From e7d7cf9c59c7229821d4e4fb76f9adef89b11a86 Mon Sep 17 00:00:00 2001 From: jeanluc Date: Wed, 20 Apr 2022 22:37:39 +0200 Subject: [PATCH] Initial commit --- .cruft.json | 103 +++ .github/workflows/commitlint.yml | 16 + .gitignore | 134 ++++ .gitlab-ci.yml | 220 ++++++ .pre-commit-config.yaml | 78 ++ .rstcheck.cfg | 4 + .rubocop.yml | 23 + .salt-lint | 14 + .travis.yml | 192 +++++ .yamllint | 44 ++ CODEOWNERS | 53 ++ FORMULA | 9 + Gemfile | 19 + Gemfile.lock | 675 ++++++++++++++++++ LICENSE | 13 + bin/install-hooks | 16 + bin/kitchen | 32 + bin/slsdoc | 571 +++++++++++++++ commitlint.config.js | 8 + docs/Makefile | 20 + docs/README.rst | 188 +++++ docs/TOFS_pattern.rst | 518 ++++++++++++++ docs/conf.py | 78 ++ docs/index.rst | 20 + docs/make.bat | 35 + docs/map.jinja.rst | 542 ++++++++++++++ docs/pillar.rst | 7 + docs/states.rst | 6 + gitea/_mapdata/_mapdata.jinja | 13 + gitea/_mapdata/init.sls | 21 + gitea/clean.sls | 7 + gitea/config/clean.sls | 17 + gitea/config/file.sls | 60 ++ gitea/config/init.sls | 5 + gitea/files/default/app.ini.j2 | 30 + gitea/files/default/etc/app.ini.j2 | 24 + gitea/files/default/gitea.service.j2 | 103 +++ gitea/files/default/key.asc | 158 ++++ gitea/init.sls | 7 + gitea/libmapstack.jinja | 315 ++++++++ gitea/libmatchers.jinja | 222 ++++++ gitea/libsaltcli.jinja | 18 + gitea/libtofs.jinja | 115 +++ gitea/map.jinja | 66 ++ gitea/package/clean.sls | 33 + gitea/package/init.sls | 5 + gitea/package/install.sls | 148 ++++ gitea/parameters/defaults.yaml | 70 ++ gitea/parameters/map_jinja.yaml | 15 + gitea/parameters/os/.gitkeep | 0 gitea/parameters/os_family/Arch.yaml | 17 + gitea/parameters/os_family/Debian.yaml | 21 + gitea/parameters/os_family/FreeBSD.yaml | 18 + gitea/parameters/os_family/Gentoo.yaml | 17 + gitea/parameters/os_family/MacOS.yaml | 18 + gitea/parameters/os_family/OpenBSD.yaml | 18 + gitea/parameters/os_family/RedHat.yaml | 17 + gitea/parameters/os_family/Suse.yaml | 17 + gitea/parameters/osarch/386.yaml | 17 + gitea/parameters/osarch/amd64.yaml | 17 + gitea/parameters/osarch/arm64.yaml | 17 + gitea/parameters/osarch/armv6l.yaml | 17 + gitea/parameters/osarch/armv7l.yaml | 17 + gitea/parameters/osarch/ppc64le.yaml | 17 + gitea/parameters/osarch/s390x.yaml | 17 + gitea/parameters/osarch/x86_64.yaml | 17 + gitea/parameters/osfinger/.gitkeep | 0 gitea/post-map.jinja | 65 ++ gitea/service/clean.sls | 10 + gitea/service/init.sls | 5 + gitea/service/running.sls | 16 + kitchen.yml | 305 ++++++++ pillar.example | 122 ++++ pre-commit_semantic-release.sh | 30 + pyproject.toml | 20 + release-rules.js | 18 + release.config.js | 107 +++ test/integration/default/README.md | 50 ++ test/integration/default/controls/_mapdata.rb | 47 ++ test/integration/default/controls/config.rb | 40 ++ test/integration/default/controls/packages.rb | 11 + test/integration/default/controls/services.rb | 13 + .../default/files/_mapdata/almalinux-8.yaml | 89 +++ .../default/files/_mapdata/amazonlinux-1.yaml | 89 +++ .../default/files/_mapdata/amazonlinux-2.yaml | 89 +++ .../files/_mapdata/arch-base-latest.yaml | 89 +++ .../default/files/_mapdata/centos-6.yaml | 89 +++ .../default/files/_mapdata/centos-7.yaml | 89 +++ .../default/files/_mapdata/centos-8.yaml | 89 +++ .../default/files/_mapdata/debian-10.yaml | 89 +++ .../default/files/_mapdata/debian-11.yaml | 89 +++ .../default/files/_mapdata/debian-9.yaml | 89 +++ .../default/files/_mapdata/fedora-31.yaml | 89 +++ .../default/files/_mapdata/fedora-32.yaml | 89 +++ .../default/files/_mapdata/fedora-33.yaml | 89 +++ .../default/files/_mapdata/fedora-34.yaml | 89 +++ .../default/files/_mapdata/fedora-35.yaml | 89 +++ .../default/files/_mapdata/fedora-36.yaml | 89 +++ .../default/files/_mapdata/gentoo-2-sysd.yaml | 89 +++ .../default/files/_mapdata/gentoo-2-sysv.yaml | 89 +++ .../default/files/_mapdata/opensuse-15.yaml | 89 +++ .../files/_mapdata/opensuse-tumbleweed.yaml | 89 +++ .../default/files/_mapdata/oraclelinux-7.yaml | 89 +++ .../default/files/_mapdata/oraclelinux-8.yaml | 89 +++ .../default/files/_mapdata/rockylinux-8.yaml | 89 +++ .../default/files/_mapdata/ubuntu-16.yaml | 89 +++ .../default/files/_mapdata/ubuntu-18.yaml | 89 +++ .../default/files/_mapdata/ubuntu-20.yaml | 89 +++ test/integration/default/inspec.yml | 28 + test/integration/share/README.md | 22 + test/integration/share/inspec.yml | 24 + test/integration/share/libraries/system.rb | 134 ++++ test/salt/pillar/default.sls | 104 +++ test/salt/pillar/define_roles.sls | 7 + test/salt/pillar/gentoo.sls | 5 + test/salt/pillar/top.sls | 11 + test/salt/pillar/upstart.sls | 104 +++ 117 files changed, 8981 insertions(+) create mode 100644 .cruft.json create mode 100644 .github/workflows/commitlint.yml create mode 100644 .gitignore create mode 100644 .gitlab-ci.yml create mode 100644 .pre-commit-config.yaml create mode 100644 .rstcheck.cfg create mode 100644 .rubocop.yml create mode 100644 .salt-lint create mode 100644 .travis.yml create mode 100644 .yamllint create mode 100644 CODEOWNERS create mode 100644 FORMULA create mode 100644 Gemfile create mode 100644 Gemfile.lock create mode 100644 LICENSE create mode 100755 bin/install-hooks create mode 100755 bin/kitchen create mode 100755 bin/slsdoc create mode 100644 commitlint.config.js create mode 100644 docs/Makefile create mode 100644 docs/README.rst create mode 100644 docs/TOFS_pattern.rst create mode 100644 docs/conf.py create mode 100644 docs/index.rst create mode 100644 docs/make.bat create mode 100644 docs/map.jinja.rst create mode 100644 docs/pillar.rst create mode 100644 docs/states.rst create mode 100644 gitea/_mapdata/_mapdata.jinja create mode 100644 gitea/_mapdata/init.sls create mode 100644 gitea/clean.sls create mode 100644 gitea/config/clean.sls create mode 100644 gitea/config/file.sls create mode 100644 gitea/config/init.sls create mode 100644 gitea/files/default/app.ini.j2 create mode 100644 gitea/files/default/etc/app.ini.j2 create mode 100644 gitea/files/default/gitea.service.j2 create mode 100644 gitea/files/default/key.asc create mode 100644 gitea/init.sls create mode 100644 gitea/libmapstack.jinja create mode 100644 gitea/libmatchers.jinja create mode 100644 gitea/libsaltcli.jinja create mode 100644 gitea/libtofs.jinja create mode 100644 gitea/map.jinja create mode 100644 gitea/package/clean.sls create mode 100644 gitea/package/init.sls create mode 100644 gitea/package/install.sls create mode 100644 gitea/parameters/defaults.yaml create mode 100644 gitea/parameters/map_jinja.yaml create mode 100644 gitea/parameters/os/.gitkeep create mode 100644 gitea/parameters/os_family/Arch.yaml create mode 100644 gitea/parameters/os_family/Debian.yaml create mode 100644 gitea/parameters/os_family/FreeBSD.yaml create mode 100644 gitea/parameters/os_family/Gentoo.yaml create mode 100644 gitea/parameters/os_family/MacOS.yaml create mode 100644 gitea/parameters/os_family/OpenBSD.yaml create mode 100644 gitea/parameters/os_family/RedHat.yaml create mode 100644 gitea/parameters/os_family/Suse.yaml create mode 100644 gitea/parameters/osarch/386.yaml create mode 100644 gitea/parameters/osarch/amd64.yaml create mode 100644 gitea/parameters/osarch/arm64.yaml create mode 100644 gitea/parameters/osarch/armv6l.yaml create mode 100644 gitea/parameters/osarch/armv7l.yaml create mode 100644 gitea/parameters/osarch/ppc64le.yaml create mode 100644 gitea/parameters/osarch/s390x.yaml create mode 100644 gitea/parameters/osarch/x86_64.yaml create mode 100644 gitea/parameters/osfinger/.gitkeep create mode 100644 gitea/post-map.jinja create mode 100644 gitea/service/clean.sls create mode 100644 gitea/service/init.sls create mode 100644 gitea/service/running.sls create mode 100644 kitchen.yml create mode 100644 pillar.example create mode 100755 pre-commit_semantic-release.sh create mode 100644 pyproject.toml create mode 100644 release-rules.js create mode 100644 release.config.js create mode 100644 test/integration/default/README.md create mode 100644 test/integration/default/controls/_mapdata.rb create mode 100644 test/integration/default/controls/config.rb create mode 100644 test/integration/default/controls/packages.rb create mode 100644 test/integration/default/controls/services.rb create mode 100644 test/integration/default/files/_mapdata/almalinux-8.yaml create mode 100644 test/integration/default/files/_mapdata/amazonlinux-1.yaml create mode 100644 test/integration/default/files/_mapdata/amazonlinux-2.yaml create mode 100644 test/integration/default/files/_mapdata/arch-base-latest.yaml create mode 100644 test/integration/default/files/_mapdata/centos-6.yaml create mode 100644 test/integration/default/files/_mapdata/centos-7.yaml create mode 100644 test/integration/default/files/_mapdata/centos-8.yaml create mode 100644 test/integration/default/files/_mapdata/debian-10.yaml create mode 100644 test/integration/default/files/_mapdata/debian-11.yaml create mode 100644 test/integration/default/files/_mapdata/debian-9.yaml create mode 100644 test/integration/default/files/_mapdata/fedora-31.yaml create mode 100644 test/integration/default/files/_mapdata/fedora-32.yaml create mode 100644 test/integration/default/files/_mapdata/fedora-33.yaml create mode 100644 test/integration/default/files/_mapdata/fedora-34.yaml create mode 100644 test/integration/default/files/_mapdata/fedora-35.yaml create mode 100644 test/integration/default/files/_mapdata/fedora-36.yaml create mode 100644 test/integration/default/files/_mapdata/gentoo-2-sysd.yaml create mode 100644 test/integration/default/files/_mapdata/gentoo-2-sysv.yaml create mode 100644 test/integration/default/files/_mapdata/opensuse-15.yaml create mode 100644 test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml create mode 100644 test/integration/default/files/_mapdata/oraclelinux-7.yaml create mode 100644 test/integration/default/files/_mapdata/oraclelinux-8.yaml create mode 100644 test/integration/default/files/_mapdata/rockylinux-8.yaml create mode 100644 test/integration/default/files/_mapdata/ubuntu-16.yaml create mode 100644 test/integration/default/files/_mapdata/ubuntu-18.yaml create mode 100644 test/integration/default/files/_mapdata/ubuntu-20.yaml create mode 100644 test/integration/default/inspec.yml create mode 100644 test/integration/share/README.md create mode 100644 test/integration/share/inspec.yml create mode 100644 test/integration/share/libraries/system.rb create mode 100644 test/salt/pillar/default.sls create mode 100644 test/salt/pillar/define_roles.sls create mode 100644 test/salt/pillar/gentoo.sls create mode 100644 test/salt/pillar/top.sls create mode 100644 test/salt/pillar/upstart.sls diff --git a/.cruft.json b/.cruft.json new file mode 100644 index 0000000..d77b41e --- /dev/null +++ b/.cruft.json @@ -0,0 +1,103 @@ +{ + "template": "https://github.com/lkubb/salt-template-formula", + "commit": "7dea11a9bc3cb4827bc8fda80a30271353ab3e09", + "checkout": null, + "context": { + "cookiecutter": { + "_extensions": [ + "local_extensions.YAMLDumper" + ], + "_jinja2_env_vars": { + "block_start_string": "{!", + "block_end_string": "!}", + "variable_start_string": "{=", + "variable_end_string": "=}", + "comment_start_string": "{@", + "comment_end_string": "@}" + }, + "name": "Gitea", + "abbr": "gitea", + "abbr_pysafe": "gitea", + "pkg": "gitea", + "needs_repo": "", + "config": "/var/opt/gitea/custom/conf/app.ini", + "service": "gitea", + "subcomponent": "", + "subcomponent_config": "", + "git_username": "lkubb", + "_lookup": { + "paths": { + "bin": "/opt/gitea", + "conf": "/etc/opt/gitea", + "custom": "/var/opt/gitea/custom", + "data": "/var/opt/gitea/data", + "home": "/var/opt/gitea/home", + "internal_token_uri": "file:///etc/opt/gitea/internal_token", + "log": "/var/opt/gitea/log", + "repos": "/var/opt/gitea/data/gitea-repositories", + "work": "/var/opt/gitea" + }, + "requirements": [ + "git", + "gpg", + "python-gnupg" + ], + "shell": "/bin/bash", + "user": "git", + "group": "git", + "gpg": { + "key": "7C9E68152594688862D62AF62D9AE806EC1592E2", + "keyserver": "keys.openpgp.org" + }, + "pkg": { + "latest": "https://dl.gitea.io/gitea/version.json", + "sig": "https://dl.gitea.io/gitea/{version}/gitea-{version}-linux-{arch}.asc", + "source": "https://dl.gitea.io/gitea/{version}/gitea-{version}-linux-{arch}", + "source_hash": "https://dl.gitea.io/gitea/{version}/gitea-{version}-linux-{arch}.sha256" + } + }, + "_settings": { + "version": "latest", + "database": { + "db_type": "sqlite3", + "name": "gitea", + "user": "root", + "password": "hunter1" + }, + "secrets": { + "internal_token": "", + "jwt_secret": "", + "lfs_jwt_secret": "", + "secret_key": "" + }, + "service": { + "requires_mount": [], + "wants": [] + }, + "config": { + "default": { + "app_name": "Gitea", + "run_user": "git", + "run_mode": "prod" + }, + "server": { + "protocol": "http", + "domain": "localhost", + "http_addr": "0.0.0.0", + "http_port": 3000 + }, + "log": { + "mode": "console", + "level": "Info", + "stacktrace_level": "None" + }, + "repository.signing": { + "signing_key": "default" + } + } + }, + "_template": "https://github.com/lkubb/salt-template-formula" + } + }, + "directory": null +} diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml new file mode 100644 index 0000000..42a5375 --- /dev/null +++ b/.github/workflows/commitlint.yml @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +name: Commitlint +'on': [pull_request] + +jobs: + lint: + runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + steps: + - uses: actions/checkout@v2 + with: + fetch-depth: 0 + - uses: wagoid/commitlint-github-action@v1 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..39752a7 --- /dev/null +++ b/.gitignore @@ -0,0 +1,134 @@ +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + +# C extensions +*.so + +# Distribution / packaging +.Python +env/ +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +*.egg-info/ +.installed.cfg +*.egg + +# PyInstaller +# Usually these files are written by a python script from a packager +# before PyInstaller builds the exe, so as to inject date/other infos into it. +*.manifest +*.spec + +# Installer logs +pip-log.txt +pip-delete-this-directory.txt + +# Unit test / coverage reports +htmlcov/ +.tox/ +.coverage +.coverage.