Miguel Jacq
f5eaac9f75
Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.
91 lines
5 KiB
RPMSpec
91 lines
5 KiB
RPMSpec
%global upstream_version 0.4.2
|
|
|
|
Name: enroll
|
|
Version: %{upstream_version}
|
|
Release: 1%{?dist}.enroll1
|
|
Summary: Enroll a server's running state retrospectively into Ansible.
|
|
|
|
License: GPL-3.0-or-later
|
|
URL: https://git.mig5.net/mig5/enroll
|
|
Source0: %{name}-%{version}.tar.gz
|
|
|
|
BuildArch: noarch
|
|
|
|
BuildRequires: pyproject-rpm-macros
|
|
BuildRequires: python3-devel
|
|
BuildRequires: python3-poetry-core
|
|
|
|
Requires: python3-yaml
|
|
Requires: python3-paramiko
|
|
Requires: python3-jsonschema
|
|
|
|
Recommends: jinjaturtle
|
|
|
|
%description
|
|
Enroll a server's running state retrospectively into Ansible.
|
|
|
|
%prep
|
|
%autosetup -n enroll
|
|
|
|
%generate_buildrequires
|
|
%pyproject_buildrequires
|
|
|
|
%build
|
|
%pyproject_wheel
|
|
|
|
%install
|
|
%pyproject_install
|
|
%pyproject_save_files enroll
|
|
|
|
%files -f %{pyproject_files}
|
|
%license LICENSE
|
|
%doc README.md CHANGELOG.md
|
|
%{_bindir}/enroll
|
|
|
|
%changelog
|
|
* Tue Jan 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Support `--remote-ssh-config [path-to-ssh-config]` as an argument in case extra params are required beyond `--remote-port` or `--remote-user`. Note: `--remote-host` must still be s
|
|
et, but it can be an 'alias' represented by the 'Host' value in the ssh config.
|
|
* Sun Jan 11 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Add interactive output when 'enroll diff --enforce' is invoking Ansible.
|
|
* Sat Jan 10 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Introduce `enroll validate` - a tool to validate a harvest against the state schema, or check for missing or orphaned obsolete artifacts in a harvest.
|
|
- Attempt to generate Jinja2 templates of systemd unit files and Postfix main.cf (now that JinjaTurtle supports it)
|
|
- Update pynacl dependency to resolve CVE-2025-69277
|
|
- Add `--exclude-path` to `enroll diff` command, so that you can ignore certain churn from the diff (stuff you still wanted to harvest as a baseline but don't care if it changes day to day)
|
|
- Add `--ignore-package-versions` to `enroll diff` command, to optionally ignore package upgrades (e.g due to patching) from the diff.
|
|
- Add tags to the playbook for each role, to allow easier targeting of specific roles during play later.
|
|
- Add `--enforce` mode to `enroll diff`. If there is diff detected between the two harvests, and it can enforce restoring the state from the older harvest, it will manifest the state and apply it with ansible.
|
|
Only the specific roles that had diffed will be applied (via the new tags capability)
|
|
* Mon Jan 05 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Introduce `enroll explain` - a tool to analyze and explain what's in (or not in) a harvest and why.
|
|
- Centralise the cron and logrotate stuff into their respective roles, we had a bit of duplication between roles based on harvest discovery.
|
|
- Capture other files in the user's home directory such as `.bashrc`, `.bash_aliases`, `.profile`, if these files differ from the `/etc/skel` defaults
|
|
- Ignore files that end with a tilde or - (probably backup files generated by editors or shadow file changes)
|
|
- Manage certain symlinks e.g for apache2/nginx sites-enabled and so on
|
|
* Sun Jan 04 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Introduce --ask-become-pass or -K to support password-required sudo on remote hosts, just like Ansible. It will also fall back to this prompt if a password is required but the arg wasn't passed in.
|
|
* Sat Jan 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Fix stat() of parent directory so that we set directory perms correct on --include paths.
|
|
- Set pty for remote calls when sudo is required, to help systems with limits on sudo without pty
|
|
* Fri Jan 02 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Don't accidentally add extra_paths role to usr_local_custom list, resulting in extra_paths appearing twice in manifested playbook
|
|
- Ensure directories in the tree of anything included with --include are defined in the state and manifest so we make dirs before we try to create files
|
|
* Mon Dec 29 2025 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Add version CLI arg
|
|
- Add ability to enroll RH-style systems (DNF5/DNF/RPM)
|
|
- Refactor harvest state to track package versions
|
|
* Sun Dec 28 2025 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Fix an attribution bug for certain files ending up in the wrong package/role.
|
|
* Sun Dec 28 2025 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- DRY up some code logic
|
|
- More test coverage
|
|
* Sun Dec 28 2025 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Consolidate logrotate and cron files into their main service/package roles if they exist.
|
|
- Standardise on MAX_FILES_CAP in one place
|
|
- Manage apt stuff in its own role, not in etc_custom
|
|
* Sat Dec 27 2025 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Attempt to capture more stuff from /etc that might not be attributable to a specific package. This includes common singletons and systemd timers
|
|
- Avoid duplicate apt data in package-specific roles.
|
|
* Sat Dec 27 2025 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
|
|
- Initial RPM packaging for Fedora 42
|