABLED="yes"
 
 # Additional start arguments can be provided here
-# ARGS=""
-<% if scope.lookupvar('site::nodeinfo')['ldap'].has_key?('architecture') and scope.lookupvar('site::nodeinfo')['ldap']['architecture'][0].start_with?('kfreebsd') -%>
-ARGS=""
-<% else -%>
 ARGS="-u bacula -k"
-<% end -%>
 
 # Default config file can be changed here
 # CONFIG="/etc/bacula/bacula-fd.conf"

diff --git a/modules/buildd/files/buildd.conf b/modules/buildd/files/buildd.conf
index 7bd4965..efac652 100644 (file)
--- a/modules/buildd/files/buildd.conf
+++ b/modules/buildd/files/buildd.conf
@@ -17,6 +17,6 @@ $upload_queues = [
         },
         {
                 dupload_local_queue_dir => "upload-security",
-                dupload_archive_name => "security",
+                dupload_archive_name => "rsync-security",
         }
 ];

diff --git a/modules/buildd/files/dupload.conf b/modules/buildd/files/dupload.conf
index cf6ab39..5813538 100644 (file)
--- a/modules/buildd/files/dupload.conf
+++ b/modules/buildd/files/dupload.conf
@@ -68,7 +68,7 @@ $cfg{'security'} = $cfg{'anonymous-security'};
 $cfg{'rsync-security'} = {
         method => "rsync",
         login => "buildd-uploader",
-        fqdn => "ssh.upload.security.debian.org",
+        fqdn => "ssh.security.upload.debian.org",
         incoming => "/srv/security.upload.debian.org/SecurityUploadQueue/",
         # files pass on to dinstall on ftp-master which sends emails itself
         dinstall_runs => 1,

diff --git a/modules/debian_org/files/misc/local.yaml b/modules/debian_org/files/misc/local.yaml
index 9916aaf..1a579b5 100644 (file)
--- a/modules/debian_org/files/misc/local.yaml
+++ b/modules/debian_org/files/misc/local.yaml
@@ -89,7 +89,6 @@ nameinfo:
   soriano.debian.org: Francesco Soriano (1548 or 1549 - July 19th, 1621)
   storace.debian.org: Stephen Storace (April 4th, 1762 - March 19th, 1796)
   suchon.debian.org: Eugen Suchoň (September 25, 1908 - August 5, 1993)
-  spontini.debian.org: Gaspare Luigi Pacifico Spontini (November 14th, 1774 - January 24th, 1851)
   tate.debian.org: Phyllis Tate (April 6th, 1911 - May 29th, 1987)
   tchaikovsky.debian.org: Pyotr Ilyich Tchaikovsky (Пётр Ильич Чайковский) (May 7th, 1840 - November 6th, 1893)
   ticharich.debian.org: Zdenka Ticharich (September 26th, 1900 - February 15th, 1979)
@@ -177,7 +176,6 @@ host_settings:
     - powerpc-unicamp-01.debian.org
     - ppc64el-osuosl-01.debian.org
     - ppc64el-unicamp-01.debian.org
-    - spontini.debian.org
     - x86-grnet-01.debian.org
     - zandonai.debian.org
     - zani.debian.org

diff --git a/modules/debian_org/manifests/apt.pp b/modules/debian_org/manifests/apt.pp
index 3fc0979..4fcb87b 100644 (file)
--- a/modules/debian_org/manifests/apt.pp
+++ b/modules/debian_org/manifests/apt.pp
@@ -3,14 +3,6 @@
 # Stuff common to all debian.org servers
 #
 class debian_org::apt {
-       if versioncmp($::lsbmajdistrelease, '7') <= 0 {
-               $mungedcodename = $::lsbdistcodename
-       } elsif ($::debarchitecture in ['kfreebsd-amd64', 'kfreebsd-i386']) {
-               $mungedcodename = "${::lsbdistcodename}-kfreebsd"
-       } else {
-               $mungedcodename = $::lsbdistcodename
-       }
-
        if versioncmp($::lsbmajdistrelease, '8') <= 0 {
                $fallbackmirror = 'http://cdn-fastly.deb.debian.org/debian/'
        } else {
@@ -18,14 +10,14 @@ class debian_org::apt {
        }
 