* +.cache +nosetests.xml +coverage.xml +*.cover +.hypothesis/ +.kitchen +.kitchen.local.yml +kitchen.local.yml +junit-*.xml + +# Translations +*.mo +*.pot + +# Django stuff: +*.log +local_settings.py + +# Flask stuff: +instance/ +.webassets-cache + +# Scrapy stuff: +.scrapy + +# Sphinx documentation +docs/_build/ + +# PyBuilder +target/ + +# Jupyter Notebook +.ipynb_checkpoints + +# pyenv +.python-version + +# celery beat schedule file +celerybeat-schedule + +# SageMath parsed files +*.sage.py + +# dotenv +.env + +# virtualenv +.venv +venv/ +ENV/ + +# visual studio +.vs/ + +# Spyder project settings +.spyderproject +.spyproject + +# Rope project settings +.ropeproject + +# mkdocs documentation +/site + +# mypy +.mypy_cache/ + +# Bundler +.bundle/ + +# copied `.md` files used for conversion to `.rst` using `m2r` +docs/*.md + +# Vim +*.sw? + +## Collected when centralising formulas (check and sort) +# `collectd-formula` +.pytest_cache/ +/.idea/ +Dockerfile.*_* +ignore/ +tmp/ + +# `salt-formula` -- Vagrant Specific files +.vagrant +top.sls +!test/salt/pillar/top.sls + +# `suricata-formula` -- Platform binaries +*.rpm +*.deb diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml new file mode 100644 index 0000000..52ed3ca --- /dev/null +++ b/.gitlab-ci.yml @@ -0,0 +1,220 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +############################################################################### +# Define all YAML node anchors +############################################################################### +.node_anchors: + # `only` (also used for `except` where applicable) + only_branch_master_parent_repo: &only_branch_master_parent_repo + - 'master@lkubb/salt-gitea-formula' + # `stage` + stage_lint: &stage_lint 'lint' + stage_release: &stage_release 'release' + stage_test: &stage_test 'test' + # `image` + image_commitlint: &image_commitlint 'myii/ssf-commitlint:11' + image_dindruby: &image_dindruby 'myii/ssf-dind-ruby:2.7.1-r3' + image_dindrubybionic: &image_dindrubybionic 'myii/ssf-dind-ruby-bionic:2.7.5-1bbox1' + image_precommit: &image_precommit + name: 'myii/ssf-pre-commit:2.9.2' + entrypoint: ['/bin/bash', '-c'] + image_rubocop: &image_rubocop 'pipelinecomponents/rubocop:latest' + image_semantic-release: &image_semanticrelease 'myii/ssf-semantic-release:15.14' + # `services` + services_docker_dind: &services_docker_dind + - 'docker:dind' + # `variables` + # https://forum.gitlab.com/t/gitlab-com-ci-caching-rubygems/5627/3 + # https://bundler.io/v1.16/bundle_config.html + variables_bundler: &variables_bundler + BUNDLE_CACHE_PATH: '${CI_PROJECT_DIR}/.cache/bundler' + BUNDLE_WITHOUT: 'production' + # `cache` + cache_bundler: &cache_bundler + key: '${CI_JOB_STAGE}' + paths: + - '${BUNDLE_CACHE_PATH}' + +############################################################################### +# Define stages and global variables +############################################################################### +stages: + - *stage_lint + - *stage_test + - *stage_release +variables: + DOCKER_DRIVER: 'overlay2' + +############################################################################### +# `lint` stage: `commitlint`, `pre-commit` & `rubocop` (latest, failure allowed) +############################################################################### +commitlint: + stage: *stage_lint + image: *image_commitlint + script: + # Add `upstream` remote to get access to `upstream/master` + - 'git remote add upstream + https://gitlab.com/lkubb/salt-gitea-formula.git' + - 'git fetch --all' + # Set default commit hashes for `--from` and `--to` + - 'export COMMITLINT_FROM="$(git merge-base upstream/master HEAD)"' + - 'export COMMITLINT_TO="${CI_COMMIT_SHA}"' + # `coqbot` adds a merge commit to test PRs on top of the latest commit in + # the repo; amend this merge commit message to avoid failure + - | + if [ "${GITLAB_USER_LOGIN}" = "coqbot" ] \ + && [ "${CI_COMMIT_BRANCH}" != "master" ]; then + git commit --amend -m \ + 'chore: reword coqbot merge commit message for commitlint' + export COMMITLINT_TO=HEAD + fi + # Run `commitlint` + - 'commitlint --from "${COMMITLINT_FROM}" + --to "${COMMITLINT_TO}" + --verbose' + +pre-commit: + stage: *stage_lint + image: *image_precommit + # https://pre-commit.com/#gitlab-ci-example + variables: + PRE_COMMIT_HOME: '${CI_PROJECT_DIR}/.cache/pre-commit' + cache: + key: '${CI_JOB_NAME}' + paths: + - '${PRE_COMMIT_HOME}' + script: + - 'pre-commit run --all-files --color always --verbose' + +# Use a separate job for `rubocop` other than the one potentially run by `pre-commit` +# - The `pre-commit` check will only be available for formulas that pass the default +# `rubocop` check -- and must continue to do so +# - This job is allowed to fail, so can be used for all formulas +# - Furthermore, this job uses all of the latest `rubocop` features & cops, +# which will help when upgrading the `rubocop` linter used in `pre-commit` +rubocop: + allow_failure: true + stage: *stage_lint + image: *image_rubocop + script: + - 'rubocop -d -P -S --enable-pending-cops' + +############################################################################### +# Define `test` template +############################################################################### +.test_instance: &test_instance + stage: *stage_test + image: *image_dindruby + services: *services_docker_dind + variables: *variables_bundler + cache: *cache_bundler + before_script: + # TODO: This should work from the env vars above automatically + - 'bundle config set path "${BUNDLE_CACHE_PATH}"' + - 'bundle config set without "${BUNDLE_WITHOUT}"' + - 'bundle install' + script: + # Alternative value to consider: `${CI_JOB_NAME}` + - 'bin/kitchen verify "${DOCKER_ENV_CI_JOB_NAME}"' + +############################################################################### +# Define `test` template (`allow_failure: true`) +############################################################################### +.test_instance_failure_permitted: + <<: *test_instance + allow_failure: true + +############################################################################### +# `test` stage: each instance below uses the `test` template above +############################################################################### +## Define the rest of the matrix based on Kitchen testing +# Make sure the instances listed below match up with +# the `platforms` defined in `kitchen.yml` +# yamllint disable rule:line-length +# default-debian-11-tiamat-py3: {extends: '.test_instance'} +# default-debian-10-tiamat-py3: {extends: '.test_instance'} +# default-debian-9-tiamat-py3: {extends: '.test_instance'} +# default-ubuntu-2004-tiamat-py3: {extends: '.test_instance'} +# default-ubuntu-1804-tiamat-py3: {extends: '.test_instance'} +# default-centos-stream8-tiamat-py3: {extends: '.test_instance_failure_permitted'} +# default-centos-7-tiamat-py3: {extends: '.test_instance'} +# default-amazonlinux-2-tiamat-py3: {extends: '.test_instance'} +# default-oraclelinux-8-tiamat-py3: {extends: '.test_instance'} +# default-oraclelinux-7-tiamat-py3: {extends: '.test_instance'} +# default-almalinux-8-tiamat-py3: {extends: '.test_instance'} +# default-rockylinux-8-tiamat-py3: {extends: '.test_instance'} +default-debian-11-master-py3: {extends: '.test_instance'} +default-debian-10-master-py3: {extends: '.test_instance'} +default-debian-9-master-py3: {extends: '.test_instance'} +default-ubuntu-2004-master-py3: {extends: '.test_instance'} +default-ubuntu-1804-master-py3: {extends: '.test_instance'} +default-centos-stream8-master-py3: {extends: '.test_instance_failure_permitted'} +default-centos-7-master-py3: {extends: '.test_instance'} +default-fedora-36-master-py3: {extends: '.test_instance_failure_permitted'} +default-fedora-35-master-py3: {extends: '.test_instance'} +default-fedora-34-master-py3: {extends: '.test_instance'} +default-opensuse-leap-153-master-py3: {extends: '.test_instance'} +default-opensuse-tmbl-latest-master-py3: {extends: '.test_instance_failure_permitted'} +default-amazonlinux-2-master-py3: {extends: '.test_instance'} +default-oraclelinux-8-master-py3: {extends: '.test_instance'} +default-oraclelinux-7-master-py3: {extends: '.test_instance'} +default-arch-base-latest-master-py3: {extends: '.test_instance'} +default-gentoo-stage3-latest-master-py3: {extends: '.test_instance'} +default-gentoo-stage3-systemd-master-py3: {extends: '.test_instance'} +default-almalinux-8-master-py3: {extends: '.test_instance'} +default-rockylinux-8-master-py3: {extends: '.test_instance'} +# default-debian-11-3004-1-py3: {extends: '.test_instance'} +# default-debian-10-3004-1-py3: {extends: '.test_instance'} +# default-debian-9-3004-1-py3: {extends: '.test_instance'} +# default-ubuntu-2004-3004-1-py3: {extends: '.test_instance'} +# default-ubuntu-1804-3004-1-py3: {extends: '.test_instance'} +# default-centos-stream8-3004-1-py3: {extends: '.test_instance_failure_permitted'} +# default-centos-7-3004-1-py3: {extends: '.test_instance'} +# default-fedora-36-3004-1-py3: {extends: '.test_instance_failure_permitted'} +# default-fedora-35-3004-1-py3: {extends: '.test_instance'} +# default-fedora-34-3004-1-py3: {extends: '.test_instance'} +# default-amazonlinux-2-3004-1-py3: {extends: '.test_instance'} +# default-oraclelinux-8-3004-1-py3: {extends: '.test_instance'} +# default-oraclelinux-7-3004-1-py3: {extends: '.test_instance'} +# default-arch-base-latest-3004-1-py3: {extends: '.test_instance'} +# default-gentoo-stage3-latest-3004-1-py3: {extends: '.test_instance'} +# default-gentoo-stage3-systemd-3004-1-py3: {extends: '.test_instance'} +# default-almalinux-8-3004-1-py3: {extends: '.test_instance'} +# default-rockylinux-8-3004-1-py3: {extends: '.test_instance'} +# default-opensuse-leap-153-3004-0-py3: {extends: '.test_instance'} +# default-opensuse-tmbl-latest-3004-0-py3: {extends: '.test_instance_failure_permitted'} +# default-debian-10-3003-4-py3: {extends: '.test_instance'} +# default-debian-9-3003-4-py3: {extends: '.test_instance'} +# default-ubuntu-2004-3003-4-py3: {extends: '.test_instance'} +# default-ubuntu-1804-3003-4-py3: {extends: '.test_instance'} +# default-centos-stream8-3003-4-py3: {extends: '.test_instance_failure_permitted'} +# default-centos-7-3003-4-py3: {extends: '.test_instance'} +# default-amazonlinux-2-3003-4-py3: {extends: '.test_instance'} +# default-oraclelinux-8-3003-4-py3: {extends: '.test_instance'} +# default-oraclelinux-7-3003-4-py3: {extends: '.test_instance'} +# default-almalinux-8-3003-4-py3: {extends: '.test_instance'} +# default-debian-10-3002-8-py3: {extends: '.test_instance'} +# default-debian-9-3002-8-py3: {extends: '.test_instance'} +# default-ubuntu-2004-3002-8-py3: {extends: '.test_instance'} +# default-ubuntu-1804-3002-8-py3: {extends: '.test_instance'} +# default-centos-7-3002-8-py3: {extends: '.test_instance'} +# default-amazonlinux-2-3002-8-py3: {extends: '.test_instance'} +# default-oraclelinux-8-3002-8-py3: {extends: '.test_instance'} +# default-oraclelinux-7-3002-8-py3: {extends: '.test_instance'} +# yamllint enable rule:line-length + +############################################################################### +# `release` stage: `semantic-release` +############################################################################### +semantic-release: + only: *only_branch_master_parent_repo + stage: *stage_release + image: *image_semanticrelease + variables: + MAINTAINER_TOKEN: '${GH_TOKEN}' + script: + # Update `AUTHORS.md` + - '${HOME}/go/bin/maintainer contributor' + # Run `semantic-release` + - 'semantic-release' diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..d9c04a1 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,78 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +# See https://pre-commit.com for more information +# See https://pre-commit.com/hooks.html for more hooks +default_stages: [commit] +repos: + - repo: https://github.com/dafyddj/commitlint-pre-commit-hook + rev: v2.3.0 + hooks: + - id: commitlint + name: Check commit message using commitlint + description: Lint commit message against @commitlint/config-conventional rules + stages: [commit-msg] + additional_dependencies: ['@commitlint/config-conventional@8.3.4'] + - id: commitlint-travis + stages: [manual] + additional_dependencies: ['@commitlint/config-conventional@8.3.4'] + always_run: true + - repo: https://github.com/rubocop-hq/rubocop + rev: v1.25.1 + hooks: + - id: rubocop + name: Check Ruby files with rubocop + args: [--debug] + always_run: true + pass_filenames: false + - repo: https://github.com/shellcheck-py/shellcheck-py + rev: v0.8.0.4 + hooks: + - id: shellcheck + name: Check shell scripts with shellcheck + files: ^.*\.(sh|bash|ksh)$ + types: [] + - repo: https://github.com/adrienverge/yamllint + rev: v1.26.3 + hooks: + - id: yamllint + name: Check YAML syntax with yamllint + args: [--strict, '.'] + always_run: true + pass_filenames: false + - repo: https://github.com/warpnet/salt-lint + rev: v0.8.0 + hooks: + - id: salt-lint + name: Check Salt files using salt-lint + files: ^.*\.(sls|jinja|j2|tmpl|tst)$ + - repo: local + hooks: + - id: slsdoc + name: Dump state documentation with slsdoc + entry: ./bin/slsdoc + language: system + require_serial: true + always_run: true + pass_filenames: false + - repo: https://github.com/myint/rstcheck + rev: 3f929574 + hooks: + - id: rstcheck + name: Check reST files using rstcheck + exclude: 'docs/CHANGELOG.rst' + additional_dependencies: [sphinx==4.3.0] + - repo: https://github.com/saltstack-formulas/mirrors-rst-lint + rev: v1.3.2 + hooks: + - id: rst-lint + name: Check reST files using rst-lint + exclude: | + (?x)^( + docs/CHANGELOG.rst| + docs/TOFS_pattern.rst| + docs/CONTRIBUTING_DOCS.rst| + docs/index.rst| + docs/pillar.rst| + )$ + additional_dependencies: [pygments==2.9.0] diff --git a/.rstcheck.cfg b/.rstcheck.cfg new file mode 100644 index 0000000..5383623 --- /dev/null +++ b/.rstcheck.cfg @@ -0,0 +1,4 @@ +[rstcheck] +report=info +ignore_language=rst +ignore_messages=(Duplicate (ex|im)plicit target.*|Hyperlink target ".*" is not referenced\.