propellor 5.15 → 5.16

raw patch · 15 files changed

+170/−76 lines, 15 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG +9/−0
• debian/changelog +9/−0
• joeyconfig.hs +59/−41
• propellor.cabal +1/−1
• src/Propellor/CmdLine.hs +1/−1
• src/Propellor/Engine.hs +1/−1
• src/Propellor/Property/Debootstrap.hs +4/−0
• src/Propellor/Property/Gpg.hs +1/−1
• src/Propellor/Property/Qemu.hs +1/−1
• src/Propellor/Property/SiteSpecific/GitAnnexBuilder.hs +24/−11
• src/Propellor/Property/SiteSpecific/JoeySites.hs +52/−14
• src/Propellor/Property/Ssh.hs +2/−1
• src/Propellor/Spin.hs +1/−2
• src/Propellor/Ssh.hs +1/−1
• src/Utility/UserInfo.hs +4/−1

@@ -1,3 +1,12 @@+propellor (5.16) unstable; urgency=medium++  * Debootstrap: Added UseOldGpgKeyring constructor to DebootstrapConfig,+    which allows bootstrapping ancient stable releases of Debian.+  * Qemu: Install binfmt-support along with qemu-user-static.+  * Fix build with unix-2.8.0.0 and with unix-compat-0.7.++ -- Joey Hess <id@joeyh.name>  Mon, 29 May 2023 11:24:25 -0400+ propellor (5.15) unstable; urgency=medium    * Improve propellor's MetaTypes implementation to avoid an expontential

@@ -1,3 +1,12 @@+propellor (5.16) unstable; urgency=medium++  * Debootstrap: Added UseOldGpgKeyring constructor to DebootstrapConfig,+    which allows bootstrapping ancient stable releases of Debian.+  * Qemu: Install binfmt-support along with qemu-user-static.+  * Fix build with unix-2.8.0.0 and with unix-compat-0.7.++ -- Joey Hess <id@joeyh.name>  Mon, 29 May 2023 11:24:25 -0400+ propellor (5.15) unstable; urgency=medium    * Improve propellor's MetaTypes implementation to avoid an expontential