        if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
-               $mirror = [ getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'), $fallbackmirror, 'http://debian.anycast-test.mirrors.debian.org/debian/' ]
+               $mirror = [ getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'), $fallbackmirror ]
        } else {
-               $mirror = [ $fallbackmirror, 'http://debian.anycast-test.mirrors.debian.org/debian/' ]
+               $mirror = [ $fallbackmirror ]
        }
 
        site::aptrepo { 'debian':
                url        => $mirror,
-               suite      => [ $mungedcodename, "${::lsbdistcodename}-backports", "${::lsbdistcodename}-updates" ],
+               suite      => [ $::lsbdistcodename, "${::lsbdistcodename}-backports", "${::lsbdistcodename}-updates" ],
                components => ['main','contrib','non-free']
        }
 
@@ -35,8 +27,8 @@ class debian_org::apt {
                }
        } else {
                site::aptrepo { 'security':
-                       url        => [ 'http://security-cdn.debian.org/', 'http://security.anycast-test.mirrors.debian.org/debian-security/', 'http://security.debian.org/' ],
-                       suite      => "${mungedcodename}/updates",
+                       url        => [ 'http://security-cdn.debian.org/', 'http://security.debian.org/' ],
+                       suite      => "${::lsbdistcodename}/updates",
                        components => ['main','contrib','non-free']
                }
        }
@@ -49,10 +41,10 @@ class debian_org::apt {
                key        => 'puppet:///modules/debian_org/db.debian.org.gpg',
        }
 
-       if ($::hostname in [] or $::debarchitecture in ['kfreebsd-amd64', 'kfreebsd-i386']) {
+       if ($::hostname in []) {
                site::aptrepo { 'proposed-updates':
                        url        => $mirror,
-                       suite      => "${mungedcodename}-proposed-updates",
+                       suite      => "${::lsbdistcodename}-proposed-updates",
                        components => ['main','contrib','non-free']
                }
        } else {

diff --git a/modules/debian_org/templates/rc.local.erb b/modules/debian_org/templates/rc.local.erb
index 5667c32..6b644b1 100755 (executable)
--- a/modules/debian_org/templates/rc.local.erb
+++ b/modules/debian_org/templates/rc.local.erb
@@ -12,13 +12,6 @@
     mkswap /dev/dasdc1 && swapon -p 30 /dev/dasdc1
   fi
 <%- end -%>
-<% if scope.lookupvar('site::nodeinfo')['ldap'].has_key?('architecture') and scope.lookupvar('site::nodeinfo')['ldap']['architecture'][0].start_with?('kfreebsd') -%>
-  ( sleep 120;
-    service syslog-ng restart;
-    sleep 5;
-    init q
-  ) & disown
-<%- end -%>
 
 if [ -e /proc/sys/kernel/modules_disabled ]; then
        ( sleep 60;

diff --git a/modules/kfreebsd/manifests/init.pp b/modules/kfreebsd/manifests/init.pp
deleted file mode 100644 (file)
index 66a6ee9..0000000
--- a/modules/kfreebsd/manifests/init.pp
+++ /dev/null
@@ -1,34 +0,0 @@
-class kfreebsd {
-
-       file { '/etc/cron.d/dsa-killruby':
-               source => 'puppet:///modules/kfreebsd/dsa-killruby',
-       }
-
-       file { '/etc/sysctl.d/':
-               ensure => directory,
-               mode   => '0755'
-       }
-
-       file { '/etc/init.d/procps':
-               source => 'puppet:///modules/kfreebsd/procps.init',
-               mode   => '0555',
-               before => Service['procps'],
-               notify  => Exec['update-rc.d procps defaults']
-       }
-
-       site::sysctl { 'maxfiles':
-               key    => 'kern.maxfiles',
-               value  => 65536,
-               target => 'GNU/kFreeBSD',
-       }
-       site::sysctl { 'accept_ra':
-               key    => 'net.inet6.ip6.accept_rtadv',
-               value  => 0,
-               target => 'GNU/kFreeBSD',
-       }
-
-       exec { 'update-rc.d procps defaults':
-               path        => '/usr/bin:/usr/sbin:/bin:/sbin',
-               refreshonly => true,
-       }
-}