$) diff --git a/.rubocop.yml b/.rubocop.yml new file mode 100644 index 0000000..bf4d107 --- /dev/null +++ b/.rubocop.yml @@ -0,0 +1,23 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +# General overrides used across formulas in the org +Layout/LineLength: + # Increase from default of `80` + # Based on https://github.com/PyCQA/flake8-bugbear#opinionated-warnings (`B950`) + Max: 88 +Metrics/BlockLength: + IgnoredMethods: + - control + - describe + # Increase from default of `25` + Max: 30 +Security/YAMLLoad: + Exclude: + - test/integration/**/_mapdata.rb + +# General settings across all cops in this formula +AllCops: + NewCops: enable + +# Any offenses that should be fixed, e.g. collected via. `rubocop --auto-gen-config` diff --git a/.salt-lint b/.salt-lint new file mode 100644 index 0000000..3715677 --- /dev/null +++ b/.salt-lint @@ -0,0 +1,14 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +exclude_paths: [] +rules: {} +skip_list: + # Using `salt-lint` for linting other files as well, such as Jinja macros/templates + - 205 # Use ".sls" as a Salt State file extension + # Skipping `207` and `208` because `210` is sufficient, at least for the time-being + # I.e. Allows 3-digit unquoted codes to still be used, such as `644` and `755` + - 207 # File modes should always be encapsulated in quotation marks + - 208 # File modes should always contain a leading zero +tags: [] +verbosity: 1 diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..e6cea07 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,192 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +################################################################################ +# NOTE: This file is UNMAINTAINED; it is provided for references purposes only. +# No guarantees are tendered that this structure will work after 2020. +################################################################################ +# * https://en.wikipedia.org/wiki/Travis_CI: +# - "... free open-source plans were removed in [sic] the end of 2020" +# - https://blog.travis-ci.com/2020-11-02-travis-ci-new-billing +# - https://ropensci.org/technotes/2020/11/19/moving-away-travis/ +################################################################################ +## Machine config +os: 'linux' +arch: 'amd64' +dist: 'bionic' +version: '~> 1.0' + +## Language and cache config +language: 'ruby' +cache: 'bundler' + +## Services config +services: + - docker + +## Script to run for the test stage +script: + - bin/kitchen verify "${INSTANCE}" + +## Stages and jobs matrix +stages: + - test + # # As part of the switch away from Travis CI, ensure that the `release` stage + # # is not run inadvertently + # - name: 'release' + # if: 'branch = master AND type != pull_request' +jobs: + include: + ## Define the test stage that runs the linters (and testing matrix, if applicable) + + # Run all of the linters in a single job + - language: 'node_js' + node_js: 'lts/*' + env: 'Lint' + name: 'Lint: salt-lint, yamllint, rubocop, shellcheck & commitlint' + before_install: 'skip' + script: + # Install and run `salt-lint` + - pip install --user salt-lint + - git ls-files -- '*.sls' '*.jinja' '*.j2' '*.tmpl' '*.tst' + | xargs salt-lint + # Install and run `yamllint` + # Need at least `v1.17.0` for the `yaml-files` setting + - pip install --user yamllint>=1.17.0 + - yamllint -s . + # Install and run `rubocop` + - gem install rubocop + - rubocop -d + # Run `shellcheck` (already pre-installed in Travis) + - shellcheck --version + - git ls-files -- '*.sh' '*.bash' '*.ksh' + | xargs shellcheck + # Install and run `commitlint` + - npm i -D @commitlint/config-conventional + @commitlint/travis-cli + - commitlint-travis + + # Run `pre-commit` linters in a single job + - language: 'python' + env: 'Lint_pre-commit' + name: 'Lint: pre-commit' + before_install: 'skip' + cache: + directories: + - $HOME/.cache/pre-commit + script: + # Install and run `pre-commit` + - pip install pre-commit==2.7.1 + - pre-commit run --all-files --color always --verbose + - pre-commit run --color always --hook-stage manual --verbose commitlint-travis + + ## Define the rest of the matrix based on Kitchen testing + # Make sure the instances listed below match up with + # the `platforms` defined in `kitchen.yml` + # NOTE: Please try to select up to six instances that add some meaningful + # testing of the formula's behaviour. If possible, try to refrain from + # the classical "chosing all the instances because I want to test on + # another/all distro/s" trap: it will just add time to the testing (see + # the discussion on #121). As an example, the set chosen below covers + # the most used distros families, systemd and non-systemd and the latest + # three supported Saltstack versions with python2 and 3. + # As for `kitchen.yml`, that should still contain all of the platforms, + # to allow for comprehensive local testing + # Ref: https://github.com/saltstack-formulas/template-formula/issues/118 + # Ref: https://github.com/saltstack-formulas/template-formula/issues/121 + # - env: INSTANCE=default-debian-11-tiamat-py3 + # - env: INSTANCE=default-debian-10-tiamat-py3 + # - env: INSTANCE=default-debian-9-tiamat-py3 + # - env: INSTANCE=default-ubuntu-2004-tiamat-py3 + # - env: INSTANCE=default-ubuntu-1804-tiamat-py3 + # - env: INSTANCE=default-centos-stream8-tiamat-py3 + # - env: INSTANCE=default-centos-7-tiamat-py3 + # - env: INSTANCE=default-amazonlinux-2-tiamat-py3 + # - env: INSTANCE=default-oraclelinux-8-tiamat-py3 + # - env: INSTANCE=default-oraclelinux-7-tiamat-py3 + # - env: INSTANCE=default-almalinux-8-tiamat-py3 + # - env: INSTANCE=default-rockylinux-8-tiamat-py3 + - env: INSTANCE=default-debian-11-master-py3 + - env: INSTANCE=default-debian-10-master-py3 + - env: INSTANCE=default-debian-9-master-py3 + - env: INSTANCE=default-ubuntu-2004-master-py3 + - env: INSTANCE=default-ubuntu-1804-master-py3 + - env: INSTANCE=default-centos-stream8-master-py3 + - env: INSTANCE=default-centos-7-master-py3 + - env: INSTANCE=default-fedora-36-master-py3 + - env: INSTANCE=default-fedora-35-master-py3 + - env: INSTANCE=default-fedora-34-master-py3 + - env: INSTANCE=default-opensuse-leap-153-master-py3 + - env: INSTANCE=default-opensuse-tmbl-latest-master-py3 + - env: INSTANCE=default-amazonlinux-2-master-py3 + - env: INSTANCE=default-oraclelinux-8-master-py3 + - env: INSTANCE=default-oraclelinux-7-master-py3 + - env: INSTANCE=default-arch-base-latest-master-py3 + - env: INSTANCE=default-gentoo-stage3-latest-master-py3 + - env: INSTANCE=default-gentoo-stage3-systemd-master-py3 + - env: INSTANCE=default-almalinux-8-master-py3 + - env: INSTANCE=default-rockylinux-8-master-py3 + # - env: INSTANCE=default-debian-11-3004-1-py3 + # - env: INSTANCE=default-debian-10-3004-1-py3 + # - env: INSTANCE=default-debian-9-3004-1-py3 + # - env: INSTANCE=default-ubuntu-2004-3004-1-py3 + # - env: INSTANCE=default-ubuntu-1804-3004-1-py3 + # - env: INSTANCE=default-centos-stream8-3004-1-py3 + # - env: INSTANCE=default-centos-7-3004-1-py3 + # - env: INSTANCE=default-fedora-36-3004-1-py3 + # - env: INSTANCE=default-fedora-35-3004-1-py3 + # - env: INSTANCE=default-fedora-34-3004-1-py3 + # - env: INSTANCE=default-amazonlinux-2-3004-1-py3 + # - env: INSTANCE=default-oraclelinux-8-3004-1-py3 + # - env: INSTANCE=default-oraclelinux-7-3004-1-py3 + # - env: INSTANCE=default-arch-base-latest-3004-1-py3 + # - env: INSTANCE=default-gentoo-stage3-latest-3004-1-py3 + # - env: INSTANCE=default-gentoo-stage3-systemd-3004-1-py3 + # - env: INSTANCE=default-almalinux-8-3004-1-py3 + # - env: INSTANCE=default-rockylinux-8-3004-1-py3 + # - env: INSTANCE=default-opensuse-leap-153-3004-0-py3 + # - env: INSTANCE=default-opensuse-tmbl-latest-3004-0-py3 + # - env: INSTANCE=default-debian-10-3003-4-py3 + # - env: INSTANCE=default-debian-9-3003-4-py3 + # - env: INSTANCE=default-ubuntu-2004-3003-4-py3 + # - env: INSTANCE=default-ubuntu-1804-3003-4-py3 + # - env: INSTANCE=default-centos-stream8-3003-4-py3 + # - env: INSTANCE=default-centos-7-3003-4-py3 + # - env: INSTANCE=default-amazonlinux-2-3003-4-py3 + # - env: INSTANCE=default-oraclelinux-8-3003-4-py3 + # - env: INSTANCE=default-oraclelinux-7-3003-4-py3 + # - env: INSTANCE=default-almalinux-8-3003-4-py3 + # - env: INSTANCE=default-debian-10-3002-8-py3 + # - env: INSTANCE=default-debian-9-3002-8-py3 + # - env: INSTANCE=default-ubuntu-2004-3002-8-py3 + # - env: INSTANCE=default-ubuntu-1804-3002-8-py3 + # - env: INSTANCE=default-centos-7-3002-8-py3 + # - env: INSTANCE=default-amazonlinux-2-3002-8-py3 + # - env: INSTANCE=default-oraclelinux-8-3002-8-py3 + # - env: INSTANCE=default-oraclelinux-7-3002-8-py3 + + ## Define the release stage that runs `semantic-release` + - stage: 'release' + language: 'node_js' + node_js: 'lts/*' + env: 'Release' + name: 'Run semantic-release inc. file updates to AUTHORS, CHANGELOG & FORMULA' + before_install: 'skip' + script: + # Update `AUTHORS.md` + - export MAINTAINER_TOKEN=${GH_TOKEN} + - go get github.com/myii/maintainer + - maintainer contributor + + # Install all dependencies required for `semantic-release` + - npm i -D @semantic-release/changelog@3 + @semantic-release/exec@3 + @semantic-release/git@7 + deploy: + provider: 'script' + # Opt-in to `dpl v2` to complete the Travis build config validation (beta) + # * https://docs.travis-ci.com/user/build-config-validation + # Deprecated `skip_cleanup` can now be avoided, `cleanup: false` is by default + edge: true + # Run `semantic-release` + script: 'npx semantic-release@15.14' diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..716baaf --- /dev/null +++ b/.yamllint @@ -0,0 +1,44 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +# Extend the `default` configuration provided by `yamllint` +extends: 'default' + +# Files to ignore completely +# 1. All YAML files under directory `.bundle/`, introduced if gems are installed locally +# 2. All YAML files under directory `.cache/`, introduced during the CI run +# 3. All YAML files under directory `.git/` +# 4. All YAML files under directory `node_modules/`, introduced during the CI run +# 5. Any SLS files under directory `test/`, which are actually state files +# 6. Any YAML files under directory `.kitchen/`, introduced during local testing +# 7. `kitchen.vagrant.yml`, which contains Embedded Ruby (ERB) template syntax +ignore: | + .bundle/ + .cache/ + .git/ + node_modules/ + test/**/states/**/*.sls + .kitchen/ + kitchen.vagrant.yml + +yaml-files: + # Default settings + - '*.yaml' + - '*.yml' + - .salt-lint + - .yamllint + # SaltStack Formulas additional settings + - '*.example' + - test/**/*.sls + +rules: + empty-values: + forbid-in-block-mappings: true + forbid-in-flow-mappings: true + line-length: + # Increase from default of `80` + # Based on https://github.com/PyCQA/flake8-bugbear#opinionated-warnings (`B950`) + max: 88 + octal-values: + forbid-implicit-octal: true + forbid-explicit-octal: true diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000..981cdd0 --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1,53 @@ +# https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners + +# SECTION: Owner(s) for everything in the repo, unless a later match takes precedence +# FILE PATTERN OWNER(S) +* @lkubb + +# SECTION: Owner(s) for specific directories +# FILE PATTERN OWNER(S) + +# SECTION: Owner(s) for files/directories related to `semantic-release` +# FILE PATTERN OWNER(S) +/.github/workflows/ @saltstack-formulas/ssf +/bin/install-hooks @saltstack-formulas/ssf +/bin/kitchen @saltstack-formulas/ssf +/docs/AUTHORS.rst @saltstack-formulas/ssf +/docs/CHANGELOG.rst @saltstack-formulas/ssf +/docs/TOFS_pattern.rst @saltstack-formulas/ssf +/*/_mapdata/ @saltstack-formulas/ssf +/*/libmapstack.jinja @saltstack-formulas/ssf +/*/libmatchers.jinja @saltstack-formulas/ssf +/*/libsaltcli.jinja @saltstack-formulas/ssf +/*/libtofs.jinja @saltstack-formulas/ssf +/*/map.jinja @saltstack-formulas/ssf +/test/integration/**/_mapdata.rb @saltstack-formulas/ssf +/test/integration/**/libraries/system.rb @saltstack-formulas/ssf +/test/integration/**/inspec.yml @saltstack-formulas/ssf +/test/integration/**/README.md @saltstack-formulas/ssf +/test/salt/pillar/top.sls @saltstack-formulas/ssf +/.gitignore @saltstack-formulas/ssf +/.cirrus.yml @saltstack-formulas/ssf +/.gitlab-ci.yml @saltstack-formulas/ssf +/.pre-commit-config.yaml @saltstack-formulas/ssf +/.rstcheck.cfg @saltstack-formulas/ssf +/.rubocop.yml @saltstack-formulas/ssf +/.salt-lint @saltstack-formulas/ssf +/.travis.yml @saltstack-formulas/ssf +/.yamllint @saltstack-formulas/ssf +/AUTHORS.md @saltstack-formulas/ssf +/CHANGELOG.md @saltstack-formulas/ssf +/CODEOWNERS @saltstack-formulas/ssf +/commitlint.config.js @saltstack-formulas/ssf +/FORMULA @saltstack-formulas/ssf +/Gemfile @saltstack-formulas/ssf +/Gemfile.lock @saltstack-formulas/ssf +/kitchen.yml @saltstack-formulas/ssf +/kitchen.vagrant.yml @saltstack-formulas/ssf +/kitchen.windows.yml @saltstack-formulas/ssf +/pre-commit_semantic-release.sh @saltstack-formulas/ssf +/release-rules.js @saltstack-formulas/ssf +/release.config.js @saltstack-formulas/ssf + +# SECTION: Owner(s) for specific files +# FILE PATTERN OWNER(S) diff --git a/FORMULA b/FORMULA new file mode 100644 index 0000000..fd07de8 --- /dev/null +++ b/FORMULA @@ -0,0 +1,9 @@ +name: gitea +os: Debian, Ubuntu, Raspbian, RedHat, Fedora, CentOS, Amazon, Oracle, Suse, openSUSE, Gentoo, Funtoo, Arch, Manjaro, Alpine, FreeBSD, OpenBSD, Solaris, SmartOS, Windows, MacOS +os_family: Debian, RedHat, Suse, Gentoo, Arch, Alpine, FreeBSD, OpenBSD, Solaris, Windows, MacOS +version: 1.0.0 +release: 1 +minimum_version: 2019.2 +summary: Gitea formula +description: Manage Gitea with Salt +top_level_dir: gitea diff --git a/Gemfile b/Gemfile new file mode 100644 index 0000000..5991260 --- /dev/null +++ b/Gemfile @@ -0,0 +1,19 @@ +# frozen_string_literal: true + +source ENV['PROXY_RUBYGEMSORG'] || 'https://rubygems.org' + +# Install the `inspec` gem using `git` because versions after `4.22.22` +# suppress diff output; this version fixes this for our uses. +# rubocop:disable Layout/LineLength +gem 'inspec', git: 'https://gitlab.com/saltstack-formulas/infrastructure/inspec', branch: 'ssf' +# rubocop:enable Layout/LineLength + +# Install the `kitchen-docker` gem using `git` in order to gain a performance +# improvement: avoid package installations which are already covered by the +# `salt-image-builder` (i.e. the pre-salted images that we're using) +# rubocop:disable Layout/LineLength +gem 'kitchen-docker', git: 'https://gitlab.com/saltstack-formulas/infrastructure/kitchen-docker', branch: 'ssf' +# rubocop:enable Layout/LineLength + +gem 'kitchen-inspec', '>= 2.5.0' +gem 'kitchen-salt', '>= 0.7.2' diff --git a/Gemfile.lock b/Gemfile.lock new file mode 100644 index 0000000..2dcf0f9 --- /dev/null +++ b/Gemfile.lock @@ -0,0 +1,675 @@ +GIT + remote: https://gitlab.com/saltstack-formulas/infrastructure/inspec + revision: 1821d2dfd3365e8f05b8439845c58fa4d069806b + branch: ssf + specs: + inspec (5.12.2) + cookstyle + faraday_middleware (>= 0.12.2, < 1.1) + inspec-core (= 5.12.2) + mongo (= 2.13.2) + progress_bar (~> 1.3.3) + rake + train (~> 3.0) + train-aws (~> 0.2) + train-habitat (~> 0.1) + train-winrm (~> 0.2) + inspec-core (5.12.2) + addressable (~> 2.4) + chef-telemetry (~> 1.0, >= 1.0.8) + faraday (>= 0.9.0, < 1.5) + faraday_middleware (~> 1.0) + hashie (>= 3.4, < 5.0) + license-acceptance (>= 0.2.13, < 3.0) + method_source (>= 0.8, < 2.0) + mixlib-log (~> 3.0) + multipart-post (~> 2.0) + parallel (~> 1.9) + parslet (>= 1.5, < 2.0) + pry (~> 0.13) + rspec (>= 3.9, <= 3.11) + rspec-its (~> 1.2) + rubyzip (>= 1.2.2, < 3.0) + semverse (~> 3.0) + sslshake (~> 1.2) + thor (>= 0.20, < 2.0) + tomlrb (>= 1.2, < 2.1) + train-core (~> 3.0) + tty-prompt (~> 0.17) + tty-table (~> 0.10) + +GIT + remote: https://gitlab.com/saltstack-formulas/infrastructure/kitchen-docker + revision: 9a09bc1e571e25f3ccabf4725ca2048d970fff82 + branch: ssf + specs: + kitchen-docker (2.12.0) + test-kitchen (>= 1.0.0) + +GEM + remote: https://rubygems.org/ + specs: + activesupport (7.0.2.3) + concurrent-ruby (~> 1.0, >= 1.0.2) + i18n (>= 1.6, < 2) + minitest (>= 5.1) + tzinfo (~> 2.0) + addressable (2.8.0) + public_suffix (>= 2.0.2, < 5.0) + ast (2.4.2) + aws-eventstream (1.2.0) + aws-partitions (1.577.0) + aws-sdk-alexaforbusiness (1.56.