## Why
The `puppet-initial` firstrun bootstrap RPM hardcoded the legacy Consul-discovered CA endpoint `puppetca.query.consul:8140`. That VM-era CA is being replaced by the in-cluster puppetserver CA service `puppetca.k8s.syd1.au.unkin.net`. Rather than swap one hardcoded host for another, the endpoint is now configurable so kickstart can override it per host.
Verified the new service serves the same Puppet CA API on the same port: `https://puppetca.k8s.syd1.au.unkin.net:8140/puppet-ca/v1/certificate/ca` returns HTTP 200 with a valid Puppet CA cert.
## Changes
- Default the CA host to `puppetca.k8s.syd1.au.unkin.net` (still port `8140`, same `/puppet-ca/v1/certificate/ca` path).
- Bootstrap script reads `PUPPETCA_HOST` / `PUPPETCA_PORT` from the environment, falling back to the defaults, and uses them for both the CA cert fetch and the `--server` of the initial noop registration run.
- Add `EnvironmentFile=-/etc/sysconfig/puppet-initial` to the systemd unit so kickstart `%post` can drop overrides in there.
- Ship a commented example config at `/etc/sysconfig/puppet-initial` as `%config(noreplace)`.
- Add a package README documenting the override, with a kickstart `%post` example.
- Bump el8/el9 build version `1.0.3` -> `1.0.4` so a new RPM is published (dedup skips identical filenames).
Note: the run loop still targets `puppet.query.consul` (the compile master, a separate host from the CA) — intentionally left unchanged; scope here is the CA endpoint only.
## Validation
- `make test` — 72 passed
- pre-commit (metadata jsonschema, yamllint, shebang/executable checks) — all pass
- Local `nfpm pkg` build: RPM assembles; `/etc/sysconfig/puppet-initial` correctly listed by `rpm -qcp` as a config file; packaged script carries the new default + env wiring.
https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---------
Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #171
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
- Migrate from legacy shell-based build system to modern Python tooling
- Update all metadata.yaml files to new schema with per-distro builds
- Standardise build scripts with curl -L, envsubst, and error handling
- Convert nfpm.yaml templates to use environment variable substitution
- Update Dockerfile to accept all package metadata as build arguments
- Modernise Makefile to use new Python build tool commands
- Update CI workflow to use tools/build instead of make
- Replace Makefile version/release file system with metadata.yaml only
- Add Python build automation (./tools/build) with Gitea API integration
- Add GitHub release updater (./tools/update-gh) for version management
- Centralize Dockerfiles into single parameterized Dockerfile
- Remove 54+ individual package Dockerfiles and version directories
- Update Makefile to use new Python tooling
- Add GITEA_API_TOKEN validation to prevent duplicate builds
- Support both explicit version/release args and metadata.yaml reading
Add simplified metadata structure for all 41 packages containing:
- Package name, version, and release number
- GitHub repository for packages with GitHub releases
- Build configuration for el/8 and el/9 distributions
This metadata enables future automation for version checking and package building across different distributions.
Standardize all RPM packages to use a consistent build pattern:
- Simple Dockerfiles that copy resources/ and call build.sh
- Move all build logic to resources/build.sh scripts
- Consolidate nfpm.yaml and scripts into resources/ directory
- Update base image to almalinux9-rpmbuilder for consistency
Changes:
- Refactored 37 packages total (simple + complex)
- HashiCorp tools: consul, vault, terraform, terragrunt, packer, nomad, nomad-autoscaler
- Development tools: g10k, etcd, nfpm, ruff, uv, unrar, nzbget, boilerplate
- VictoriaMetrics: vlutils, vmutils, victoria-logs
- Network tools: cni-plugins, consul-cni, unkin-ca-certificates
- Jellyfin suite: jellyfin-web, jellyfin-server, jellyfin-ffmpeg-bin
- System packages: puppet-initial, incus
This standardization improves maintainability and consistency across
the entire RPM build system while preserving all existing functionality.
unkinben