@@ -28,8 +28,10 @@ import qualified Propellor.Property.Systemd as Systemd import qualified Propellor.Property.Journald as Journald import qualified Propellor.Property.Fail2Ban as Fail2Ban+import qualified Propellor.Property.FlashKernel as FlashKernel import qualified Propellor.Property.Laptop as Laptop import qualified Propellor.Property.LightDM as LightDM+import qualified Propellor.Property.Debootstrap as Debootstrap import qualified Propellor.Property.HostingProvider.Linode as Linode import qualified Propellor.Property.SiteSpecific.GitHome as GitHome import qualified Propellor.Property.SiteSpecific.GitAnnexBuilder as GitAnnexBuilder@@ -45,13 +47,14 @@ 	[ darkstar 	, dragon 	, oyster-	, orca 	, house 	, kite+	, sparrow 	, beaver 	, sow 	, mouse 	, peregrine+	, eel 	, pell 	] ++ monsters @@ -96,29 +99,6 @@ 	& User.hasPassword (User "root") 	& Apt.unattendedUpgrades -orca :: Host-orca = host "orca.kitenet.net" $ props-	& standardSystem Unstable X86_64 [ "Main git-annex build box." ]-	& ipv4 "138.38.108.179"--	& Apt.unattendedUpgrades-	& Postfix.satellite-	& Apt.serviceInstalledRunning "ntp"-	& Systemd.persistentJournal--	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer-		GitAnnexBuilder.standardAutoBuilder-		Unstable X86_64 Nothing (Cron.Times "15 * * * *") "2h")-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer-		GitAnnexBuilder.standardAutoBuilder-		Unstable X86_32 Nothing (Cron.Times "30 * * * *") "2h")-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer-		GitAnnexBuilder.stackAutoBuilder-		(Stable "jessie") X86_32 (Just "ancient") (Cron.Times "45 * * * *") "2h")-	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer-		GitAnnexBuilder.standardAutoBuilder-		Testing ARM64 Nothing (Cron.Times "1 * * * *") "4h")- house :: Host house = host "house.lan" $ props 	& standardSystem Testing ARMHF@@ -126,6 +106,10 @@ 	& Apt.removed ["rsyslog"] 	 	& cubietech_Cubietruck+	-- fsck when needed on boot+	& "/etc/default/flash-kernel"+		`File.containsLine` "LINUX_KERNEL_CMDLINE=\"fsck.repair=yes\""+		`onChange` FlashKernel.flashKernel 	& hasPartition 		( partition EXT3 			`mountedAt` "/"@@ -148,7 +132,7 @@ 		hosts 		(Context "house.joeyh.name") 		(SshEd25519, "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMAmVYddg/RgCbIj+cLcEiddeFXaYFnbEJ3uGj9G/EyV joey@honeybee")-	& JoeySites.connectStarlinkRouter+	& JoeySites.connectStarlinkDish 	& JoeySites.homeRouter 	& JoeySites.homeNAS 	& Apt.installed ["mtr-tiny", "iftop", "screen", "nmap"]@@ -156,15 +140,6 @@ 	& Apt.installed ["linux-headers-armmp-lpae"] 	& Postfix.satellite -	& check (not <$> hasContainerCapability Systemd.FilesystemContained) -		(setupRevertableProperty autobuilder)-	-- In case compiler needs more than available ram-	& Apt.serviceInstalledRunning "swapspace"-  where-	autobuilder = Systemd.nspawned $ GitAnnexBuilder.autoBuilderContainer-		(GitAnnexBuilder.armAutoBuilder GitAnnexBuilder.standardAutoBuilder)-		Testing ARMEL Nothing (Cron.Times "15 15 * * *") "10h"- -- This is not a complete description of kite, since it's a -- multiuser system with eg, user passwords that are not deployed -- with propellor.