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-amplify (1.32.0) + aws-sdk-core (~> 3, >= 3.120.0) + aws-sigv4 (~> 1.1) + aws-sdk-apigateway (1.76.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-apigatewayv2 (1.42.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-applicationautoscaling (1.51.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-athena (1.53.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-autoscaling (1.63.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-batch (1.47.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-budgets (1.49.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudformation (1.68.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudfront (1.63.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudhsm (1.39.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudhsmv2 (1.42.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudtrail (1.48.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudwatch (1.64.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudwatchevents (1.46.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-cloudwatchlogs (1.52.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-codecommit (1.51.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-codedeploy (1.49.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-codepipeline (1.53.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-cognitoidentity (1.31.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-cognitoidentityprovider (1.53.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-configservice (1.77.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-core (3.130.1) + aws-eventstream (~> 1, >= 1.0.2) + aws-partitions (~> 1, >= 1.525.0) + aws-sigv4 (~> 1.1) + jmespath (~> 1.0) + aws-sdk-costandusagereportservice (1.40.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-databasemigrationservice (1.53.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-dynamodb (1.74.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-ec2 (1.307.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-ecr (1.56.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-ecrpublic (1.12.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-ecs (1.99.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-efs (1.54.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-eks (1.74.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-elasticache (1.76.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-elasticbeanstalk (1.51.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-elasticloadbalancing (1.40.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-elasticloadbalancingv2 (1.77.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-elasticsearchservice (1.65.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-emr (1.53.0) + aws-sdk-core (~> 3, >= 3.121.2) + aws-sigv4 (~> 1.1) + aws-sdk-eventbridge (1.24.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-firehose (1.48.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-glue (1.88.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-guardduty (1.56.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-iam (1.68.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-kafka (1.49.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-kinesis (1.41.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-kms (1.55.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-lambda (1.83.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-mq (1.40.0) + aws-sdk-core (~> 3, >= 3.120.0) + aws-sigv4 (~> 1.1) + aws-sdk-networkfirewall (1.15.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-networkmanager (1.22.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-organizations (1.59.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-ram (1.26.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-rds (1.143.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-redshift (1.80.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-route53 (1.62.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-route53domains (1.40.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-route53resolver (1.37.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-s3 (1.113.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sdk-kms (~> 1) + aws-sigv4 (~> 1.4) + aws-sdk-s3control (1.43.0) + aws-sdk-core (~> 3, >= 3.122.0) + aws-sigv4 (~> 1.1) + aws-sdk-secretsmanager (1.46.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-securityhub (1.63.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-servicecatalog (1.60.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-ses (1.41.0) + aws-sdk-core (~> 3, >= 3.120.0) + aws-sigv4 (~> 1.1) + aws-sdk-shield (1.48.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-signer (1.32.0) + aws-sdk-core (~> 3, >= 3.120.0) + aws-sigv4 (~> 1.1) + aws-sdk-simpledb (1.29.0) + aws-sdk-core (~> 3, >= 3.120.0) + aws-sigv2 (~> 1.0) + aws-sdk-sms (1.40.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-sns (1.53.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-sqs (1.51.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-ssm (1.134.0) + aws-sdk-core (~> 3, >= 3.127.0) + aws-sigv4 (~> 1.1) + aws-sdk-states (1.39.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-synthetics (1.19.0) + aws-sdk-core (~> 3, >= 3.121.2) + aws-sigv4 (~> 1.1) + aws-sdk-transfer (1.34.0) + aws-sdk-core (~> 3, >= 3.112.0) + aws-sigv4 (~> 1.1) + aws-sdk-waf (1.43.0) + aws-sdk-core (~> 3, >= 3.122.0) + aws-sigv4 (~> 1.1) + aws-sigv2 (1.1.0) + aws-sigv4 (1.4.0) + aws-eventstream (~> 1, >= 1.0.2) + azure_graph_rbac (0.17.2) + ms_rest_azure (~> 0.12.0) + azure_mgmt_key_vault (0.17.7) + ms_rest_azure (~> 0.12.0) + azure_mgmt_resources (0.18.2) + ms_rest_azure (~> 0.12.0) + azure_mgmt_security (0.19.0) + ms_rest_azure (~> 0.12.0) + azure_mgmt_storage (0.23.0) + ms_rest_azure (~> 0.12.0) + bcrypt_pbkdf (1.1.0) + bson (4.14.1) + builder (3.2.4) + chef-config (17.10.0) + addressable + chef-utils (= 17.10.0) + fuzzyurl + mixlib-config (>= 2.2.12, < 4.0) + mixlib-shellout (>= 2.0, < 4.0) + tomlrb (~> 1.2) + chef-telemetry (1.1.1) + chef-config + concurrent-ruby (~> 1.0) + chef-utils (17.10.0) + concurrent-ruby + coderay (1.1.3) + concurrent-ruby (1.1.10) + cookstyle (7.32.1) + rubocop (= 1.25.1) + declarative (0.0.20) + diff-lcs (1.5.0) + docker-api (2.2.0) + excon (>= 0.47.0) + multi_json + domain_name (0.5.20190701) + unf (>= 0.0.5, < 1.0.0) + ed25519 (1.3.0) + erubi (1.10.0) + excon (0.92.2) + faraday (1.4.3) + faraday-em_http (~> 1.0) + faraday-em_synchrony (~> 1.0) + faraday-excon (~> 1.1) + faraday-net_http (~> 1.0) + faraday-net_http_persistent (~> 1.1) + multipart-post (>= 1.2, < 3) + ruby2_keywords (>= 0.0.4) + faraday-cookie_jar (0.0.7) + faraday (>= 0.8.0) + http-cookie (~> 1.0.0) + faraday-em_http (1.0.0) + faraday-em_synchrony (1.0.0) + faraday-excon (1.1.0) + faraday-net_http (1.0.1) + faraday-net_http_persistent (1.2.0) + faraday_middleware (1.0.0) + faraday (~> 1.0) + ffi (1.15.5) + fuzzyurl (0.9.0) + google-api-client (0.52.0) + addressable (~> 2.5, >= 2.5.1) + googleauth (~> 0.9) + httpclient (>= 2.8.1, < 3.0) + mini_mime (~> 1.0) + representable (~> 3.0) + retriable (>= 2.0, < 4.0) + rexml + signet (~> 0.12) + googleauth (0.14.0) + faraday (>= 0.17.3, < 2.0) + jwt (>= 1.4, < 3.0) + memoist (~> 0.16) + multi_json (~> 1.11) + os (>= 0.9, < 2.0) + signet (~> 0.14) + gssapi (1.3.1) + ffi (>= 1.0.1) + gyoku (1.4.0) + builder (>= 2.1.2) + rexml (~> 3.0) + hashie (4.1.0) + highline (2.0.3) + http-cookie (1.0.4) + domain_name (~> 0.5) + httpclient (2.8.3) + i18n (1.10.0) + concurrent-ruby (~> 1.0) + inifile (3.0.0) + jmespath (1.6.1) + json (2.6.1) + jwt (2.3.0) + kitchen-inspec (2.5.2) + hashie (>= 3.4, <= 5.0) + inspec (>= 2.2.64, < 6.0) + test-kitchen (>= 2.7, < 4) + kitchen-salt (0.7.2) + hashie (>= 3.5) + test-kitchen (>= 1.4) + license-acceptance (2.1.13) + pastel (~> 0.7) + tomlrb (>= 1.2, < 3.0) + tty-box (~> 0.6) + tty-prompt (~> 0.20) + little-plugger (1.1.4) + logging (2.3.0) + little-plugger (~> 1.1) + multi_json (~> 1.14) + memoist (0.16.2) + method_source (1.0.0) + mini_mime (1.1.2) + minitest (5.15.0) + mixlib-config (3.0.9) + tomlrb + mixlib-install (3.12.16) + mixlib-shellout + mixlib-versioning + thor + mixlib-log (3.0.9) + mixlib-shellout (3.2.7) + chef-utils + mixlib-versioning (1.2.12) + mongo (2.13.2) + bson (>= 4.8.2, < 5.0.0) + ms_rest (0.7.6) + concurrent-ruby (~> 1.0) + faraday (>= 0.9, < 2.0.0) + timeliness (~> 0.3.10) + ms_rest_azure (0.12.0) + concurrent-ruby (~> 1.0) + faraday (>= 0.9, < 2.0.0) + faraday-cookie_jar (~> 0.0.6) + ms_rest (~> 0.7.6) + multi_json (1.15.0) + multipart-post (2.1.1) + net-scp (3.0.0) + net-ssh (>= 2.6.5, < 7.0.0) + net-ssh (6.1.0) + net-ssh-gateway (2.0.0) + net-ssh (>= 4.0.0) + nori (2.6.0) + options (2.3.2) + os (1.1.4) + parallel (1.22.1) + parser (3.1.2.0) + ast (~> 2.4.1) + parslet (1.8.2) + pastel (0.8.0) + tty-color (~> 0.5) + progress_bar (1.3.3) + highline (>= 1.6, < 3) + options (~> 2.3.0) + pry (0.14.1) + coderay (~> 1.1) + method_source (~> 1.0) + public_suffix (4.0.7) + rainbow (3.1.1) + rake (13.0.6) + regexp_parser (2.3.0) + representable (3.1.1) + declarative (< 0.1.0) + trailblazer-option (>= 0.1.1, < 0.2.0) + uber (< 0.2.0) + retriable (3.1.2) + rexml (3.2.5) + rspec (3.11.0) + rspec-core (~> 3.11.0) + rspec-expectations (~> 3.11.0) + rspec-mocks (~> 3.11.0) + rspec-core (3.11.0) + rspec-support (~> 3.11.0) + rspec-expectations (3.11.0) + diff-lcs (>= 1.2.0, < 2.0) + rspec-support (~> 3.11.0) + rspec-its (1.3.0) + rspec-core (>= 3.0.0) + rspec-expectations (>= 3.0.0) + rspec-mocks (3.11.1) + diff-lcs (>= 1.2.0, < 2.0) + rspec-support (~> 3.11.0) + rspec-support (3.11.0) + rubocop (1.25.1) + parallel (~> 1.10) + parser (>= 3.1.0.0) + rainbow (>= 2.2.2, < 4.0) + regexp_parser (>= 1.8, < 3.0) + rexml + rubocop-ast (>= 1.15.1, < 2.0) + ruby-progressbar (~> 1.7) + unicode-display_width (>= 1.4.0, < 3.0) + rubocop-ast (1.17.0) + parser (>= 3.1.1.0) + ruby-progressbar (1.11.0) + ruby2_keywords (0.0.5) + rubyntlm (0.6.3) + rubyzip (2.3.2) + semverse (3.0.0) + signet (0.16.1) + addressable (~> 2.8) + faraday (>= 0.17.5, < 3.0) + jwt (>= 1.5, < 3.0) + multi_json (~> 1.10) + sslshake (1.3.1) + strings (0.2.1) + strings-ansi (~> 0.2) + unicode-display_width (>= 1.5, < 3.0) + unicode_utils (~> 1.4) + strings-ansi (0.2.0) + test-kitchen (3.2.2) + bcrypt_pbkdf (~> 1.0) + chef-utils (>= 16.4.35) + ed25519 (~> 1.2) + license-acceptance (>= 1.0.11, < 3.0) + mixlib-install (~> 3.6) + mixlib-shellout (>= 1.2, < 4.0) + net-scp (>= 1.1, < 4.0) + net-ssh (>= 2.9, < 7.0) + net-ssh-gateway (>= 1.2, < 3.0) + thor (>= 0.19, < 2.0) + winrm (~> 2.0) + winrm-elevated (~> 1.0) + winrm-fs (~> 1.1) + thor (1.2.1) + timeliness (0.3.10) + tomlrb (1.3.0) + trailblazer-option (0.1.2) + train (3.9.2) + activesupport (>= 6.0.3.1) + azure_graph_rbac (~> 0.16) + azure_mgmt_key_vault (~> 0.17) + azure_mgmt_resources (~> 0.15) + azure_mgmt_security (~> 0.18) + azure_mgmt_storage (~> 0.18) + docker-api (>= 1.26, < 3.0) + google-api-client (>= 0.23.9, <= 0.52.0) + googleauth (>= 0.6.6, <= 0.14.0) + inifile (~> 3.0) + train-core (= 3.9.2) + train-winrm (~> 0.2) + train-aws (0.2.24) + aws-sdk-alexaforbusiness (~> 1.0) + aws-sdk-amplify (~> 1.32.0) + aws-sdk-apigateway (~> 1.0) + aws-sdk-apigatewayv2 (~> 1.0) + aws-sdk-applicationautoscaling (>= 1.46, < 1.52) + aws-sdk-athena (~> 1.0) + aws-sdk-autoscaling (>= 1.22, < 1.64) + aws-sdk-batch (>= 1.36, < 1.48) + aws-sdk-budgets (~> 1.0) + aws-sdk-cloudformation (~> 1.0) + aws-sdk-cloudfront (~> 1.0) + aws-sdk-cloudhsm (~> 1.0) + aws-sdk-cloudhsmv2 (~> 1.0) + aws-sdk-cloudtrail (~> 1.8) + aws-sdk-cloudwatch (~> 1.13) + aws-sdk-cloudwatchevents (>= 1.36, < 1.47) + aws-sdk-cloudwatchlogs (~> 1.13) + aws-sdk-codecommit (~> 1.0) + aws-sdk-codedeploy (~> 1.0) + aws-sdk-codepipeline (~> 1.0) + aws-sdk-cognitoidentity (>= 1.26, < 1.32) + aws-sdk-cognitoidentityprovider (>= 1.46, < 1.54) + aws-sdk-configservice (~> 1.21) + aws-sdk-core (~> 3.0) + aws-sdk-costandusagereportservice (~> 1.6) + aws-sdk-databasemigrationservice (>= 1.42, < 1.54) + aws-sdk-dynamodb (~> 1.31) + aws-sdk-ec2 (~> 1.70) + aws-sdk-ecr (~> 1.18) + aws-sdk-ecrpublic (~> 1.3) + aws-sdk-ecs (~> 1.30) + aws-sdk-efs (~> 1.0) + aws-sdk-eks (~> 1.9) + aws-sdk-elasticache (~> 1.0) + aws-sdk-elasticbeanstalk (~> 1.0) + aws-sdk-elasticloadbalancing (~> 1.8) + aws-sdk-elasticloadbalancingv2 (~> 1.0) + aws-sdk-elasticsearchservice (~> 1.0) + aws-sdk-emr (~> 1.53.0) + aws-sdk-eventbridge (~> 1.24.0) + aws-sdk-firehose (~> 1.0) + aws-sdk-glue (>= 1.71, < 1.89) + aws-sdk-guardduty (~> 1.31) + aws-sdk-iam (~> 1.13) + aws-sdk-kafka (~> 1.0) + aws-sdk-kinesis (~> 1.0) + aws-sdk-kms (~> 1.13) + aws-sdk-lambda (~> 1.0) + aws-sdk-mq (~> 1.40.0) + aws-sdk-networkfirewall (>= 1.6.0) + aws-sdk-networkmanager (>= 1.13.0) + aws-sdk-organizations (>= 1.17, < 1.60) + aws-sdk-ram (>= 1.21, < 1.27) + aws-sdk-rds (~> 1.43) + aws-sdk-redshift (~> 1.0) + aws-sdk-route53 (~> 1.0) + aws-sdk-route53domains (~> 1.0) + aws-sdk-route53resolver (~> 1.0) + aws-sdk-s3 (~> 1.30) + aws-sdk-s3control (~> 1.43.0) + aws-sdk-secretsmanager (>= 1.42, < 1.47) + aws-sdk-securityhub (~> 1.0) + aws-sdk-servicecatalog (>= 1.48, < 1.61) + aws-sdk-ses (~> 1.41.0) + aws-sdk-shield (~> 1.30) + aws-sdk-signer (~> 1.32.0) + aws-sdk-simpledb (~> 1.29.0) + aws-sdk-sms (~> 1.0) + aws-sdk-sns (~> 1.9) + aws-sdk-sqs (~> 1.10) + aws-sdk-ssm (~> 1.0) + aws-sdk-states (>= 1.35, < 1.40) + aws-sdk-synthetics (~> 1.19.0) + aws-sdk-transfer (>= 1.26, < 1.35) + aws-sdk-waf (~> 1.43.0) + train-core (3.9.2) + addressable (~> 2.5) + ffi (!