diff --git a/modules/munin/templates/munin-node.plugin.conf.erb b/modules/munin/templates/munin-node.plugin.conf.erb
index 872ac55..07923e2 100644 (file)
--- a/modules/munin/templates/munin-node.plugin.conf.erb
+++ b/modules/munin/templates/munin-node.plugin.conf.erb
@@ -104,9 +104,3 @@ env.exclude sbuild,schroot
 # filter out all the short-lived filesystems for df*:
 [df*]
 env.exclude_re ^/dev$ ^/run/.*$ ^/srv/piuparts-workspace/tmp.*$ ^/sys/.*$ ^/var/lib/schroot/mount/.*$
-
-<% if scope.lookupvar('site::nodeinfo')['ldap'].has_key?('architecture') and scope.lookupvar('site::nodeinfo')['ldap']['architecture'][0].start_with?('kfreebsd') -%>
-# Workaround for https://bugs.debian.org/767102
-[df*]
-env.exclude devfs fdescfs linprocfs sysfs noprocfs linsysfs nfs nullfs
-<% end %>

diff --git a/modules/roles/files/planet_master/planet-master.debian.org b/modules/roles/files/planet_master/planet-master.debian.org
deleted file mode 100644 (file)
index a58f07c..0000000
--- a/modules/roles/files/planet_master/planet-master.debian.org
+++ /dev/null
@@ -1,20 +0,0 @@
-Use common-debian-service-https-redirect * planet-master.debian.org
-<VirtualHost *:443>
-       ServerName planet-master.debian.org
-       ServerAdmin debian-admin@lists.debian.org
-
-       Use common-debian-service-ssl planet-master.debian.org
-       Use common-ssl-HSTS
-
-       <IfModule mod_userdir.c>
-               UserDir disabled
-       </IfModule>
-       ErrorLog ${APACHE_LOG_DIR}/planet-master.debian.org-error.log
-       CustomLog ${APACHE_LOG_DIR}/planet-master.debian.org-access.log privacy
-       ServerSignature On
-
-       DocumentRoot /srv/planet.debian.org/www
-       <Directory /srv/planet.debian.org/www>
-               Use DebianHostList
-       </Directory>
-</VirtualHost>

diff --git a/modules/roles/files/ssh_upload/rsync-ssh-wrap b/modules/roles/files/ssh_upload/rsync-ssh-wrap
index bdfc6f1..f2a8917 100755 (executable)
--- a/modules/roles/files/ssh_upload/rsync-ssh-wrap
+++ b/modules/roles/files/ssh_upload/rsync-ssh-wrap
@@ -68,7 +68,7 @@ do_rsync() {
                allowed="${allowed_rsyncs[$cmd_idx]}"
                if [ "$*" = "$allowed" ]; then
                        info "Running for host $remote_host: rsync $*"
-                       exec rsync "$@"
+                       exec rsync --chmod=F640 "$@"
                        croak "Exec failed"
                fi
        done

diff --git a/modules/roles/manifests/planet_master.pp b/modules/roles/manifests/planet_master.pp
index 5114ece..8e67d46 100644 (file)
--- a/modules/roles/manifests/planet_master.pp
+++ b/modules/roles/manifests/planet_master.pp
@@ -1,10 +1,10 @@
 class roles::planet_master {
        include apache2::ssl
        apache2::config { 'puppet-debianhosts':
-               content => template('roles/conf-debianhostlist.erb'),
+               ensure => 'absent',
        }
        apache2::site { 'planet-master.debian.org':
-               source => 'puppet:///modules/roles/planet_master/planet-master.debian.org',
+               content => template('roles/planet_master/planet-master.debian.org.erb')
        }
        ssl::service { 'planet-master.debian.org':
                notify => Exec['service apache2 reload'],

