propellor 2.7.0 → 2.7.1

raw patch · 11 files changed

+65/−35 lines, 11 files

Files

• CHANGELOG +8/−0
• config-joey.hs +18/−17
• debian/changelog +8/−0
• debian/control +1/−0
• propellor.cabal +1/−1
• src/Propellor/Bootstrap.hs +1/−0
• src/Propellor/Property/Firewall.hs +12/−7
• src/Propellor/Property/Network.hs +9/−0
• src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs +3/−3
• src/Propellor/Property/SiteSpecific/IABak.hs +2/−0
• src/Propellor/Property/Tor.hs +2/−7

@@ -1,3 +1,11 @@+propellor (2.7.1) unstable; urgency=medium++  * Make sure that make is installed when bootstrapping propellor.+  * Fix bug in Firewall's Port datatype to iptable parameter translation code.+    Thanks, Antoine Eiche.++ -- Joey Hess <id@joeyh.name>  Fri, 14 Aug 2015 15:01:37 -0400+ propellor (2.7.0) unstable; urgency=medium    * Ssh.permitRootLogin type changed to allow configuring WithoutPassword

@@ -145,29 +145,30 @@ honeybee :: Host honeybee = standardSystem "honeybee.kitenet.net" Testing "armhf" 	[ "Arm git-annex build box." ]-	& ipv6 "2001:4830:1600:187::2"+	+	-- I have to travel to get console access, so no automatic+	-- upgrades, and try to be robust.+	& "/etc/default/rcS" `File.containsLine` "FSCKFIX=yes" -	-- No unattended upgrades as there is currently no console access.-	-- (Also, system is not currently running a stock kernel,-	-- although it should be able to.)+	& Apt.installed ["flash-kernel"]+	& "/etc/flash-kernel/machine" `File.hasContent` ["Cubietech Cubietruck"]+	& Apt.installed ["linux-image-armmp"]+	& Network.dhcp "eth0" `requires` Network.cleanInterfacesFile 	& Postfix.satellite+	+	-- ipv6 used for remote access thru firewalls 	& Apt.serviceInstalledRunning "aiccu"+	& ipv6 "2001:4830:1600:187::2"++	-- In case compiler needs more than available ram 	& Apt.serviceInstalledRunning "swapspace"++	-- No hardware clock. 	& Apt.serviceInstalledRunning "ntp" -	-- Not using systemd-nspawn because it's broken (kernel issue?)-	-- & Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer-	-- 	GitAnnexBuilder.armAutoBuilder-	-- 		builderos Cron.Daily "22h")-	& Chroot.provisioned -		(Chroot.debootstrapped builderos mempty "/var/lib/container/armel-git-annex-builder"-			& "/etc/timezone" `File.hasContent` ["America/New_York"]-			& GitAnnexBuilder.armAutoBuilder-				builderos (Cron.Times "1 1 * * *") "12h"-		)-  where-	-- Using unstable to get new enough ghc for TH on arm.-	builderos = System (Debian Unstable) "armel"+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		GitAnnexBuilder.armAutoBuilder+			(System (Debian Unstable) "armel") Cron.Daily "22h")  -- This is not a complete description of kite, since it's a -- multiuser system with eg, user passwords that are not deployed

@@ -1,3 +1,11 @@+propellor (2.7.1) unstable; urgency=medium++  * Make sure that make is installed when bootstrapping propellor.+  * Fix bug in Firewall's Port datatype to iptable parameter translation code.+    Thanks, Antoine Eiche.++ -- Joey Hess <id@joeyh.name>  Fri, 14 Aug 2015 15:01:37 -0400+ propellor (2.7.0) unstable; urgency=medium    * Ssh.permitRootLogin type changed to allow configuring WithoutPassword

@@ -40,6 +40,7 @@ 	libghc-transformers-dev, 	libghc-exceptions-dev (>= 0.6), 	git,+	make, Description: property-based host configuration management in haskell  Propellor enures that the system it's run in satisfies a list of  properties, taking action as necessary when a property is not yet met.