= 1.13.0) + json (>= 1.8, < 3.0) + mixlib-shellout (>= 2.0, < 4.0) + net-scp (>= 1.2, < 4.0) + net-ssh (>= 2.9, < 7.0) + train-habitat (0.2.22) + train-winrm (0.2.13) + winrm (>= 2.3.6, < 3.0) + winrm-elevated (~> 1.2.2) + winrm-fs (~> 1.0) + tty-box (0.7.0) + pastel (~> 0.8) + strings (~> 0.2.0) + tty-cursor (~> 0.7) + tty-color (0.6.0) + tty-cursor (0.7.1) + tty-prompt (0.23.1) + pastel (~> 0.8) + tty-reader (~> 0.8) + tty-reader (0.9.0) + tty-cursor (~> 0.7) + tty-screen (~> 0.8) + wisper (~> 2.0) + tty-screen (0.8.1) + tty-table (0.12.0) + pastel (~> 0.8) + strings (~> 0.2.0) + tty-screen (~> 0.8) + tzinfo (2.0.4) + concurrent-ruby (~> 1.0) + uber (0.1.0) + unf (0.1.4) + unf_ext + unf_ext (0.0.8.1) + unicode-display_width (2.1.0) + unicode_utils (1.4.0) + winrm (2.3.6) + builder (>= 2.1.2) + erubi (~> 1.8) + gssapi (~> 1.2) + gyoku (~> 1.0) + httpclient (~> 2.2, >= 2.2.0.2) + logging (>= 1.6.1, < 3.0) + nori (~> 2.0) + rubyntlm (~> 0.6.0, >= 0.6.3) + winrm-elevated (1.2.3) + erubi (~> 1.8) + winrm (~> 2.0) + winrm-fs (~> 1.0) + winrm-fs (1.3.5) + erubi (~> 1.8) + logging (>= 1.6.1, < 3.0) + rubyzip (~> 2.0) + winrm (~> 2.0) + wisper (2.0.1) + +PLATFORMS + ruby + +DEPENDENCIES + inspec! + kitchen-docker! + kitchen-inspec (>= 2.5.0) + kitchen-salt (>= 0.7.2) + +BUNDLED WITH + 2.1.2 diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..3e21c72 --- /dev/null +++ b/LICENSE @@ -0,0 +1,13 @@ + Copyright (c) 2014 Salt Stack Formulas + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/bin/install-hooks b/bin/install-hooks new file mode 100755 index 0000000..840bb6c --- /dev/null +++ b/bin/install-hooks @@ -0,0 +1,16 @@ +#!/usr/bin/env sh +set -o nounset # Treat unset variables as an error and immediately exit +set -o errexit # If a command fails exit the whole script + +if [ "${DEBUG:-false}" = "true" ]; then + set -x # Run the entire script in debug mode +fi + +if ! command -v pre-commit >/dev/null 2>&1; then + echo "pre-commit not found: please install or check your PATH" >&2 + echo "See https://pre-commit.com/#installation" >&2 + exit 1 +fi + +pre-commit install --install-hooks +pre-commit install --hook-type commit-msg --install-hooks diff --git a/bin/kitchen b/bin/kitchen new file mode 100755 index 0000000..dcfdb4c --- /dev/null +++ b/bin/kitchen @@ -0,0 +1,32 @@ +#!/usr/bin/env ruby +# frozen_string_literal: true + +# +# This file was generated by Bundler. +# +# The application 'kitchen' is installed as part of a gem, and +# this file is here to facilitate running it. +# + +require 'pathname' +ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', + Pathname.new(__FILE__).realpath) + +bundle_binstub = File.expand_path('bundle', __dir__) + +if File.file?(bundle_binstub) + if File.read(bundle_binstub, 300) =~ /This file was generated by Bundler/ + load(bundle_binstub) + else + abort( + 'Your `bin/bundle` was not generated by Bundler, '\ + 'so this binstub cannot run. Replace `bin/bundle` by running '\ + '`bundle binstubs bundler --force`, then run this command again.' + ) + end +end + +require 'rubygems' +require 'bundler/setup' + +load Gem.bin_path('test-kitchen', 'kitchen') diff --git a/bin/slsdoc b/bin/slsdoc new file mode 100755 index 0000000..e63e7fa --- /dev/null +++ b/bin/slsdoc @@ -0,0 +1,571 @@ +#!/usr/bin/env python3 + +""" +This script renders Jinja comments found at the beginning +of `.sls` files. + +Since this was written for the salt tool suite, +it should be placed in a sibling directory +of a directory named tool_ containing +the actual states to be able autodiscover them. + +Of course, it can be used by other formulae by manually +providing the root path and I might publish this at some +point as a python module or at least in a separate repo +to be used by pre-commit. It would need to be configurable +without editing the source code for that. @TODO +""" + +from pathlib import Path + +from jinja2 import Environment +from jinja2.exceptions import TemplateSyntaxError + +# import sphinx.util.docstrings as d + +base_dir = Path(__file__).parent.parent.absolute() + + +class State: + """ + Object representing a documented state. + """ + + def __init__(self, path, comment): + self.path = path + self.comment = comment + + def tostateid(self, include_init=True, relative_to=""): + ret = self.path.with_suffix("") + + if not include_init and "init" == ret.parts[-1]: + ret = ret.parent + + if relative_to: + relative_to = Path(relative_to.replace(".", "/")) + ret = ret.relative_to(relative_to) + + return str(ret).replace("/", ".") + + def isinit(self): + return "init.sls" == self.path.parts[-1] + + def isclean(self): + return "clean.sls" == self.path.parts[-1] + + +class StateRegistry: + """ + Registers State objects. It generates several indices: + + 1. nested dictionary containing the states + 2. flattened list of states + 3. flattened list of prefixes ~ directories containing .sls files + + All of them are guaranteed to be sorted, which is required + by some of the downstream classes. + """ + + def __init__(self, reg=None, states=None, prefixes=None): + if reg is None: + reg = {} + if states is None: + states = [] + if prefixes is None: + prefixes = [] + self.reg = reg + self.states = states + self.prefixes = prefixes + + def lookup(self, state, tree=False): + """ + Looks up State objects by ID ('some.example' or ['some', 'example']). + If tree, also returns pointers to dicts inside the nested registry. + """ + ptr = self.reg + if isinstance(state, str): + state = state.split(".") + + try: + while state: + cur = state.pop(0) + ptr = ptr[cur] + except KeyError: + return False + + if isinstance(ptr, State) or tree: + return ptr + # map init.sls same way as salt does + elif "init" in ptr: + return ptr["init"] + + raise ValueError("State could not be found.") + + def register(self, state): + state_id = state.tostateid() + self.states.append(state_id) + + parts = state_id.split(".") + + ptr = self.reg + prefix = "" + + while len(parts) > 1: + cur = parts.pop(0) + prefix = (prefix + "." + cur) if prefix else cur + # make sure subdicts are initialized + if cur not in ptr: + ptr[cur] = {} + self.prefixes.append(prefix) + ptr = ptr[cur] + + ptr[parts.pop(0)] = state + + self.prefixes.sort() + self.states.sort() + + def unregister(self, state): + state_id = state.tostateid() + self.states.remove(state_id) + + if state_id.find("."): + path, key = state_id.rsplit(".", maxsplit=1) + parent = self.lookup(path, tree=True) + else: + parent = self.reg + key = state_id + + del parent[key] + + def depth(self, prefix=""): + """ + Returns depth of nested dict. Optionally from a specified prefix. + """ + d = self.lookup(prefix, tree=True) if prefix else self.reg + return self._get_depth(d) + + def _get_depth(self, d): + """ + Recursively look up depth. + """ + if isinstance(d, dict) and set(d.keys()) - {"init", "clean"}: + return 1 + (max(map(self._get_depth, d.values())) if d else 0) + return 0 + + def count(self): + return len(self.states) + + def dump(self, prefix=""): + """ + Returns all states sorted alphabetically, optionally + from a prefix onwards. + """ + for s in self.states: + if not prefix or s.startswith(prefix): + yield self.lookup(s) + + +class Renderer: + """ + Base class for Renderer objects. + """ + + opts = {} + + def __init__(self, target="docs", opts=None): + if opts is not None: + self.opts = self.opts | opts + + if isinstance(target, str): + target = Path(target) + self.target = base_dir / target + + self._ensurepath(self.target) + + def render(self, states): + raise NotImplementedError() + + def _write(self, text, ncount=1): + """ + Convenience method to mimic writeln + This is bad form though, implicitly requires + self.f to be set before being called + """ + if not hasattr(self, "f"): + raise ValueError( + "Sorry, you need to set self.f to a file pointer before calling self._write methods." + ) + self.f.write(text + "\n" * ncount) + + def _write_heading(self, text, uline="-"): + """ + Convenience method to write a subheading + """ + self._write(text) + self._write(uline * len(text)) + + def _write_main_heading(self, text, uline="="): + """ + Convenience method to write the main heading + """ + self.f.write(text + "\n") + self.f.write(uline * len(text) + "\n\n") + + def _write_main_description(self, text): + """ + Convenience method to write the main description + """ + self.f.write(text + "\n\n") + + def _get_main_heading(self, states): + """ + Returns a string to be used as the main heading of an + rst file. Looks up in the following order: + 1. If there is a documented root init.sls, return its first line. + 2. If a header was specified in opts, return that. + 3. If this renderer was instantiated with a prefix, return the + capitalized last part of it. + 4. "Available States" + """ + if main := states.lookup(self.prefix + ".init"): + lines = main.comment.splitlines() + header = lines.pop(0) + # make sure the header does not get printed twice + main.comment = "\n".join(lines).strip("\n") + return header + if main := self.opts.get("header"): + return main + if self.prefix: + return self.prefix.split(".")[-1].title() + return "Available States" + + def _get_main_description(self, states): + """ + Returns a string to be used as the main description (after the main header). + Looks up in the following order: + 1. If there is a documented root init.sls, return everything but its first line. + If it was found, unregister it to not render it twice (bad form again, maybe consider was_rendered on State) + 2. If a description was specified in opts, return that. + 3. general description + """ + if main := states.lookup(self.prefix + ".init"): + comment = main.comment + # make sure the comment does not get printed twice + states.unregister(main) + return comment + if main := self.opts.get("description"): + return main + return "The following states are found in {}:".format( + self.prefix if self.prefix else "this formula" + ) + + def _write_header(self, states): + """ + Convenience method to write the main heading and description. + """ + self._write_main_heading(self._get_main_heading(states)) + self._write_main_description(self._get_main_description(states)) + self.f.write("\n") + + def _ensurepath(self, path): + """ + Convenience method to mimic mkdir -p on the parent dir of a path + """ + if not path.parent.is_dir(): + path.parent.mkdir(parents=True) + + +class SingleRenderer(Renderer): + """ + Renders documented Salt states in a single file. When a prefix + is specified, it only considers states nested inside that prefix. + + If there is a documented top-layer init.sls, the first line of + its comment will become the main heading of the file, the stripped + rest will be rendered directly below before any nested states. + """ + + opts = { + # include init.sls files + "init": True, + # include .init suffix + "init_suffix": False, + # include clean.sls files + "clean": False, + # when rendering with prefix `settings.something`, + # write `else` instead of `settings.something.else` + "cut_prefix": False, + } + + def __init__(self, target="docs/states.rst", prefix="", opts=None): + self.prefix = prefix + + if isinstance(target, str): + target = Path(target) + + target = target.with_suffix(".rst") + super().__init__(target, self.opts | opts or {}) + + def render(self, states): + relative_to = self.prefix if self.opts["cut_prefix"] else "" + + with open(self.target, "w") as f: + self.f = f + + self._write_header(states) + + for state in states.dump(self.prefix): + if not self.opts["clean"] and state.isclean(): + continue + if not self.opts["init"] and state.isinit(): + continue + self._write_heading( + state.tostateid(self.opts["init_suffix"], relative_to) + ) + self._write(state.comment, 3) + + +class DepthRenderer(Renderer): + """ + Renders documented Salt states in separate files. They are combined + according to the maximum nesting depth specified during instantiation. + + Consider an example with max_depth=1. + + This directory structure: + settings + ├── animations + │ ├── cursor_blinking + │ └── window_resize_time + └── apps + └── messages + └── read_receipts + + will result in these files: + * docs/settings/index.rst + - animations + - apps/index + * docs/settings/animations.rst + - cursor_blinking doc + - window_resize_time doc + * docs/settings/apps/index.rst + - messages + * docs/settings/apps/messages.rst + - read_receipts doc + """ + + opts = { + # maxdepth for generated index.rst files + "index_maxdepth": 4, + # also any options are passed through to the + # delegate renderer, by default SingleRenderer + } + + def __init__(self, max_depth=1, target="docs/states", delegate_cls=None, opts=None): + if delegate_cls is None: + delegate_cls = SingleRenderer + + self.max_depth = max_depth + self.delegate = delegate_cls + + super().__init__(target, self.opts | opts or {}) + + def render(self, states): + found = [] + indices = {} + cur_top = "" + + # find at which prefix length the maxdepth is fulfilled + for prefix in states.prefixes: + # filtering out more specific = shallower dicts + # this requires the list to be sorted! + if cur_top: + if prefix.startswith(cur_top): + continue + else: + cur_top = "" + if states.depth(prefix) <= self.max_depth: + found.append(prefix) + cur_top = prefix + + # fill indices with relative links to + # a) other indices if there are nested prefixes + # b) the rendered files at that depth + # example: settings.one settings.two.