diff --git a/modules/roles/manifests/snapshot.pp b/modules/roles/manifests/snapshot.pp
index 0811bfd..34621f5 100644 (file)
--- a/modules/roles/manifests/snapshot.pp
+++ b/modules/roles/manifests/snapshot.pp
@@ -2,4 +2,6 @@ class roles::snapshot {
        rsync::site { 'snapshot-farm':
                content => template('roles/snapshot/rsyncd.conf.erb'),
        }
+
+       ensure_packages ( ["build-essential", "python-dev", "libssl-dev"], { ensure => 'installed' })
 }

diff --git a/modules/roles/manifests/static_mirror.pp b/modules/roles/manifests/static_mirror.pp
index c3d62e5..96e607c 100644 (file)
--- a/modules/roles/manifests/static_mirror.pp
+++ b/modules/roles/manifests/static_mirror.pp
@@ -10,6 +10,8 @@ class roles::static_mirror {
        include apache2::ssl
        apache2::module { 'include': }
        apache2::module { 'geoip': require => [Package['libapache2-mod-geoip'], Package['geoip-database']]; }
+       apache2::module { 'deflate': }
+       apache2::module { 'filter': }
 
        file { '/usr/local/bin/static-mirror-run':
                source => 'puppet:///modules/roles/static-mirroring/static-mirror-run',

diff --git a/modules/roles/templates/planet_master/planet-master.debian.org.erb b/modules/roles/templates/planet_master/planet-master.debian.org.erb
new file mode 100644 (file)
index 0000000..95afcf0
--- /dev/null
+++ b/modules/roles/templates/planet_master/planet-master.debian.org.erb
@@ -0,0 +1,41 @@
+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+
+Use common-debian-service-https-redirect * planet-master.debian.org
+<VirtualHost *:443>
+       ServerName planet-master.debian.org
+       ServerAdmin debian-admin@lists.debian.org
+
+       Use common-debian-service-ssl planet-master.debian.org
+       Use common-ssl-HSTS
+
+       <IfModule mod_userdir.c>
+               UserDir disabled
+       </IfModule>
+       ErrorLog ${APACHE_LOG_DIR}/planet-master.debian.org-error.log
+       CustomLog ${APACHE_LOG_DIR}/planet-master.debian.org-access.log privacy
+       ServerSignature On
+
+       DocumentRoot /srv/planet.debian.org/www
+       <Directory /srv/planet.debian.org/www>
+               # Localhost
+               Require ip ::1
+               Require ip 127.0.0.1
+<%=
+  lines = []
+  roles = scope.lookupvar('site::roles')
+  roles['planet_master'].each do |node|
+    lines << "\t\t# #{scope.lookupvar('site::allnodeinfo')[node]['hostname'][0]}"
+    scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |addr|
+      lines << "\t\tRequire ip #{addr}"
+    end
+  end
+  lines.join("\n")
+# vim:set et:
+# vim:set sts=2 ts=2:
+# vim:set shiftwidth=2:
+%>
+       </Directory>
+</VirtualHost>

diff --git a/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb b/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
index cbdeb36..fea7de7 100644 (file)
--- a/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
+++ b/modules/roles/templates/static-mirroring/vhost/static-vhosts-simple.erb
@@ -126,10 +126,7 @@
                AddEncoding x-gzip .gz
                AddType text/plain .log
 
-               <IfModule mod_userdir.c>
-                       AddOutputFilterByType DEFLATE image/svg+xml
-                       AddOutputFilterByType DEFLATE text/plain
-               </IfModule>
+               AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css image/svg+xml
        </Directory>
 