@@ -186,7 +161,6 @@  	& Network.preserveStatic "eth0" `requires` Network.cleanInterfacesFile 	& Apt.installed ["linux-image-amd64"]-	& Apt.serviceInstalledRunning "swapspace" 	& Linode.serialGrub 	& Linode.locateEnabled 	& Apt.unattendedUpgrades@@ -257,8 +231,6 @@ 	& alias "kgb.kitenet.net" 	& JoeySites.kgbServer 	-	& Systemd.nspawned ancientKitenet-	 	& alias "podcatcher.kitenet.net" 	& JoeySites.podcatcher @@ -267,6 +239,7 @@ 		[ (RelDomain "mouse-onion", CNAME $ AbsDomain "htieo6yu2qtcn2j3.onion") 		, (RelDomain "beaver-onion", CNAME $ AbsDomain "tl4xsvaxryjylgxs.onion") 		, (RelDomain "peregrine-onion", CNAME $ AbsDomain "rsdwvaabir6ty2kdzblq7wdda26ib4fuc6hzxzwum75jbn6thqbojvid.onion")+		, (RelDomain "eel-onion", CNAME $ AbsDomain "4yuc425lsa6ho2c6dlsg4cinadxvsn7vvir7a36ljv7wdyvg52h3inid.onion") 		, (RelDomain "sow-onion", CNAME $ AbsDomain "urt4g2tq32qktgtp.onion") 		] 	& myDnsPrimary "joeyh.name" []@@ -293,7 +266,45 @@ 	& Apache.httpsVirtualHost "letsencrypt.joeyh.name" "/var/www/html" 		(LetsEncrypt.AgreeTOS (Just "id@joeyh.name")) 	& alias "letsencrypt.joeyh.name"+	+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		(GitAnnexBuilder.standardAutoBuilder True)+		Unstable X86_64 mempty Nothing (Cron.Times "15 * * * *") "2h")+	& Apt.serviceInstalledRunning "swapspace" +sparrow :: Host+sparrow = host "sparrow.kitenet.net" $ props+	& standardSystem Testing ARM64 [ "Welcome to sparrow!" ]+	& ipv4 "128.140.52.168"+	& ipv6 "2a01:4f8:c17:ed3a::1"+	& Apt.installed ["ssh"]+	& Apt.installed [ "git-annex", "myrepos", "build-essential", "make"]+	-- In case compiler needs more than available ram+	& Apt.serviceInstalledRunning "swapspace"++	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		-- qemu hangs running unattended-upgrades on i386+		-- so disable installing that+		(GitAnnexBuilder.standardAutoBuilder False)+		Unstable X86_32 mempty Nothing (Cron.Times "30 * * * *") "4h")+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		GitAnnexBuilder.stackAutoBuilder+		(Stable "jessie") X86_32 +		(Debootstrap.UseOldGpgKeyring Debootstrap.:+ Debootstrap.DebootstrapMirror "http://archive.debian.org/debian/")+		(Just "ancient") (Cron.Times "45 * * * *") "4h")+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		(GitAnnexBuilder.standardAutoBuilder True)+		Testing ARM64 mempty Nothing (Cron.Times "1 * * * *") "2h")+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		GitAnnexBuilder.stackAutoBuilder+		(Stable "bullseye") ARM64 mempty+		(Just "ancient") (Cron.Times "20 * * * *") "2h")+	& Systemd.nspawned (GitAnnexBuilder.autoBuilderContainer+		(GitAnnexBuilder.armAutoBuilder (GitAnnexBuilder.standardAutoBuilder True))+		Testing ARMEL mempty Nothing (Cron.Times "15 15 * * *") "2h")+	+	& Systemd.nspawned ancientKitenet+ beaver :: Host beaver = host "beaver.kitenet.net" $ props 	& Apt.installed ["ssh"]@@ -315,6 +326,13 @@ 	& Tor.installed 	& Tor.hiddenServiceAvailable "ssh" (Port 22) +eel :: Host+eel = host "eel.kitenet.net" $ props+	& Apt.installed ["ssh", "screen", "git-annex"]+	& Tor.installed+	& Tor.hiddenServiceAvailable "ssh" (Port 22)+	& LightDM.autoLogin (User "desktop")+ peregrine :: Host peregrine = host "peregrine.kitenet.net" $ props 	& Apt.installed ["ssh", "screen", "variety", "git-annex"]@@ -362,7 +380,7 @@ -- Exhibit: kite's 90's website on port 1994. ancientKitenet :: Systemd.Container ancientKitenet = Systemd.debContainer "ancient-kitenet" $ props-	& standardContainer (Stable "buster")+	& standardContainer (Stable "buster") ARM64 	& alias hn 	& Git.cloned (User "root") "git://kitenet-net.branchable.com/" "/var/www/html" 		(Just "remotes/origin/old-kitenet.net")@@ -406,9 +424,9 @@ 	& JoeySites.noExim  -- This is my standard container setup, Featuring automatic upgrades.-standardContainer :: DebianSuite -> Property (HasInfo + Debian)-standardContainer suite = propertyList "standard container" $ props-	& osDebian suite X86_64+standardContainer :: DebianSuite -> Architecture -> Property (HasInfo + Debian)+standardContainer suite arch = propertyList "standard container" $ props+	& osDebian suite arch 	-- Do not want to run mail daemon inside a random container.. 	& JoeySites.noExim 	& Apt.stdSourcesList `onChange` Apt.upgrade