[subone, subtwo] => + # { settings: {'_index': ['one', 'two/index'], + # 'two': {'_index': [subone, subtwo]}}, + # '_index': 'settings/index'} + + for prefix in found: + ptr = indices + prefix = prefix.split(".") + + while prefix: + cur = prefix.pop(0) + if prefix and cur not in ptr: + ptr[cur] = {} + if "_index" not in ptr: + ptr["_index"] = [] + if prefix and cur + "/index" not in ptr["_index"]: + ptr["_index"].append(cur + "/index") + elif not prefix and cur not in ptr["_index"]: + ptr["_index"].append(cur) + if prefix: + ptr = ptr[cur] + + if "_index" in indices: + self._render_index(states, indices) + + for prefix in found: + self._render_single(states, prefix) + + def _render_single(self, states, prefix): + target = self._get_target(prefix) + renderer = self.delegate(target=target, prefix=prefix, opts=self.opts) + renderer.render(states) + + def _render_index(self, states, indices, prefix=""): + target = self._get_target(prefix) / Path("index.rst") + self._ensurepath(target) + with open(target, "w") as f: + self.f = f + self.prefix = prefix + self._write_header(states) + self.prefix = "" + f.write( + """ +.. toctree:: + :maxdepth: {} + :caption: Contents: + +""".format( + self.opts.get("index_maxdepth", 4) + ) + ) + for s in indices["_index"]: + f.write(" " + s + "\n") + for sub in indices: + if "_index" == sub: + continue + if "_index" in indices[sub]: + new_prefix = prefix + "." + sub if prefix else sub + self._render_index(states, indices[sub], new_prefix) + + def _get_target(self, prefix): + target_prefix = Path(prefix.replace(".", "/")) + target = self.target / target_prefix + self._ensurepath(target) + return target + + +class SaltAutodoc: + """ + Looks for salt state files (*.sls) relative to base, + reads them and looks for the first token being a Jinja + comment. If the comment does not start with the string + '@internal', it will be saved in the registry. + + The registry is then passed to the renderer. + """ + + SKIP_FILE = "@internal" + + def __init__(self, base=None, renderer=None, registry=None, env=None): + """ + base: base path containing Salt states to autodocument + renderer: renderer to use for rendering + """ + if base is None: + base = list(base_dir.glob("tool_*"))[0] + self.base = base + if renderer is None: + renderer = SingleRenderer() + self.renderer = renderer + if env is None: + env = Environment() + self.env = env + if registry is None: + registry = StateRegistry() + self.registry = registry + + def run(self, src=""): + """ + 1. look for .sls files + 2. lex them with Jinja and see if the first token is a comment + 3. in that case, save it to the registry + 4. pass the registry to the renderer + """ + states = {} + + for file in self.glob(src): + with open(file, "r") as f: + text = "".join(f.readlines()) + try: + comment = self.find_comment(text) + except TemplateSyntaxError as e: + raise RuntimeError( + "There was an error parsing the Jinja syntax in file '{}':\n\n{}".format( + file, str(e) + ) + ) + + if comment and not comment.startswith(self.SKIP_FILE): + path = self.path2saltpath(file) + self.registry.register(State(path, comment)) + + self.renderer.render(self.registry) + + def path2saltpath(self, path): + """ + Returns a Path object relative to the base directory. + """ + return path.relative_to(self.base) + + def glob(self, src): + """ + Returns Path objects pointing to Salt states provided by this formula. + """ + for path in (self.base / Path(src)).rglob("*.sls"): + yield path + + def find_comment(self, text): + """ + Lexes files with Jinja. If the first token is a comment, return it. + """ + lexed = list(self.env.lex(text)) + try: + i, t, content = lexed[1] + except IndexError: + i = t = content = "" + + if "comment" == t: + return self.parse(content) + + return "" + + def parse(self, comment): + """ + Strips indentation from [multiline] strings. Could have used + docutils.prepare_docstring. + """ + # return d.prepare_docstring(comment) + ws = min([len(x) - len(x.lstrip()) for x in comment.splitlines() if len(x) > 0]) + return "\n".join([x[ws:] for x in comment.splitlines()]).strip("\n") + + +if __name__ == "__main__": + options = { + "init": True, + "init_suffix": False, + "clean": False, + "cut_prefix": False, + "index_maxdepth": 4, + } + + # by default, + # - render all documented states to a single file + # - skip clean.sls descriptions + # - do not include .init suffix on state ID + r = SingleRenderer(target="docs/states.rst", opts=options) + a = SaltAutodoc(base=base_dir / "gitea", renderer=r) + a.run() diff --git a/commitlint.config.js b/commitlint.config.js new file mode 100644 index 0000000..4eb37f4 --- /dev/null +++ b/commitlint.config.js @@ -0,0 +1,8 @@ +module.exports = { + extends: ['@commitlint/config-conventional'], + rules: { + 'body-max-line-length': [2, 'always', 120], + 'footer-max-line-length': [2, 'always', 120], + 'header-max-length': [2, 'always', 72], + }, +}; diff --git a/docs/Makefile b/docs/Makefile new file mode 100644 index 0000000..d4bb2cb --- /dev/null +++ b/docs/Makefile @@ -0,0 +1,20 @@ +# Minimal makefile for Sphinx documentation +# + +# You can set these variables from the command line, and also +# from the environment for the first two. +SPHINXOPTS ?= +SPHINXBUILD ?= sphinx-build +SOURCEDIR = . +BUILDDIR = _build + +# Put it first so that "make" without argument is like "make help". +help: + @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) + +.PHONY: help Makefile + +# Catch-all target: route all unknown targets to Sphinx using the new +# "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS). +%: Makefile + @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) diff --git a/docs/README.rst b/docs/README.rst new file mode 100644 index 0000000..7f81321 --- /dev/null +++ b/docs/README.rst @@ -0,0 +1,188 @@ +.. _readme: + +Gitea Formula +============= + +|img_sr| |img_pc| + +.. |img_sr| image:: https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg + :alt: Semantic Release + :scale: 100% + :target: https://github.com/semantic-release/semantic-release +.. |img_pc| image:: https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white + :alt: pre-commit + :scale: 100% + :target: https://github.com/pre-commit/pre-commit + +Manage Gitea with Salt. + +.. contents:: **Table of Contents** + :depth: 1 + +General notes +------------- + +See the full `SaltStack Formulas installation and usage instructions +`_. + +If you are interested in writing or contributing to formulas, please pay attention to the `Writing Formula Section +`_. + +If you want to use this formula, please pay attention to the ``FORMULA`` file and/or ``git tag``, +which contains the currently released version. This formula is versioned according to `Semantic Versioning `_. + +See `Formula Versioning Section `_ for more details. + +If you need (non-default) configuration, please refer to: + +- `how to configure the formula with map.jinja `_ +- the ``pillar.example`` file +- the `Special notes`_ section + +Special notes +------------- +* This installs from the `official binary source `_. +* The formula is currently Linux/systemd-centric. It should be relatively easy to provide the correct parameters and service file for other platforms though. +* Since the formula skips the web installer, you will need to provide at least the database configuration. +* You can optionally specify the secrets, but they can be autogenerated by Salt as well. In that case, they will be saved in a grain value. +* Secrets and database config will be written to the global config file, the rest into ``custom/conf/app.ini``. +* All the paths are modifiable, find them in ``lookup:paths``. You should not need to set the corresponding values in your config, they are added automatically. +* If Gitea requires mounts for some of the paths, you can specify them in ``service:requires_mount`` as a list. +* If Gitea requires a local service unit (e.g. database server), specify it/them in ``service:wants`` as a list. + +Configuration +------------- +An example pillar is provided, please see `pillar.example`. Note that you do not need to specify everything by pillar. Often, it's much easier and less resource-heavy to use the ``parameters//.yaml`` files for non-sensitive settings. The underlying logic is explained in `map.jinja`. + +Available states +---------------- + +.. contents:: + :local: + +``gitea`` +^^^^^^^^^ + +*Meta-state (This is a state that includes other states)*. + +This installs the gitea package, +manages the gitea configuration file and then +starts the associated gitea service. + +``gitea.package`` +^^^^^^^^^^^^^^^^^ + +This state will install the gitea package only. + +``gitea.config`` +^^^^^^^^^^^^^^^^ + +This state will configure the gitea service and has a dependency on ``gitea.install`` +via include list. + +``gitea.service`` +^^^^^^^^^^^^^^^^^ + +This state will start the gitea service and has a dependency on ``gitea.config`` +via include list. + +``gitea.clean`` +^^^^^^^^^^^^^^^ + +*Meta-state (This is a state that includes other states)*. + +This state will undo everything performed in the ``gitea`` meta-state in reverse order, i.e. +stops the service, +removes the configuration file and +then uninstalls the package. Some paths are left to avoid accidental data loss (namely ``GITEA_WORKDIR``, ``APP_DATA_PATH`` and the gitea user home). + +``gitea.service.clean`` +^^^^^^^^^^^^^^^^^^^^^^^ + +This state will stop the gitea service and disable it at boot time. + +``gitea.config.clean`` +^^^^^^^^^^^^^^^^^^^^^^ + +This state will remove the configuration of the gitea service and has a +dependency on ``gitea.service.clean`` via include list. + +``gitea.package.clean`` +^^^^^^^^^^^^^^^^^^^^^^^ + +This state will remove the gitea package and has a depency on +``gitea.config.clean`` via include list. + +Contributing to this repo +------------------------- + +Commit messages +^^^^^^^^^^^^^^^ + +**Commit message formatting is significant!** + +Please see `How to contribute `_ for more details. + +pre-commit +^^^^^^^^^^ + +`pre-commit `_ is configured for this formula, which you may optionally use to ease the steps involved in submitting your changes. +First install the ``pre-commit`` package manager using the appropriate `method `_, then run ``bin/install-hooks`` and +now ``pre-commit`` will run automatically on each ``git commit``. :: + + $ bin/install-hooks + pre-commit installed at .git/hooks/pre-commit + pre-commit installed at .git/hooks/commit-msg + +State documentation +~~~~~~~~~~~~~~~~~~~ +There is a script that semi-autodocuments available states: ``bin/slsdoc``. + +If a ``.sls`` file begins with a Jinja comment, it will dump that into the docs. It can be configured differently depending on the formula. See the script source code for details currently. + +This means if you feel a state should be documented, make sure to write a comment explaining it. + +Testing +------- + +Linux testing is done with ``kitchen-salt``. + +Requirements +^^^^^^^^^^^^ + +* Ruby +* Docker + +.. code-block:: bash + + $ gem install bundler + $ bundle install + $ bin/kitchen test [platform] + +Where ``[platform]`` is the platform name defined in ``kitchen.yml``, +e.g. ``debian-9-2019-2-py3``. + +``bin/kitchen converge`` +^^^^^^^^^^^^^^^^^^^^^^^^ + +Creates the docker instance and runs the ``gitea`` main state, ready for testing. + +``bin/kitchen verify`` +^^^^^^^^^^^^^^^^^^^^^^ + +Runs the ``inspec`` tests on the actual instance. + +``bin/kitchen destroy`` +^^^^^^^^^^^^^^^^^^^^^^^ + +Removes the docker instance. + +``bin/kitchen test`` +^^^^^^^^^^^^^^^^^^^^ + +Runs all of the stages above in one go: i.e. ``destroy`` + ``converge`` + ``verify`` + ``destroy``. + +``bin/kitchen login`` +^^^^^^^^^^^^^^^^^^^^^ + +Gives you SSH access to the instance for manual testing. diff --git a/docs/TOFS_pattern.rst b/docs/TOFS_pattern.rst new file mode 100644 index 0000000..dd2c17e --- /dev/null +++ b/docs/TOFS_pattern.rst @@ -0,0 +1,518 @@ +.. _tofs_pattern: + +TOFS: A pattern for using SaltStack +=================================== + +.. list-table:: + :name: tofs-authors + :header-rows: 1 + :stub-columns: 1 + :widths: 2,2,3,2 + + * - + - Person + - Contact + - Date + * - Authored by + - Roberto Moreda + - moreda@allenta.com + - 29/12/2014 + * - Modified by + - Daniel Dehennin + - daniel.dehennin@baby-gnu.org + - 07/02/2019 + * - Modified by + - Imran Iqbal + - https://github.com/myii + - 23/02/2019 + +All that follows is a proposal based on my experience with `SaltStack `_. The good thing of a piece of software like this is that you can "bend it" to suit your needs in many possible ways, and this is one of them. All the recommendations and thoughts are given "as it is" with no warranty of any type. + +.. contents:: **Table of Contents** + +Usage of values in pillar vs templates in ``file_roots`` +-------------------------------------------------------- + +Among other functions, the *master* (or *salt-master*) serves files to the *minions* (or *salt-minions*). The `file_roots `_ is the list of directories used in sequence to find a file when a minion requires it: the first match is served to the minion. Those files could be `state files `_ or configuration templates, among others. + +Using SaltStack is a simple and effective way to implement configuration management, but even in a `non-multitenant `_ scenario, it is not a good idea to generally access some data (e.g. the database password in our `Zabbix `_ server configuration file or the private key of our `Nginx `_ TLS certificate). + +To avoid this situation we can use the `pillar mechanism `_, which is designed to provide controlled access to data from the minions based on some selection rules. As pillar data could be easily integrated in the `Jinja `_ templates, it is a good mechanism to store values to be used in the final rendering of state files and templates. + +There are a variety of approaches on the usage of pillar and templates as seen in the `saltstack-formulas `_' repositories. `Some `_ `developments `_ stress the initial purpose of pillar data into a storage for most of the possible variables