        <Directory /srv/static.debian.org/mirrors/lintian.debian.org/cur/resources>

diff --git a/modules/rsync/files/systemd-cleanup-failed-rsyncs b/modules/rsync/files/systemd-cleanup-failed-rsyncs
deleted file mode 100755 (executable)
index 5cde92b..0000000
--- a/modules/rsync/files/systemd-cleanup-failed-rsyncs
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-# if a client goes away on socket activated connections before systemd launches
-# the process, things go sad and result in failed services.
-#
-# cf. https://github.com/systemd/systemd/issues/7172
-#
-# should be fixed in buster and newer, but for now clean those up.
-
-systemctl --failed --no-legend | awk '{print $1}' | \
-    while read service; do
-    if [[ $service =~ ^rsyncd-[a-z]*@.*\.service$ ]]; then
-        systemctl reset-failed "$service"
-    fi
-done

diff --git a/modules/rsync/manifests/init.pp b/modules/rsync/manifests/init.pp
index a80582c..686843c 100644 (file)
--- a/modules/rsync/manifests/init.pp
+++ b/modules/rsync/manifests/init.pp
@@ -25,14 +25,6 @@ class rsync {
        }
 
        file { '/usr/local/sbin/systemd-cleanup-failed-rsyncs':
-               source => 'puppet:///modules/rsync/systemd-cleanup-failed-rsyncs',
-               mode   => '0555',
-       }
-       file { '/etc/cron.d/puppet-crazy-multipath-restart': ensure => absent, }
-       concat::fragment { 'dsa-puppet-stuff--systemd-cleanup-failed-rsyncs':
-               target => '/etc/cron.d/dsa-puppet-stuff',
-               content  => @("EOF"),
-                               */10 * * * * root /usr/local/sbin/systemd-cleanup-failed-rsyncs
-                               | EOF
+               ensure => absent,
        }
 }

diff --git a/modules/schroot/files/schroot-setup.d/99builddsourceslist b/modules/schroot/files/schroot-setup.d/99builddsourceslist
index 7a61391..d9dc92d 100755 (executable)
--- a/modules/schroot/files/schroot-setup.d/99builddsourceslist
+++ b/modules/schroot/files/schroot-setup.d/99builddsourceslist
@@ -137,8 +137,8 @@ if [ "$1" = "setup-start" ] || [ "$1" = "setup-recover" ]; then
             [ -n "${debian_mirror}" ] && domirror "${debian_mirror} ${SUITE_BASE} COMPONENT" ${APT_LIST}
             domirror "http://ftp.debian.org/debian ${SUITE_BASE} COMPONENT" ${APT_LIST}
             [ -n "${security_mirror}" ] && domirror "${security_mirror} ${SUITE_BASE}/updates COMPONENT" ${APT_LIST}
-            domirror "http://security-master.debian.org/debian-security ${SUITE_BASE}/updates COMPONENT" ${APT_LIST}
-            domirror "http://security-master.debian.org/debian-security-buildd buildd-${SUITE_BASE}/updates COMPONENT" ${APT_LIST}
+            domirror "https://security-master.debian.org/debian-security ${SUITE_BASE}/updates COMPONENT" ${APT_LIST}
+            domirror "https://security-master.debian.org/debian-security-buildd buildd-${SUITE_BASE}/updates COMPONENT" ${APT_LIST}
 
         elif [ "${SUITE_VARIANT%%-sloppy}" = 'backports' ]; then
             # Hack: for kfreebsd-* the base suite for jessie-backports and jessie-backports-sloppy is jessie-kfreebsd (and not jessie)
@@ -207,10 +207,10 @@ if [ "$1" = "setup-start" ] || [ "$1" = "setup-recover" ]; then
                         echo deb ${security_mirror} ${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
                         echo deb-src ${security_mirror} ${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
                     fi
-                    echo deb http://security-master.debian.org/debian-security ${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
-                    echo deb-src http://security-master.debian.org/debian-security ${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
-                    echo deb http://security-master.debian.org/debian-security-buildd buildd-${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
-                    echo deb-src http://security-master.debian.org/debian-security-buildd buildd-${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
+                    echo deb https://security-master.debian.org/debian-security ${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
+                    echo deb-src https://security-master.debian.org/debian-security ${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
+                    echo deb https://security-master.debian.org/debian-security-buildd buildd-${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
+                    echo deb-src https://security-master.debian.org/debian-security-buildd buildd-${SUITE_BASE}/updates main contrib >> ${APT_LIST_AUTO}
                 elif [ ${SUITE_VARIANT%%-sloppy} = 'backports' ]; then
                         : > ${APT_LIST_AUTO}
                     if [ -n "${debian_mirror}" ]; then

