## Why
The estate migrated from Puppet to OpenVox. The `puppet-agent` package name no longer exists in the rpm-vendor repos, so kickstart installs of `puppet-initial` fail dependency resolution with "nothing provides puppet-agent", blocking host provisioning.
(Note: `openvox-agent` does `Provides: puppet-agent = 7`, so an alternative root cause is openvox repo priority/availability during the kickstart solve. This PR changes the explicit `Requires` as requested so puppet-initial depends on the package by its real name.)
## Changes
- Change puppet-initial's dependency from `puppet-agent` to `openvox-agent`.
- Bump el8/el9 build version `1.0.4` -> `1.0.5` so a new RPM is published (deploy dedup skips identical filenames).
## Validation
- `make test` — 72 passed.
- Local `nfpm pkg` build in the almalinux9-rpmbuilder image: RPM assembles as `puppet-initial-1.0.5-1.x86_64`, `rpm -qpR` reports `Requires: openvox-agent`.
- Confirmed `openvox-agent` is resolvable from the openvox el9 remote (7.35.0–7.37.2 available).
https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Reviewed-on: #172
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
## Why
The `puppet-initial` firstrun bootstrap RPM hardcoded the legacy Consul-discovered CA endpoint `puppetca.query.consul:8140`. That VM-era CA is being replaced by the in-cluster puppetserver CA service `puppetca.k8s.syd1.au.unkin.net`. Rather than swap one hardcoded host for another, the endpoint is now configurable so kickstart can override it per host.
Verified the new service serves the same Puppet CA API on the same port: `https://puppetca.k8s.syd1.au.unkin.net:8140/puppet-ca/v1/certificate/ca` returns HTTP 200 with a valid Puppet CA cert.
## Changes
- Default the CA host to `puppetca.k8s.syd1.au.unkin.net` (still port `8140`, same `/puppet-ca/v1/certificate/ca` path).
- Bootstrap script reads `PUPPETCA_HOST` / `PUPPETCA_PORT` from the environment, falling back to the defaults, and uses them for both the CA cert fetch and the `--server` of the initial noop registration run.
- Add `EnvironmentFile=-/etc/sysconfig/puppet-initial` to the systemd unit so kickstart `%post` can drop overrides in there.
- Ship a commented example config at `/etc/sysconfig/puppet-initial` as `%config(noreplace)`.
- Add a package README documenting the override, with a kickstart `%post` example.
- Bump el8/el9 build version `1.0.3` -> `1.0.4` so a new RPM is published (dedup skips identical filenames).
Note: the run loop still targets `puppet.query.consul` (the compile master, a separate host from the CA) — intentionally left unchanged; scope here is the CA endpoint only.
## Validation
- `make test` — 72 passed
- pre-commit (metadata jsonschema, yamllint, shebang/executable checks) — all pass
- Local `nfpm pkg` build: RPM assembles; `/etc/sysconfig/puppet-initial` correctly listed by `rpm -qcp` as a config file; packaged script carries the new default + env wiring.
https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---------
Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #171
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
## Why
`nzbget` is absent from the artifactapi `rpm-vendor-el9` / `rpm-vendor-el8` repodata, so `dnf install nzbget` fails on the media host (AlmaLinux 9.7). The legacy Gitea RPM registry is being removed from hosts by puppet-prod #496, so nzbget must land in `rpm-vendor-el9` or installs break.
Root cause: nzbget's `build.sh` built the GitHub download URL from `PACKAGE_RELEASE`, which carries the dist tag (e.g. `1.el9`). Upstream only publishes `nzbget-<version>-1.x86_64.rpm` (no dist tag), so the fetch 404s and a 22-byte "upstream returned 404" junk file is what gets published — createrepo cannot index it, so the package never appears in the repo metadata. The stale junk `nzbget-26.1-1.el9` also makes the deploy step's dedup probe return HTTP 200, which would skip re-uploading a corrected 26.1.
## How
- Point the `build.sh` source URL at the upstream release-1 asset name (`nzbget-${PACKAGE_VERSION}-1.x86_64.rpm`) while keeping the dist-tagged local output filename, mirroring the `code-server` package which repackages a prebuilt upstream RPM the same way.
- Bump nzbget el8/el9 to `26.2` (current upstream stable) so the corrected build produces a fresh filename the deploy step will actually PUT (side-stepping the stale-junk dedup skip).
## Validation
- Confirmed the corrected URL fetches a real 9.1MB RPM through artifactapi's github remote: `NAME=nzbget VER=26.2 REL=1 ARCH=x86_64`.
- `pytest` 72 passed; metadata validates against `schema/metadata.json`; all pre-commit hooks pass (yamllint, check-jsonschema, etc.).
## Post-merge
The deploy pipelines (`.woodpecker/deploy-almalinux{8,9}.yaml`) run on push to `master`. On merge they will `build-all --distro almalinux/el{8,9}`, build nzbget 26.2, and PUT `nzbget-26.2-1.el{8,9}.x86_64.rpm` to `rpm-vendor-el{8,9}`; artifactapi regenerates repodata so `dnf install nzbget` resolves.
https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: #170
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
unkinben
benvin