Merge branch 'master' into benvin/nfpm_fedora

rpms/nzbget/metadata.yaml

@@ -13,9 +13,9 @@ builds:
   - almalinux/el8
   image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
-  version: '26.2'
+  version: '26.1'
 - repository:
   - almalinux/el9
   image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
   release: 1
-  version: '26.2'
+  version: '26.1'

rpms/nzbget/resources/build.sh

@@ -2,10 +2,6 @@
 
 set -e
 
-# Download the pre-built RPM from GitHub releases.
-# Upstream always publishes the release-1 asset (nzbget-<version>-1.x86_64.rpm);
-# the source URL must use the upstream asset name, not PACKAGE_RELEASE, which
-# carries the dist tag (e.g. 1.el9) and does not exist upstream. Only the local
-# output filename is dist-tagged, mirroring the code-server package.
+# Download the pre-built RPM from GitHub releases
 curl -L -o /app/dist/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm \
-  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-1.x86_64.rpm
+  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm

rpms/puppet-initial/README.md

@@ -1,38 +0,0 @@
-# puppet-initial
-
-A firstrun bootstrap script and oneshot systemd service that initialises a
-freshly-provisioned host into Puppet:
-
-1. Sets the FQDN under `.main.unkin.net`.
-2. Fetches the Puppet CA certificate from the CA service.
-3. Registers the node with a noop agent run against the CA.
-4. Runs the agent a few times against the compile master, then enables the
-   `puppet` service and disables itself.
-
-## Puppet CA endpoint
-
-The CA endpoint defaults to the in-cluster puppetserver CA service
-`puppetca.k8s.syd1.au.unkin.net:8140` (serving the standard
-`/puppet-ca/v1/certificate/ca` API).
-
-It is overridable via the environment. The `puppet-initial.service` unit reads
-`/etc/sysconfig/puppet-initial` (`EnvironmentFile=-`, so the file is optional),
-which the RPM ships as a commented `%config(noreplace)` example:
-
-| Variable        | Default                          | Purpose                                                      |
-|-----------------|----------------------------------|-------------------------------------------------------------|
-| `PUPPETCA_HOST` | `puppetca.k8s.syd1.au.unkin.net` | CA hostname (CA cert fetch + `--server` for registration).  |
-| `PUPPETCA_PORT` | `8140`                           | CA API port.                                                |
-
-### Overriding from kickstart
-
-A kickstart `%post` can point a host at a different CA without rebuilding the
-RPM by writing the sysconfig file before the service starts:
-
-```bash
-%post
-cat > /etc/sysconfig/puppet-initial <<'EOF'
-PUPPETCA_HOST=puppetca.k8s.syd1.au.unkin.net
-PUPPETCA_PORT=8140
-EOF
-```

rpms/puppet-initial/metadata.yaml

@@ -11,9 +11,9 @@ builds:
   release: '1'
   repository:
   - almalinux/el8
-  version: 1.0.5
+  version: 1.0.3
 - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
   release: '1'
   repository:
   - almalinux/el9
-  version: 1.0.5
+  version: 1.0.3

rpms/puppet-initial/resources/nfpm.yaml

@@ -15,7 +15,7 @@ license: ${PACKAGE_LICENSE}
 disable_globbing: false
 
 depends:
-  - openvox-agent
+  - puppet-agent
 
 # Files to include in the package
 contents:
@@ -31,13 +31,6 @@ contents:
       mode: 0644
       owner: root
       group: root
-  - src: /app/resources/puppet-initial.sysconfig
-    dst: /etc/sysconfig/puppet-initial
-    type: config|noreplace
-    file_info:
-      mode: 0644
-      owner: root
-      group: root
 
 # Scripts to run during installation/removal (optional)
 scripts:

rpms/puppet-initial/resources/puppet-initial

@@ -1,21 +1,14 @@
 #!/bin/bash
 
-# Puppet CA endpoint. Overridable via the environment (systemd reads
-# /etc/sysconfig/puppet-initial via EnvironmentFile), so kickstart %post can
-# point a host at a different CA without rebuilding the RPM. Defaults to the
-# in-cluster puppetserver CA service.
-PUPPETCA_HOST="${PUPPETCA_HOST:-puppetca.k8s.syd1.au.unkin.net}"
-PUPPETCA_PORT="${PUPPETCA_PORT:-8140}"
-
 # Ensure the hostname is set
 hostnamectl set-hostname $(hostname -s).main.unkin.net
 grep '^HOSTNAME=' /etc/sysconfig/network | cut -d= -f2 | grep -q '\.' || sed -i 's/^\(HOSTNAME=[^\.]*\)$/\1.main.unkin.net/' /etc/sysconfig/network
 
 # Install CA for Puppet
-test -f /etc/puppetlabs/puppet/ssl/certs/ca.pem || mkdir -p /etc/puppetlabs/puppet/ssl/certs && wget --no-check-certificate "https://${PUPPETCA_HOST}:${PUPPETCA_PORT}/puppet-ca/v1/certificate/ca" -O /etc/puppetlabs/puppet/ssl/certs/ca.pem
+test -f /etc/puppetlabs/puppet/ssl/certs/ca.pem || mkdir -p /etc/puppetlabs/puppet/ssl/certs && wget --no-check-certificate https://puppetca.query.consul:8140/puppet-ca/v1/certificate/ca -O /etc/puppetlabs/puppet/ssl/certs/ca.pem
 
 # Registering to Puppet server
-/opt/puppetlabs/bin/puppet agent --test --server "${PUPPETCA_HOST}" --noop --onetime --no-daemonize --verbose
+/opt/puppetlabs/bin/puppet agent --test --server puppetca.query.consul --noop --onetime --no-daemonize --verbose
 
 # Running Puppet agent five times with a 30-second gap between each run, stop puppet service at the end of each run
 for i in {1..5}; do

rpms/puppet-initial/resources/puppet-initial.service

@@ -5,7 +5,6 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-EnvironmentFile=-/etc/sysconfig/puppet-initial
 ExecStart=/usr/local/bin/puppet-initial
 RemainAfterExit=true
 ExecStop=/bin/true

rpms/puppet-initial/resources/puppet-initial.sysconfig

@@ -1,13 +0,0 @@
-# Environment overrides for the puppet-initial firstrun bootstrap.
-# Read by the puppet-initial.service unit (EnvironmentFile=-/etc/sysconfig/puppet-initial).
-# A kickstart %post can write this file to point a host at a different Puppet CA
-# without rebuilding the RPM. All values are optional; the defaults below match
-# the shipped in-cluster puppetserver CA service.
-
-# Hostname of the Puppet CA service. Used both to fetch the CA certificate
-# (https://<host>:<port>/puppet-ca/v1/certificate/ca) and as --server for the
-# initial noop agent registration run.
-#PUPPETCA_HOST=puppetca.k8s.syd1.au.unkin.net
-
-# Port the Puppet CA API listens on.
-#PUPPETCA_PORT=8140