diff --git a/modules/schroot/files/setup-all-dchroots b/modules/schroot/files/setup-all-dchroots
index 4e71f1f..4de0f83 100755 (executable)
--- a/modules/schroot/files/setup-all-dchroots
+++ b/modules/schroot/files/setup-all-dchroots
@@ -46,18 +46,12 @@ get_suites() {
       amd64|i386|armel|armhf)
         echo "sid buster stretch jessie wheezy"
         ;;
-      kfreebsd-*)
-        echo "sid         jessie"
-        ;;
       mips64el)
         echo "sid buster stretch"
         ;;
       powerpc)
         echo "sid         jessie"
         ;;
-      ppc64)
-        echo "sid"
-        ;;
       *)
         echo "sid buster stretch jessie"
         ;;

diff --git a/modules/schroot/files/setup-dchroot b/modules/schroot/files/setup-dchroot
index a3187dd..1040212 100755 (executable)
--- a/modules/schroot/files/setup-dchroot
+++ b/modules/schroot/files/setup-dchroot
@@ -383,6 +383,16 @@ chmod +x "$rootdir/usr/local/sbin/policy-rc.d"
 [ -z "$bare" ] && [ -z "$ubuntu" ] && chroot "$rootdir" apt-get install -y --no-install-recommends locales-all
 chroot "$rootdir" apt-get install -y --no-install-recommends build-essential
 [ -z "$bare" ] && chroot "$rootdir" apt-get install -y --no-install-recommends zsh less vim fakeroot devscripts gdb
+if [ -n "$buildd" ] ; then
+    case "$suite" in
+      wheezy|jessie|stretch)
+        chroot "$rootdir" apt-get install -y --no-install-recommends apt-transport-https ca-certificates
+        ;;
+      *)
+        chroot "$rootdir" apt-get install -y --no-install-recommends ca-certificates
+        ;;
+    esac
+fi
 rm -f "$rootdir/etc/apt/sources.list" "$rootdir/etc/apt/sources.list.d/*"
 chroot "$rootdir" apt-get clean
 umount "$rootdir/dev" 2>/dev/null || true

diff --git a/modules/schroot/templates/schroot-buildd/fstab.erb b/modules/schroot/templates/schroot-buildd/fstab.erb
index 7fe230f..2ff6198 100644 (file)
--- a/modules/schroot/templates/schroot-buildd/fstab.erb
+++ b/modules/schroot/templates/schroot-buildd/fstab.erb
@@ -4,14 +4,6 @@
 #
 # <file system>        <mount point>   <type>  <options>       <dump>  <pass>
 
-<% if scope.lookupvar('site::nodeinfo')['ldap'].has_key?('architecture') and scope.lookupvar('site::nodeinfo')['ldap']['architecture'][0].start_with?('kfreebsd') -%>
-# kFreeBSD version
-proc           /proc           linprocfs       defaults        0       0
-dev            /dev            devfs   rw              0       0
-dev            /dev/fd         fdescfs rw              0       0
-
-/srv/build-trees       /build  nullfs  rw              0       0
-<% else -%>
 # Linux version
 /proc          /proc           none    rw,bind         0       0
 /sys           /sys            none    rw,bind         0       0
@@ -20,6 +12,4 @@ tmpfs-shm     /dev/shm        tmpfs   defaults,size=64m       0 0
 
 <%- if has_variable?("has_srv_build_trees") && @has_srv_build_trees -%>
 /srv/build-trees       /build  none    rw,bind         0       0
-
-<% end %>
 <% end %>

diff --git a/modules/schroot/templates/schroot-dsa/fstab.erb b/modules/schroot/templates/schroot-dsa/fstab.erb
index 1b08d0d..ab1d12e 100644 (file)
--- a/modules/schroot/templates/schroot-dsa/fstab.erb
+++ b/modules/schroot/templates/schroot-dsa/fstab.erb
@@ -4,15 +4,6 @@
 #
 # <file system>        <mount point>   <type>  <options>       <dump>  <pass>
 