@@ -1,5 +1,5 @@ Name: propellor-Version: 5.15+Version: 5.16 Cabal-Version: 1.20 License: BSD2 Maintainer: Joey Hess <id@joeyh.name>

@@ -6,7 +6,7 @@ import System.Environment (getArgs) import Data.List import System.Exit-import System.PosixCompat+import System.Posix.User import Network.Socket  import Propellor.Base

@@ -16,7 +16,7 @@ import System.IO import Data.Monoid import "mtl" Control.Monad.RWS.Strict-import System.PosixCompat+import System.Posix.Files import System.Posix.IO import System.FilePath import System.Console.Concurrent

@@ -34,6 +34,9 @@ 	| UseEmulation 	| DebootstrapProxy Url 	| DebootstrapMirror Url+	| UseOldGpgKeyring+	-- ^ Debootstrap using the keyring of old and removed gpg keys.+	-- This is needed to debootstrap ancient stable releases of Debian. 	| DebootstrapConfig :+ DebootstrapConfig 	deriving (Show) @@ -52,6 +55,7 @@ toParams UseEmulation = [] toParams (DebootstrapProxy _) = [] toParams (DebootstrapMirror _) = []+toParams UseOldGpgKeyring = [Param "--keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg"] toParams (c1 :+ c2) = toParams c1 <> toParams c2  useEmulation :: DebootstrapConfig -> Bool

@@ -3,7 +3,7 @@ import Propellor.Base import qualified Propellor.Property.Apt as Apt -import System.PosixCompat+import System.Posix.User  installed :: Property DebianLike installed = Apt.installed ["gnupg"]

@@ -11,7 +11,7 @@   where 	setup = Apt.installed p `pickOS` unsupportedOS 	cleanup = Apt.removed p `pickOS` unsupportedOS-	p = ["qemu-user-static"]+	p = ["qemu-user-static", "binfmt-support"]  -- | Check if the given System supports an Architecture. --

@@ -10,6 +10,7 @@ import qualified Propellor.Property.Systemd as Systemd import qualified Propellor.Property.Chroot as Chroot import Propellor.Property.Cron (Times)+import Propellor.Property.Debootstrap  builduser :: UserName builduser = "builder"@@ -105,9 +106,9 @@ 			`assume` MadeChange 		cabalupdated = homedir </> ".cabal" </> "packages" </> "hackage.haskell.org" </> "00-index.cache" -autoBuilderContainer :: (DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)) -> DebianSuite -> Architecture -> Flavor -> Times -> TimeOut -> Systemd.Container-autoBuilderContainer mkprop suite arch flavor crontime timeout =-	Systemd.container name $ \d -> Chroot.debootstrapped mempty d $ props+autoBuilderContainer :: (DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)) -> DebianSuite -> Architecture -> DebootstrapConfig -> Flavor -> Times -> TimeOut -> Systemd.Container+autoBuilderContainer mkprop suite arch debootstrapconfig flavor crontime timeout =+	Systemd.container name $ \d -> Chroot.debootstrapped debootstrapconfig d $ props 		& mkprop suite arch flavor 		& autobuilder (architectureToDebianArchString arch) crontime timeout   where@@ -115,13 +116,13 @@  type Flavor = Maybe String -standardAutoBuilder :: DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)-standardAutoBuilder suite arch flavor =+standardAutoBuilder :: Bool -> DebianSuite -> Architecture -> Flavor -> Property (HasInfo + Debian)+standardAutoBuilder unattendedupgrades suite arch flavor = 	propertyList "standard git-annex autobuilder" $ props 		& osDebian suite arch 		& Apt.stdSourcesList-		& Apt.unattendedUpgrades 		& Apt.cacheCleaned+		& (if unattendedupgrades then Apt.unattendedUpgrades else mempty) 		& User.accountFor (User builduser) 		& tree (architectureToDebianArchString arch) flavor 		& buildDepsApt@@ -131,7 +132,10 @@ 	propertyList "git-annex autobuilder using stack" $ props 		& osDebian suite arch 		& buildDepsNoHaskellLibs-		& Apt.stdSourcesList+		-- For some reason security.debian.org is very slow for+		-- ancient versions of debian stable used with this. So+		-- disable for now.+		-- & Apt.stdSourcesList 		& Apt.unattendedUpgrades 		& Apt.cacheCleaned 		& User.accountFor (User builduser)@@ -139,18 +143,24 @@ 		& stackInstalled 		-- Workaround https://github.com/commercialhaskell/stack/issues/2093 		& Apt.installed ["libtinfo-dev"]+		& Apt.installed ["libnuma1", "libnuma-dev", "zlib1g-dev"]  stackInstalled :: Property DebianLike stackInstalled = withOS "stack installed" $ \w o -> 	case o of 		(Just (System (Debian Linux (Stable "jessie")) arch)) -> 			ensureProperty w $ manualinstall arch+		(Just (System (Debian Linux (Stable "stretch")) arch)) ->+			ensureProperty w $ manualinstall arch+		(Just (System (Debian Linux (Stable "buster")) arch)) ->+			ensureProperty w $ manualinstall arch 		_ -> ensureProperty w $ Apt.installed ["haskell-stack"]   where 	-- Warning: Using a binary downloaded w/o validation.-	manualinstall :: Architecture -> Property Linux+	manualinstall :: Architecture -> Property DebianLike 	manualinstall arch = tightenTargets $ check (not <$> doesFileExist binstack) $ 		propertyList "stack installed from upstream tarball" $ props+			& Apt.installed ["wget"] 			& cmdProperty "wget" [url, "-O", tmptar] 				`assume` MadeChange 			& File.dirExists tmpdir@@ -168,9 +178,12 @@ 				_ -> doNothing 	  where 		url = case arch of-			X86_32 -> "https://www.stackage.org/stack/linux-i386"-			X86_64 -> "https://www.stackage.org/stack/linux-x86_64"-			ARMEL -> "https://github.com/commercialhaskell/stack/releases/download/v1.7.1/stack-1.7.1-linux-arm.tar.gz"+			X86_64 -> "https://github.com/commercialhaskell/stack/releases/download/v1.9.3/stack-1.9.3-linux-x86_64.tar.gz"+			X86_32 -> "https://github.com/commercialhaskell/stack/releases/download/v1.9.3/stack-1.9.3-linux-i386.tar.gz"+			ARMEL -> "https://github.com/commercialhaskell/stack/releases/download/v1.9.3/stack-1.9.3-linux-arm.tar.gz"+			-- Newer version because older version did not+			-- support installing ghc on arm64+			ARM64 -> "https://github.com/commercialhaskell/stack/releases/download/v2.1.3/stack-2.1.3-linux-aarch64.tar.gz" 			-- Probably not available. 			a -> "https://www.stackage.org/stack/linux-" ++ architectureToDebianArchString a 	binstack = "/usr/bin/stack"

