Don't enforce /etc/enroll if no firewall rules to set in subdir

enroll/puppet.py

@@ -828,19 +828,15 @@ def _collect_puppet_roles(
             or fw.get("iptables_v4_save")
             or fw.get("iptables_v6_save")
         )
-        packages = [
+        if has_fw:
-            str(p).strip() for p in (fw.get("packages") or []) if str(p).strip()
+            runtime_role = ensure_role("enroll_runtime")
-        ]
+            runtime_role.add_managed_dir(
-        if has_fw or packages or fw.get("notes"):
+                "/etc/enroll",
-            if has_fw:
+                owner="root",
-                runtime_role = ensure_role("enroll_runtime")
+                group="root",
-                runtime_role.add_managed_dir(
+                mode="0750",
-                    "/etc/enroll",
+                reason="enroll_runtime",
-                    owner="root",
+            )
-                    group="root",
-                    mode="0750",
-                    reason="enroll_runtime",
-                )
             role_name = str(fw.get("role_name") or "firewall_runtime")
             prole = ensure_role(role_name)
             prole.add_firewall_runtime_snapshot(

enroll/salt.py

@@ -884,19 +884,15 @@ def _collect_salt_roles(
             or fw.get("iptables_v4_save")
             or fw.get("iptables_v6_save")
         )
-        packages = [
+        if has_fw:
-            str(p).strip() for p in (fw.get("packages") or []) if str(p).strip()
+            runtime_role = ensure_role("enroll_runtime")
-        ]
+            runtime_role.add_managed_dir(
-        if has_fw or packages or fw.get("notes"):
+                "/etc/enroll",
-            if has_fw:
+                user="root",
-                runtime_role = ensure_role("enroll_runtime")
+                group="root",
-                runtime_role.add_managed_dir(
+                mode="0750",
-                    "/etc/enroll",
+                reason="enroll_runtime",
-                    user="root",
+            )
-                    group="root",
-                    mode="0750",
-                    reason="enroll_runtime",
-                )
             role_name = str(fw.get("role_name") or "firewall_runtime")
             srole = ensure_role(role_name)
             srole.add_firewall_runtime_snapshot(

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "enroll"
-version = "0.7.0b1"
+version = "0.7.0b3"
 description = "Enroll a server's running state retrospectively into Ansible"
 authors = ["Miguel Jacq <mig@mig5.net>"]
 license = "GPL-3.0-or-later"

tests/test_manifest_puppet.py

@@ -798,3 +798,37 @@ def test_manifest_puppet_renders_firewall_runtime_resources(tmp_path: Path):
     ).read_text(encoding="utf-8")
     assert "Hash $firewall_runtime = {}" in fqdn_pp
     assert "$firewall_runtime['ipset_restore_cmd']" in fqdn_pp
+
+
+def test_manifest_puppet_omits_firewall_runtime_when_no_rules_were_sampled(
+    tmp_path: Path,
+):
+    bundle = tmp_path / "bundle"
+    out = tmp_path / "puppet"
+    state = {
+        "schema_version": 3,
+        "host": {"hostname": "test", "os": "debian", "pkg_backend": "dpkg"},
+        "inventory": {"packages": {}},
+        "roles": {
+            "firewall_runtime": {
+                "role_name": "firewall_runtime",
+                "packages": [],
+                "ipset_save": None,
+                "ipset_sets": [],
+                "iptables_v4_save": None,
+                "iptables_v6_save": None,
+                "notes": [
+                    "not running as root; live firewall runtime was not captured"
+                ],
+            }
+        },
+    }
+    _write_state(bundle, state)
+
+    manifest.manifest(str(bundle), str(out), target="puppet")
+
+    site_pp = (out / "manifests" / "site.pp").read_text(encoding="utf-8")
+    assert "include enroll_runtime" not in site_pp
+    assert "include firewall_runtime" not in site_pp
+    assert not (out / "modules" / "enroll_runtime").exists()
+    assert not (out / "modules" / "firewall_runtime").exists()

tests/test_manifest_salt.py

@@ -624,3 +624,37 @@ def test_manifest_salt_renders_firewall_runtime_states(tmp_path: Path):
         fqdn_out / "states" / "roles" / "firewall_runtime" / "init.sls"
     ).read_text(encoding="utf-8")
     assert "firewall_runtime.get('ipset_restore_cmd')" in fqdn_sls
+
+
+def test_manifest_salt_omits_firewall_runtime_when_no_rules_were_sampled(
+    tmp_path: Path,
+):
+    bundle = tmp_path / "bundle"
+    out = tmp_path / "salt"
+    state = {
+        "schema_version": 3,
+        "host": {"hostname": "test", "os": "debian", "pkg_backend": "dpkg"},
+        "inventory": {"packages": {}},
+        "roles": {
+            "firewall_runtime": {
+                "role_name": "firewall_runtime",
+                "packages": [],
+                "ipset_save": None,
+                "ipset_sets": [],
+                "iptables_v4_save": None,
+                "iptables_v6_save": None,
+                "notes": [
+                    "not running as root; live firewall runtime was not captured"
+                ],
+            }
+        },
+    }
+    _write_state(bundle, state)
+
+    manifest.manifest(str(bundle), str(out), target="salt")
+
+    top = yaml.safe_load((out / "states" / "top.sls").read_text(encoding="utf-8"))
+    assert "roles.enroll_runtime" not in top["base"]["*"]
+    assert "roles.firewall_runtime" not in top["base"]["*"]
+    assert not (out / "states" / "roles" / "enroll_runtime").exists()
+    assert not (out / "states" / "roles" / "firewall_runtime").exists()