-<% if scope.lookupvar('site::nodeinfo')['ldap'].has_key?('architecture') and scope.lookupvar('site::nodeinfo')['ldap']['architecture'][0].start_with?('kfreebsd') -%>
-# kFreeBSD version
-proc           /proc           linprocfs       defaults        0       0
-dev            /dev            devfs   rw              0       0
-dev            /dev/fd         fdescfs rw              0       0
-/home          /home           nullfs  rw              0       0
-/tmp           /tmp            nullfs  rw              0       0
-
-<% else -%>
 # Linux version
 /proc          /proc           none    rw,bind         0       0
 /sys           /sys            none    rw,bind         0       0
@@ -21,5 +12,3 @@ dev           /dev/fd         fdescfs rw              0       0
 /home          /home           none    rw,bind         0       0
 /tmp           /tmp            none    rw,bind         0       0
 tmpfs-shm      /dev/shm        tmpfs   defaults,size=64m       0 0
-
-<% end %>

diff --git a/modules/sudo/files/sudoers b/modules/sudo/files/sudoers
index cb64051..bdf87ae 100644 (file)
--- a/modules/sudo/files/sudoers
+++ b/modules/sudo/files/sudoers
@@ -54,7 +54,6 @@ root  ALL=(ALL) ALL
 %zivit-admins  ZIVITHOSTS=(ALL)        NOPASSWD: ALL
 
 # nagios
-nagios         ALL=(ALL)       NOPASSWD: /bin/systemctl is-system-running
 nagios         MQ_HOSTS=(rabbitmq)     NOPASSWD: /usr/sbin/rabbitmqctl list_queues -p dsa name messages consumers
 nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/service ekeyd-egd-linux restart
 nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/service samhain restart
@@ -62,6 +61,7 @@ nagios                ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-dabackup ""
 nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-filesystems ""
 nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-libs --ignore-younger=1h
 nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-stunnel-sanity ""
+nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-systemd-services ""
 nagios         handel=(puppet) NOPASSWD: /usr/lib/nagios/plugins/dsa-check-cert-expire /var/lib/puppet/ssl/certs/ca.pem
 # with smartarray controllers
 nagios         ALL=(ALL)       NOPASSWD: /sbin/hpasmcli ""

diff --git a/modules/systemd/files/systemd-cleanup-failed b/modules/systemd/files/systemd-cleanup-failed
new file mode 100755 (executable)
index 0000000..0115f93
--- /dev/null
+++ b/modules/systemd/files/systemd-cleanup-failed
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# if a client goes away on socket activated connections before systemd launches
+# the process, things go sad and result in failed services.
+#
+# cf. https://github.com/systemd/systemd/issues/7172
+#
+# should be fixed in buster and newer, but for now clean those up.
+
+systemctl --failed --no-legend | awk '{print $1}' | \
+    while read service; do
+    if [[ $service =~ ^rsyncd-[a-z]*@.*\.service$ ]] ||
+       [[ $service =~ ^session-[0-9]+\.scope$ ]]; then
+        systemctl reset-failed "$service"
+    fi
+done

diff --git a/modules/systemd/manifests/init.pp b/modules/systemd/manifests/init.pp
index d5b896d..1dd41cd 100644 (file)
--- a/modules/systemd/manifests/init.pp
+++ b/modules/systemd/manifests/init.pp
@@ -15,4 +15,14 @@ class systemd {
                }
        }
 
+       file { '/usr/local/sbin/systemd-cleanup-failed':
+               source => 'puppet:///modules/systemd/systemd-cleanup-failed',
+               mode   => '0555',
+       }
+       concat::fragment { 'dsa-puppet-stuff--systemd-cleanup-failed':
+               target => '/etc/cron.d/dsa-puppet-stuff',
+               content  => @("EOF"),
+                               */10 * * * * root /usr/local/sbin/systemd-cleanup-failed
+                               | EOF
+       }
 }