@@ -1,5 +1,5 @@ Name: propellor-Version: 2.7.0+Version: 2.7.1 Cabal-Version: >= 1.8 License: BSD3 Maintainer: Joey Hess <id@joeyh.name>

@@ -81,6 +81,7 @@ 		, "libghc-mtl-dev" 		, "libghc-transformers-dev" 		, "libghc-exceptions-dev"+		, "make" 		]  installGitCommand :: ShellCommand

@@ -42,13 +42,18 @@ 	(toIpTableArg (ruleRules r)) ++ [ "-j" , show $ ruleTarget r ]  toIpTableArg :: Rules -> [String]-toIpTableArg Everything        = []-toIpTableArg (Proto proto)     = ["-p", map toLower $ show proto]-toIpTableArg (DPort port)       = ["--dport", show port]-toIpTableArg (DPortRange (f,t)) = ["--dport", show f ++ ":" ++ show t]-toIpTableArg (IFace iface)     = ["-i", iface]-toIpTableArg (Ctstate states)  = ["-m", "conntrack","--ctstate", concat $ intersperse "," (map show states)]-toIpTableArg (r :- r')         = toIpTableArg r <> toIpTableArg r'+toIpTableArg Everything = []+toIpTableArg (Proto proto) = ["-p", map toLower $ show proto]+toIpTableArg (DPort (Port port)) = ["--dport", show port]+toIpTableArg (DPortRange (Port f, Port t)) =+	["--dport", show f ++ ":" ++ show t]+toIpTableArg (IFace iface) = ["-i", iface]+toIpTableArg (Ctstate states) =+	[ "-m"+	, "conntrack"+	, "--ctstate", concat $ intersperse "," (map show states)+	]+toIpTableArg (r :- r') = toIpTableArg r <> toIpTableArg r'  data Rule = Rule 	{ ruleChain :: Chain

@@ -27,6 +27,15 @@ 	] 	`describe` ("clean " ++ interfacesFile) +-- | Configures an interface to get its address via dhcp.+dhcp :: Interface -> Property NoInfo+dhcp iface = hasContent (interfaceDFile iface)+	[ "auto " ++ iface+	, "iface " ++ iface ++ " inet dhcp"+	]+	`describe` ("dhcp " ++ iface)+	`requires` interfacesDEnabled+ -- | Writes a static interface file for the specified interface. -- -- The interface has to be up already. It could have been brought up by

@@ -115,8 +115,8 @@ 		& User.accountFor (User builduser) 		& tree arch -armAutoBuilder :: System -> Times -> TimeOut -> Property HasInfo-armAutoBuilder osver@(System _ arch) crontime timeout = +armAutoBuilder :: System -> Property HasInfo+armAutoBuilder osver =  	propertyList "arm git-annex autobuilder" $ props 		& standardAutoBuilder osver 		& buildDepsNoHaskellLibs@@ -126,12 +126,12 @@ 		-- Install patched haskell packages for portability to 		-- arm NAS's using old kernel versions. 		& haskellPkgsInstalled "linux"-		& autobuilder arch crontime timeout  androidAutoBuilderContainer :: Times -> TimeOut -> Systemd.Container androidAutoBuilderContainer crontimes timeout = 	androidContainer "android-git-annex-builder" (tree "android") builddir 		& Apt.unattendedUpgrades+		& buildDepsNoHaskellLibs 		& autobuilder "android" crontimes timeout  -- Android is cross-built in a Debian i386 container, using the Android NDK.

@@ -36,6 +36,7 @@ 		"/usr/local/IA.BAK/shardstats-all" 	& Cron.niceJob "shardmaint" Cron.Daily (User "root") "/" 		"/usr/local/IA.BAK/shardmaint-fast; /usr/local/IA.BAK/shardmaint"+	& Apt.installed ["git-annex"]  registrationServer :: [Host] -> Property HasInfo registrationServer knownhosts = propertyList "iabak registration server" $ props@@ -71,6 +72,7 @@ 		, "retentions = 10m:30d,1h:1y,3h:10y" 		, "[default_1min_for_1day]" 		, "pattern = .*"+		, "retentions = 60s:1d" 		] 	& graphiteCSRF 	& cmdProperty "graphite-manage" ["syncdb", "--noinput"] `flagFile` "/etc/flagFiles/graphite-syncdb"

@@ -103,13 +103,8 @@ 	Nothing -> property ("unable to parse " ++ s) noChange  hiddenServiceAvailable :: HiddenServiceName -> Int -> Property NoInfo-hiddenServiceAvailable hn port = hiddenServiceHostName prop+hiddenServiceAvailable hn port = hiddenServiceHostName $ hiddenService hn port   where-	prop = configured-		[ ("HiddenServiceDir", varLib </> hn)-		, ("HiddenServicePort", unwords [show port, "127.0.0.1:" ++ show port])-		]-		`describe` "hidden service available" 	hiddenServiceHostName p =  adjustPropertySatisfy p $ \satisfy -> do 		r <- satisfy 		h <- liftIO $ readFile (varLib </> hn </> "hostname")@@ -164,7 +159,7 @@  -- | Convert String to a valid tor NickName. saneNickname :: String -> NickName-saneNickname s +saneNickname s 	| null n = "unnamed" 	| otherwise = n   where