@@ -249,22 +249,23 @@ 	`requires` Apt.installed ["git-annex", "myrepos"]  spamdEnabled :: Property DebianLike-spamdEnabled = tightenTargets $ -	cmdProperty "update-rc.d" ["spamassassin", "enable"]-		`assume` MadeChange+spamdEnabled = Apt.serviceInstalledRunning "spamd"  spamassassinConfigured :: Property DebianLike spamassassinConfigured = propertyList "spamassassin configured" $ props-	& Apt.serviceInstalledRunning "spamassassin"-	& "/etc/default/spamassassin" `File.containsLines`+	& spamdEnabled+	& "/etc/default/spamd" `File.containsLines` 		[ "# Propellor deployed" 		, "OPTIONS=\"--create-prefs --max-children 5 --helper-home-dir\""-		, "CRON=1" 		, "NICE=\"--nicelevel 15\""-		]+		]  		`describe` "spamd configured"-		`onChange` spamdEnabled-		`onChange` Service.restarted "spamassassin"+		`onChange` Service.restarted "spamd"+	& "/etc/default/spamassassin" `File.containsLines`+		[ "# Propellor deployed"+		, "CRON=1"+		]+		`describe` "spamassassin configured" 		`requires` Apt.serviceInstalledRunning "cron"  kiteMailServer :: Property (HasInfo + DebianLike)@@ -881,12 +882,33 @@ homerouterWifiInterface = "wlx00c0ca82eb78"  homerouterWifiInterfaceOld :: String-homerouterWifiInterfaceOld = "wlx00c0cab064eb"+homerouterWifiInterfaceOld = "wlx9cefd5fcd6f3" +-- Connect to the starlink dish directly (no starlink router)+connectStarlinkDish :: Property DebianLike+connectStarlinkDish = propertyList "connected via starlink dish" $ props+	-- Use dhcpcd for ipv6 prefix delegation to the wifi interface.+	& Apt.installed ["dhcpcd"]+	-- dhcpcd is run by ifup on boot. When the daemon was enabled,+	-- that somehow prevented prefix delegation from happening,+	-- so disable the daemon from being run by systemd.+	& Systemd.stopped "dhcpcd"+	& Systemd.masked "dhcpcd"+	& "/etc/dhcpcd.conf" `File.containsLine`+		("ia_pd 1 " ++ homerouterWifiInterface)+	& "/etc/dhcpcd.conf" `File.lacksLine`+		("ia_pd 1 " ++ homerouterWifiInterfaceOld)+	& Network.dhcp "end0"+		`requires` Network.cleanInterfacesFile+ -- Connect to the starlink router with its ethernet adapter.+--+-- Static route because with dhcp it sometimes fails to get an address from+-- starlink. connectStarlinkRouter :: Property DebianLike connectStarlinkRouter = propertyList "connected via starlink router" $ props-	& Network.dhcp "eth0"+	& Network.static "end0" (IPv4 "192.168.1.62")+		(Just (Network.Gateway (IPv4 "192.168.1.1"))) 		`requires` Network.cleanInterfacesFile  -- My home router, running hostapd and dnsmasq.@@ -916,21 +938,37 @@ 		[ "domain-needed" 		, "bogus-priv" 		, "interface=" ++ homerouterWifiInterface-		, "interface=eth0" 		, "domain=lan" 		-- lease time is short because the house 		-- controller wants to know when clients disconnect 		, "dhcp-range=10.1.1.100,10.1.1.150,10m" 		, "no-hosts"-		, "address=/honeybee.kitenet.net/10.1.1.1" 		, "address=/house.lan/10.1.1.1"+		-- allow accessing starlink dish when it's not online yet+		, "address=/dishy.starlink.com/192.168.100.1" 		] 		`onChange` Service.restarted "dnsmasq" 	-- Avoid DHCPNAK of lease obtained at boot, after NTP slews clock-	-- forward too far, causing that least to not be valid.+	-- forward too far, causing that lease to not be valid. 	& "/etc/default/dnsmasq" `File.containsLine` "DNSMASQ_OPTS=\"--dhcp-authoritative\"" 		`onChange` Service.restarted "dnsmasq" 	& ipmasq homerouterWifiInterface+	& Apt.installed ["radvd"]+	-- This needs ipv6 prefix delegation to the wifi interface to be+	-- enabled.+	& File.hasContent "/etc/radvd.conf"+		[ "interface " ++ homerouterWifiInterface ++ " {"+		, "  AdvSendAdvert on;"+		, "  MinRtrAdvInterval 3;"+		, "  MaxRtrAdvInterval 10;"+		, "  prefix ::/64 {"+		, "    AdvOnLink on;"+		, "    AdvAutonomous on;"+		, "    AdvRouterAddr on;"+		, "  };"+		, "};"+		]+		`onChange` Service.restarted "radvd"  -- | Enable IP masqerading, on whatever other interfaces come up, besides the -- provided intif.

@@ -41,7 +41,8 @@ import Propellor.Property.User import Propellor.Types.Info -import System.PosixCompat+import System.Posix.User+import System.Posix.Files import qualified Data.Map as M import qualified Data.Set as S import qualified Data.Semigroup as Sem

@@ -11,9 +11,8 @@  import Data.List import System.Exit-import System.PosixCompat+import System.Posix import System.Posix.IO-import System.Posix.Directory import Control.Concurrent.Async import qualified Data.ByteString as B import qualified Data.Set as S

@@ -4,7 +4,7 @@ import Utility.UserInfo import Utility.FileSystemEncoding -import System.PosixCompat+import System.Posix import Data.Time.Clock.POSIX import Data.Hashable 

@@ -21,7 +21,10 @@ import Control.Applicative #endif -import System.PosixCompat+import System.Posix.User+#if MIN_VERSION_unix(2,8,0)+import System.Posix.User.ByteString (UserEntry)+#endif import Prelude  {- Current user's home directory.