for a determined system configuration. This, in my opinion, is shifting too much load from the original template files approach. Adding up some `non-trivial Jinja `_ code as essential part of composing the state file definitely makes SaltStack state files (hence formulas) more difficult to read. The extreme of this approach is that we could end up with a new render mechanism, implemented in Jinja, storing everything needed in pillar data to compose configurations. Additionally, we are establishing a strong dependency with the Jinja renderer. + +In opposition to the *put the code in file_roots and the data in pillars* approach, there is the *pillar as a store for a set of key-values* approach. A full-blown configuration file abstracted in pillar and jinja is complicated to develop, understand and maintain. I think a better and simpler approach is to keep a configuration file templated using just a basic (non-extensive but extensible) set of pillar values. + +On the reusability of SaltStack state files +------------------------------------------- + +There is a brilliant initiative of the SaltStack community called `salt-formulas `_. Their goal is to provide state files, pillar examples and configuration templates ready to be used for provisioning. I am a contributor for two small ones: `zabbix-formula `_ and `varnish-formula `_. + +The `design guidelines `_ for formulas are clear in many aspects and it is a recommended reading for anyone willing to write state files, even non-formulaic ones. + +In the next section, I am going to describe my proposal to extend further the reusability of formulas, suggesting some patterns of usage. + +The Template Override and Files Switch (TOFS) pattern +----------------------------------------------------- + +I understand a formula as a **complete, independent set of SaltStack state and configuration template files sufficient to configure a system**. A system could be something as simple as an NTP server or some other much more complex service that requires many state and configuration template files. + +The customization of a formula should be done mainly by providing pillar data used later to render either the state or the configuration template files. + +Example: NTP before applying TOFS +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Let's work with the NTP example. A basic formula that follows the `design guidelines `_ has the following files and directories tree: + +.. code-block:: console + + /srv/saltstack/salt-formulas/ntp-saltstack-formula/ + ntp/ + map.jinja + init.sls + conf.sls + files/ + default/ + etc/ + ntp.conf.jinja + +In order to use it, let's assume a `masterless configuration `_ and this relevant section of ``/etc/salt/minion``: + +.. code-block:: yaml + + pillar_roots: + base: + - /srv/saltstack/pillar + file_client: local + file_roots: + base: + - /srv/saltstack/salt + - /srv/saltstack/salt-formulas/ntp-saltstack-formula + +.. code-block:: jinja + + {#- /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/map.jinja #} + {%- set ntp = salt['grains.filter_by']({ + 'default': { + 'pkg': 'ntp', + 'service': 'ntp', + 'config': '/etc/ntp.conf', + }, + }, merge=salt['pillar.get']('ntp:lookup')) %} + +In ``init.sls`` we have the minimal states required to have NTP configured. In many cases ``init.sls`` is almost equivalent to an ``apt-get install`` or a ``yum install`` of the package. + +.. code-block:: sls + + ## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/init.sls + {%- from 'ntp/map.jinja' import ntp with context %} + + Install NTP: + pkg.installed: + - name: {{ ntp.pkg }} + + Enable and start NTP: + service.running: + - name: {{ ntp.service }} + - enabled: True + - require: + - pkg: Install NTP package + +In ``conf.sls`` we have the configuration states. In most cases, that is just managing configuration file templates and making them to be watched by the service. + +.. code-block:: sls + + ## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls + include: + - ntp + + {%- from 'ntp/map.jinja' import ntp with context %} + + Configure NTP: + file.managed: + - name: {{ ntp.config }} + - template: jinja + - source: salt://ntp/files/default/etc/ntp.conf.jinja + - watch_in: + - service: Enable and start NTP service + - require: + - pkg: Install NTP package + +Under ``files/default``, there is a structure that mimics the one in the minion in order to avoid clashes and confusion on where to put the needed templates. There you can find a mostly standard template for the configuration file. + +.. code-block:: jinja + + {#- /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/files/default/etc/ntp.conf.jinja #} + {#- Managed by saltstack #} + {#- Edit pillars or override this template in saltstack if you need customization #} + {%- set settings = salt['pillar.get']('ntp', {}) %} + {%- set default_servers = ['0.ubuntu.pool.ntp.org', + '1.ubuntu.pool.ntp.org', + '2.ubuntu.pool.ntp.org', + '3.ubuntu.pool.ntp.org'] %} + + driftfile /var/lib/ntp/ntp.drift + statistics loopstats peerstats clockstats + filegen loopstats file loopstats type day enable + filegen peerstats file peerstats type day enable + filegen clockstats file clockstats type day enable + + {%- for server in settings.get('servers', default_servers) %} + server {{ server }} + {%- endfor %} + + restrict -4 default kod notrap nomodify nopeer noquery + restrict -6 default kod notrap nomodify nopeer noquery + + restrict 127.0.0.1 + restrict ::1 + +With all this, it is easy to install and configure a simple NTP server by just running ``salt-call state.sls ntp.conf``: the package will be installed, the service will be running and the configuration should be correct for most of cases, even without pillar data. + +Alternatively, you can define a highstate in ``/srv/saltstack/salt/top.sls`` and run ``salt-call state.highstate``. + +.. code-block:: sls + + ## /srv/saltstack/salt/top.sls + base: + '*': + - ntp.conf + +**Customizing the formula just with pillar data**, we have the option to define the NTP servers. + +.. code-block:: sls + + ## /srv/saltstack/pillar/top.sls + base: + '*': + - ntp + +.. code-block:: sls + + ## /srv/saltstack/pillar/ntp.sls + ntp: + servers: + - 0.ch.pool.ntp.org + - 1.ch.pool.ntp.org + - 2.ch.pool.ntp.org + - 3.ch.pool.ntp.org + +Template Override +^^^^^^^^^^^^^^^^^ + +If the customization based on pillar data is not enough, we can override the template by creating a new one in ``/srv/saltstack/salt/ntp/files/default/etc/ntp.conf.jinja`` + +.. code-block:: jinja + + {#- /srv/saltstack/salt/ntp/files/default/etc/ntp.conf.jinja #} + {#- Managed by saltstack #} + {#- Edit pillars or override this template in saltstack if you need customization #} + + {#- Some bizarre configurations here #} + {#- ... #} + + {%- for server in settings.get('servers', default_servers) %} + server {{ server }} + {%- endfor %} + +This way we are locally **overriding the template files** offered by the formula in order to make a more complex adaptation. Of course, this could be applied as well to any of the files, including the state files. + +Files Switch +^^^^^^^^^^^^ + +To bring some order into the set of template files included in a formula, as we commented, we suggest having a similar structure to a normal final file system under ``files/default``. + +We can make different templates coexist for different minions, classified by any `grain `_ value, by simply creating new directories under ``files``. This mechanism is based on **using values of some grains as a switch for the directories under** ``files/``. + +If we decide that we want ``os_family`` as switch, then we could provide the formula template variants for both the ``RedHat`` and ``Debian`` families. + +.. code-block:: console + + /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/files/ + default/ + etc/ + ntp.conf.jinja + RedHat/ + etc/ + ntp.conf.jinja + Debian/ + etc/ + ntp.conf.jinja + +To make this work we need a ``conf.sls`` state file that takes a list of possible files as the configuration template. + +.. code-block:: sls + + ## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls + include: + - ntp + + {%- from 'ntp/map.jinja' import ntp with context %} + + Configure NTP: + file.managed: + - name: {{ ntp.config }} + - template: jinja + - source: + - salt://ntp/files/{{ grains.get('os_family', 'default') }}/etc/ntp.conf.jinja + - salt://ntp/files/default/etc/ntp.conf.jinja + - watch_in: + - service: Enable and start NTP service + - require: + - pkg: Install NTP package + +If we want to cover the possibility of a special template for a minion identified by ``node01`` then we could have a specific template in ``/srv/saltstack/salt/ntp/files/node01/etc/ntp.conf.jinja``. + +.. code-block:: jinja + + {#- /srv/saltstack/salt/ntp/files/node01/etc/ntp.conf.jinja #} + {#- Managed by saltstack #} + {#- Edit pillars or override this template in saltstack if you need customization #} + + {#- Some crazy configurations here for node01 #} + {#- ... #} + +To make this work we could write a specially crafted ``conf.sls``. + +.. code-block:: sls + + ## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls + include: + - ntp + + {%- from 'ntp/map.jinja' import ntp with context %} + + Configure NTP: + file.managed: + - name: {{ ntp.config }} + - template: jinja + - source: + - salt://ntp/files/{{ grains.get('id') }}/etc/ntp.conf.jinja + - salt://ntp/files/{{ grains.get('os_family') }}/etc/ntp.conf.jinja + - salt://ntp/files/default/etc/ntp.conf.jinja + - watch_in: + - service: Enable and start NTP service + - require: + - pkg: Install NTP package + +Using the ``files_switch`` macro +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +We can simplify the ``conf.sls`` with the new ``files_switch`` macro to use in the ``source`` parameter for the ``file.managed`` state. + +.. code-block:: sls + + ## /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/conf.sls + include: + - ntp + + {%- set tplroot = tpldir.split('/')[0] %} + {%- from 'ntp/map.jinja' import ntp with context %} + {%- from 'ntp/libtofs.jinja' import files_switch %} + + Configure NTP: + file.managed: + - name: {{ ntp.config }} + - template: jinja + - source: {{ files_switch(['/etc/ntp.conf.jinja'], + lookup='Configure NTP' + ) + }} + - watch_in: + - service: Enable and start NTP service + - require: + - pkg: Install NTP package + + +* This uses ``config.get``, searching for ``ntp:tofs:source_files:Configure NTP`` to determine the list of template files to use. +* If this returns a result, the default of ``['/etc/ntp.conf.jinja']`` will be appended to it. +* If this does not yield any results, the default of ``['/etc/ntp.conf.jinja']`` will be used. + +In ``libtofs.jinja``, we define this new macro ``files_switch``. + +.. literalinclude:: ../template/libtofs.jinja + :caption: /srv/saltstack/salt-formulas/ntp-saltstack-formula/ntp/libtofs.jinja + :language: jinja + +How to customise the ``source`` further +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The examples below are based on an ``Ubuntu`` minion called ``theminion`` being configured via. pillar. + +Using the default settings of the ``files_switch`` macro above, +the ``source`` will be: + +.. code-block:: sls + + - source: + - salt://ntp/files/theminion/etc/ntp.conf.jinja + - salt://ntp/files/Debian/etc/ntp.conf.jinja + - salt://ntp/files/default/etc/ntp.conf.jinja + +Customise ``files`` +~~~~~~~~~~~~~~~~~~~ + +The ``files`` portion can be customised: + +.. code-block:: sls + + ntp: + tofs: + dirs: + files: files_alt + +Resulting in: + +.. code-block:: sls + + - source: + - salt://ntp/files_alt/theminion/etc/ntp.conf.jinja + - salt://ntp/files_alt/Debian/etc/ntp.conf.jinja + - salt://ntp/files_alt/default/etc/ntp.conf.jinja + +Customise the use of grains +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Grains can be customised and even arbitrary paths can be supplied: + +.. code-block:: sls + + ntp: + tofs: + files_switch: + - any/path/can/be/used/here + - id + - os + - os_family + +Resulting in: + +.. code-block:: sls + + - source: + - salt://ntp/files/any/path/can/be/used/here/etc/ntp.conf.jinja + - salt://ntp/files/theminion/etc/ntp.conf.jinja + - salt://ntp/files/Ubuntu/etc/ntp.conf.jinja + - salt://ntp/files/Debian/etc/ntp.conf.jinja + - salt://ntp/files/default/etc/ntp.conf.jinja + +Customise the ``default`` path +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The ``default`` portion of the path can be customised: + +.. code-block:: sls + + ntp: + tofs: + dirs: + default: default_alt + +Resulting in: + +.. code-block:: sls + + - source: + ... + - salt://ntp/files/default_alt/etc/ntp.conf.jinja + +Customise the list of ``source_files`` +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The list of ``source_files`` can be given: + +.. code-block:: sls + + ntp: + tofs: + source_files: + Configure NTP: + - '/etc/ntp.conf_alt.jinja' + +Resulting in: + +.. code-block:: sls + + - source: + - salt://ntp/files/theminion/etc/ntp.conf_alt.jinja + - salt://ntp/files/theminion/etc/ntp.conf.jinja + - salt://ntp/files/Debian/etc/ntp.conf_alt.jinja + - salt://ntp/files/Debian/etc/ntp.conf.jinja + - salt://ntp/files/default/etc/ntp.conf_alt.jinja + - salt://ntp/files/default/etc/ntp.conf.jinja + +Note: This does *not* override the default value. +Rather, the value from the pillar/config is prepended to the default. + +Using sub-directories for ``components`` +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +If your formula is composed of several components, you may prefer to provides files under sub-directories, like in the `systemd-formula `_. + +.. code-block:: console + + /srv/saltstack/systemd-formula/ + systemd/ + init.sls + libtofs.jinja + map.jinja + networkd/ + init.sls + files/ + default/ + network/ + 99-default.link + resolved/ + init.sls + files/ + default/ + resolved.conf + timesyncd/ + init.sls + files/ + Arch/ + resolved.conf + Debian/ + resolved.conf + default/ + resolved.conf + Ubuntu/ + resolved.conf + +For example, the following ``formula.component.config`` SLS: + +.. code-block:: sls + + {%- from "formula/libtofs.jinja" import files_switch with context %} + + formula configuration file: + file.managed: + - name: /etc/formula.conf + - user: root + - group: root + - mode: 644 + - template: jinja + - source: {{ files_switch(['formula.conf'], + lookup='formula', + use_subpath=True + ) + }} + +will be rendered on a ``Debian`` minion named ``salt-formula.ci.local`` as: + +.. code-block:: sls + + formula configuration file: + file.managed: + - name: /etc/formula.conf + - user: root + - group: root + - mode: 644 + - template: jinja + - source: + - salt://formula/component/files/salt-formula.ci.local/formula.conf + - salt://formula/component/files/Debian/formula.conf + - salt://formula/component/files/default/formula.conf + - salt://formula/files/salt-formula.ci.local/formula.conf + - salt://formula/files/Debian/formula.conf + - salt://formula/files/default/formula.conf diff --git a/docs/conf.py b/docs/conf.py new file mode 100644 index 0000000..82e368f --- /dev/null +++ b/docs/conf.py @@ -0,0 +1,78 @@ +# Configuration file for the Sphinx documentation builder. +# +# This file only contains a selection of the most common options. For a full +# list see the documentation: +# https://www.sphinx-doc.org/en/master/usage/configuration.html +import os +import sys +# import sphinx_rtd_theme +# import sphinx-material-saltstack # official Salt Sphinx theme + +# -- Path setup -------------------------------------------------------------- + +# If extensions (or modules to document with autodoc) are in another directory, +# add these directories to sys.path here. If the directory is relative to the +# documentation root, use os.path.abspath to make it absolute, like shown here. +# +# import os +# import sys +# sys.path.insert(0, os.path.abspath('.')) + +sys.path.insert(0, os.path.abspath('..')) + +# -- Project information ----------------------------------------------------- + +project = 'gitea-formula' +copyright = '2022, lkubb' +author = 'lkubb' + +# The full version, including alpha/beta/rc tags +release = '1.0.0' + + +# -- General configuration --------------------------------------------------- + +# Add any Sphinx extension module names here, as strings. They can be +# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom +# ones. +extensions = [ + 'sphinx.ext.autosummary', + 'sphinx.ext.viewcode', + # 'sphinxcontrib.fulltoc', +] + +# Add any paths that contain templates here, relative to this directory. +templates_path = ['_templates'] + +# List of patterns, relative to source directory, that match files and +# directories to ignore when looking for source files. +# This pattern also affects html_static_path and html_extra_path. +exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store'] + + +# -- Options for HTML output ------------------------------------------------- + +# The theme to use for HTML and HTML Help pages. See the documentation for +# a list of builtin themes. +# +# html_theme = 'sphinx_rtd_theme' + +# Add any paths that contain custom static files (such as style sheets) here, +# relative to this directory. They are copied after the builtin static files, +# so a file named "default.css" will overwrite the builtin "default.css". +html_static_path = ['_static'] + +html_theme_options = { + # 'logo_only': False, + # 'display_version': True, + # 'prev_next_buttons_location': 'bottom', + # 'style_external_links': False, + # 'vcs_pageview_mode': '', + # 'style_nav_header_background': 'white', + # Toc options + # 'collapse_navigation': False, # needs sphinxcontrib.fulltoc + # 'sticky_navigation': True, + # 'navigation_depth': 4, + # 'includehidden': True, + # 'titles_only': False +} diff --git a/docs/index.rst b/docs/index.rst new file mode 100644 index 0000000..305914a --- /dev/null +++ b/docs/index.rst @@ -0,0 +1,20 @@ +Welcome to gitea-formula's documentation! +========================================= + +.. toctree:: + :maxdepth: 2 + :caption: Contents: + + README + states + pillar + map.jinja + TOFS_pattern + + + +Indices and tables +================== + +* :ref:`genindex` +* :ref:`search` diff --git a/docs/make.bat b/docs/make.bat new file mode 100644 index 0000000..153be5e --- /dev/null +++ b/docs/make.bat @@ -0,0 +1,35 @@ +@ECHO OFF + +pushd %~dp0 + +REM Command file for Sphinx documentation + +if "%SPHINXBUILD%" == "" ( + set SPHINXBUILD=sphinx-build +) +set SOURCEDIR=. +set BUILDDIR=_build + +if "%1" == "" goto help + +%SPHINXBUILD% >NUL 2>NUL +if errorlevel 9009 ( + echo. + echo.The 'sphinx-build' command was not found. Make sure you have Sphinx + echo.installed, then set the SPHINXBUILD environment variable to point + echo.to the full path of the 'sphinx-build' executable. Alternatively you + echo.may add the Sphinx directory to PATH. + echo. + echo.If you don't have Sphinx installed, grab it from + echo.https://www.sphinx-doc.org/ + exit /b 1 +) + +%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O% +goto end + +:help +%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O% + +:end +popd diff --git a/docs/map.jinja.rst b/docs/map.jinja.rst new file mode 100644 index 0000000..3d07843 --- /dev/null +++ b/docs/map.jinja.rst @@ -0,0 +1,542 @@ +.. _map.jinja: + +``map.jinja``: gather formula configuration values +================================================== + +The `documentation`_ explains the use of a ``map.jinja`` to gather parameters values for a formula. + +As `pillars`_ are rendered on the Salt master for every minion, this increases the load on the master as the pillar values and the number of minions grows. + +As a good practice, you should: + +- store non-secret data in YAML files distributed by the `fileserver`_ +- store secret data in: + + - `pillars`_ (and look for the use of something like `pillar.vault`_) + - `SDB`_ (and look for the use of something like `sdb.vault`_) + +Current best practice is to let ``map.jinja`` handle parameters from all sources, to minimise the use of pillars, grains or configuration from ``sls`` files and templates directly. + + +.. contents:: **Table of Contents** + + +For formula users +----------------- + + +Quick start: configure per role and per DNS domain name values +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +We will see a quick setup to configure the ``gitea`` formula for different DNS domain names and several roles. + +For this example, I'll define 2 kinds of `fileserver`_ sources: + +1. formulas git repositories with hard-coded version reference to avoid breaking my setup randomly at upstream update. they are the last sources where files are looked up +2. parameters of the formulas in the file backend `roots`_ + + +Configure the fileserver backends +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +I configure the `fileserver`_ backends to serve: + +1. files from `roots`_ first +2. `gitfs`_ repositories last + +Create the file ``/etc/salt/master.d/fileserver.conf`` and restart the ``master``: + +.. code-block:: yaml + + --- + ## + ## file server + ## + fileserver_backend: + # parameters values and override + - roots + # formulas + - gitfs + + # The files in this directory will take precedence over git repositories + file_roots: + base: + - /srv/salt + + # List of formulas I'm using + gitfs_remotes: + - https://github.com/saltstack-formulas/template-formula.git: + - base: v4.1.1 + - https://github.com/saltstack-formulas/openssh-formula.git: + - base: v2.0.1 + ... + + +Create per DNS configuration for ``gitea`` formula +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Now, we can provides the per DNS domain name configuration files for the ``gitea`` formulas under ``/srv/salt/gitea/parameters/``. + +We create the directory for ``dns:domain`` grain and we add a symlink for the ``domain`` grain which is extracted from the minion ``id``: + +.. code-block:: console + + mkdir -p /srv/salt/gitea/parameters/dns:domain/ + ln -s dns:domain /srv/salt/gitea/parameters/domain + +We create a configuration for the DNS domain ``example.net`` in ``/srv/salt/gitea/parameters/dns:domain/example.net.yaml``: + +.. code-block:: yaml + + --- + values: + config: /etc/template-formula-example-net.conf + ... + +We create another configuration for the DNS domain ``example.com`` in the Jinja YAML template ``/srv/salt/gitea/parameters/dns:domain/example.com.yaml.jinja``: + +.. code-block:: yaml + + --- + values: + config: /etc/template-formula-{{ grains['os_family'] }}.conf + ... + + +Create per role configuration for ``gitea`` formula +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Now, we can provides the per role configuration files for the ``gitea`` formulas under ``/srv/salt/gitea/parameters/``. + +We create the directory for roles: + +.. code-block:: console + + mkdir -p /srv/salt/gitea/parameters/roles + +We will define 2 roles: + +- ``gitea/server`` +- ``gitea/client`` + +We create a configuration for the role ``gitea/server`` in ``/srv/salt/gitea/parameters/roles/gitea/server.yaml``: + +.. code-block:: yaml + + --- + values: + config: /etc/template-formula-server.conf + ... + +We create another configuration for the role ``gitea/client`` in ``/srv/salt/gitea/parameters/roles/gitea/client.yaml``: + +.. code-block:: yaml + + --- + values: + config: /etc/template-formula-client.conf + ... + + +Enable roles and the ``dns:domain`` and ``domain`` grains for ``map.jinja`` +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +We need to redefine the sources for ``map.jinja`` to load values from our new configuration files, we provide a global configuration for all our minions. + +We create the global parameters file ``/srv/salt/parameters/map_jinja.yaml``: + +.. code-block:: yaml + + --- + values: + sources: + # default values + - "Y:G@osarch" + - "Y:G@os_family" + - "Y:G@os" + - "Y:G@osfinger" + - "C@{{ tplroot ~ ':lookup' }}" + - "C@{{ tplroot }}" + + # Roles activate/deactivate things + # then thing are configured depending on environment + # So roles comes before `dns:domain`, `domain` and `id` + - "Y:C@roles" + + # DNS domain configured (DHCP or resolv.conf) + - "Y:G@dns:domain" + + # Based on minion ID + - "Y:G@domain" + + # default values + - "Y:G@id" + ... + +The syntax is explained later at `Sources of configuration values`_. + + +Bind roles to minions +~~~~~~~~~~~~~~~~~~~~~ + +We associate roles `grains`_ to minion using `grains.append`_. + +For the servers: + +.. code-block:: console + + salt 'server-*' grains.append roles gitea/server + +For the clients: + +.. code-block:: console + + salt 'client-*' grains.append roles gitea/client + +.. note:: + + Since we used ``Y:C@roles``, ``map.jinja`` will do a ``salt['config.get']('roles')`` to retrieve the roles so you could use any other method to bind roles to minions (`pillars`_ or `SDB`_) but `grains`_ seems to be the preferred method. + +Note for Microsoft Windows systems +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +If you have a minion running under windows, you can't use colon ``:`` as a delimiter for grain path query (see `bug 58726`_) in which case you should use an alternate delimiter: + +Modify ``/srv/salt/parameters/map_jinja.yaml`` to change the query for ``dns:domain`` to define the `alternate delimiter`_: + +.. code-block:: yaml + + --- + values: + sources: + # default values + - "Y:G@osarch" + - "Y:G@os_family" + - "Y:G@os" + - "Y:G@osfinger" + - "C@{{ tplroot ~ ':lookup' }}" + - "C@{{ tplroot }}" + + # Roles activate/deactivate things + # then thing are configured depending on environment + # So roles comes before `dns:domain`, `domain` and `id` + - "Y:C@roles" + + # DNS domain configured (DHCP or resolv.conf) + - "Y:G:!@dns!domain" + + # Based on minion ID + - "Y:G@domain" + + # default values + - "Y:G@id" + ... + +And then, rename the directory: + +.. code-block:: console + + mv /srv/salt/gitea/parameters/dns:domain/ '/srv/salt/gitea/parameters/dns!domain/' + + +Format of configuration YAML files +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +When you write a new YAML file, note that it must conform to the following layout: + +- a mandatory ``values`` key to store the configuration values +- two optional keys to configure the use of `salt.slsutil.merge`_ + + - an optional ``strategy`` key to configure the merging strategy, for example ``strategy: 'recurse'``, the default is ``smart`` + - an optional ``merge_lists`` key to configure if lists should be merged or overridden for the ``recurse`` and ``overwrite`` strategy, for example ``merge_lists: 'true'`` + +Here is a valid example: + +.. code-block:: yaml + + --- + strategy: 'recurse' + merge_lists: 'false' + values: + pkg: + name: 'some-package' + config: '/path/to/a/configuration/file' + ... + + +Using Jinja2 YAML template +~~~~~~~~~~~~~~~~~~~~~~~~~~ + +You can provide a Jinja2 YAML template file with a name suffixed with ``.yaml.jinja``, it must produce a YAML file conform to the `Format of configuration YAML files`_, for example: + +.. code-block:: jinja + + --- + strategy: 'overwrite' + merge_lists: 'true' + values: + {%- if grains["os"] == "Debian" %} + output_dir: /tmp/{{ grains["id"] }} + {%- endif %} + ... + + +Sources of configuration values +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``map.jinja`` file aggregates configuration values from several sources: + +- YAML files stored in the `fileserver`_ +- `pillars`_ +- `grains`_ +- configuration gathered with `salt['config.get']`_ + +For the values loaded from YAML files, ``map.jinja`` will automatically try to load a Jinja2 template with the same name as the YAML file with the addition of the ``.jinja`` extension, for example ``foo/bar/quux.yaml.jinja``. + +After loading values from all sources, it will try to include the ``salt://{{ tplroot }}/post-map.jinja`` Jinja file if it exists which can post-process the ``mapdata`` variable. + +Configuring ``map.jinja`` sources +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The ``map.jinja`` file uses several sources where to lookup parameter values. The list of sources can be configured in two places: + +1. globally + + 1. with a plain YAML file ``salt://parameters/map_jinja.yaml`` + 2. with a Jinja2 YAML template file ``salt://parameters/map_jinja.yaml.jinja`` + +2. per formula + + 1. with a plain YAML file ``salt://{{ tplroot }}/parameters/map_jinja.yaml`` + 2. with a Jinja2 YAML template file ``salt://{{ tplroot }}/parameters/map_jinja.yaml.jinja`` + +.. note:: + + The ``map.jinja`` configuration files must conform to the `format of configuration YAML files`_. + +Each source definition has the form ``[[: