!DO NOT MERGE! Stripped branch #175

lrvick · 2017-06-15T10:49:41Z

Goal here is to remove apt-made changes and apt-controlled files and only preserve files where we have deviated from package defalts. This is a pre-step towards phasing out use of etckeeper.

Top post hijacked by Ryan to clear up some information

Currently, #! uses a software called etckeeper to manage commits and other information. However,
as of right now (2017-08-14) all files are managed, even the files we don't make changes to.
Eventually, this commit needs to be moved into hashbang/shell-server and
the following changes to that repo need to happen:

Automate the deployment of the config
- In systems already managed in this style (or pristine systems)
- In systems that need to be migrated from the current etckeeper-based system
Include this configuration in admin-tools
Either as a directory, or as a submodule (as we do for roles)

This is achievable (for testing) by setting up a VM, pointing Ansible to the VM, and then making sure
that the changes are deployed. Once that is done, a shell server must be duplicated and Ansible pointed
to the shell server. If the configs have the same (with some mild adjustments) values, then it can be
pointed to the live machines and run there.

Afterwards, a new PR needs to be created after deploying works to apply the following changes:

Data files (in this branch, under data/) need to be converted to YAML
Ansible can read JSON files, but that's not consistent with what we do in admin-tools
Files should be converted to templates where any values (domain, external configuration, etc.) will be pulled in.

This branch was generated by a script

remove setup.sh, document new update flow

Package changes: +gir1.2-glib-2.0 1.42.0-2.2 +libgirepository-1.0-1 1.42.0-2.2 +libimage-exiftool-perl 9.74-1 +mat 0.5.2-3 +python-gi 3.14.0-1 +python-hachoir-core 1.3.3-4 +python-hachoir-parser 1.3.4-2 +python-mutagen 1.25.1-1 +python-pdfrw 0.1-3 +python-reportlab 3.1.8-3+deb8u1 +python-reportlab-accel 3.1.8-3+deb8u1

@lrvick

@lrvick Please stop leaving messes behind you. :V

httpredir.debian.org is currently unmaintained. This should solve the security issues lrvick had.

Use deb.debian.org as general-purpose & security mirror

This is part of #86 and required for hashbang/dotfiles#25

Package changes:

Package changes: -libpcre2-32-0 10.21-1 -libstdc++6 6.1.1-10 +libstdc++6 4.9.2-10

Package changes: -fish 2.3.1-1 -fish-common 2.3.1-1 +fish 2.2.0-3~bpo8+1 +fish-common 2.2.0-3~bpo8+1 +python3-decorator 3.4.0-2 +python3-numpy 1:1.8.2-2 +python3-scipy 0.14.0-2

apt: Never install silently from testing

This has caused too many issues, and I just replaced the last package that was pulling in stretch's libstdc++6, creating ABI breakage.

Package changes: +travis 140902-1

Package changes: -travis 140902-1

@lrvick

Reviewed-by: @lrvick

This was required to push directly to Github from the server, but we do not do this anymore.

@lrvick

Reviewed-by: @lrvick

Package changes: +znc 1.4-2

Pull mosh from jessie-backports, so as to have mouse support.

Reviewed-by: lrvick

Package changes: +python3-venv 3.4.2-2 +python3.4-venv 3.4.2-1

Reviewed-by: DeviaVir, singlerider

Package changes: -libgraphite2-3 1.3.6-1~deb8u1 +libgraphite2-3 1.3.10-1~deb8u1 -libmysqlclient18 5.5.53-0+deb8u1 +libmysqlclient18 5.5.55-0+deb8u1 -libuuid-perl 0.05-1+b1 -linux-image-4.9.0-0.bpo.3-amd64 4.9.25-1~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1 -mysql-common 5.5.53-0+deb8u1 +mysql-common 5.5.55-0+deb8u1 -php5-cgi 5.6.29+dfsg-0+deb8u1 -php5-cli 5.6.29+dfsg-0+deb8u1 +php5-cgi 5.6.30+dfsg-0+deb8u1 +php5-cli 5.6.30+dfsg-0+deb8u1 -php5-curl 5.6.29+dfsg-0+deb8u1 -php5-fpm 5.6.29+dfsg-0+deb8u1 +php5-curl 5.6.30+dfsg-0+deb8u1 +php5-fpm 5.6.30+dfsg-0+deb8u1 -php5-mysql 5.6.29+dfsg-0+deb8u1 -php5-sqlite 5.6.29+dfsg-0+deb8u1 +php5-mysql 5.6.30+dfsg-0+deb8u1 +php5-sqlite 5.6.30+dfsg-0+deb8u1

Package changes: -libgraphite2-3 1.3.6-1~deb8u1 +libgraphite2-3 1.3.10-1~deb8u1 -libuuid-perl 0.05-1+b1 -linux-image-4.9.0-0.bpo.3-amd64 4.9.25-1~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1

Package changes: -libgraphite2-3 1.3.6-1~deb8u1 +libgraphite2-3 1.3.10-1~deb8u1 +libmysqlclient18 5.5.55-0+deb8u1 -libuuid-perl 0.05-1+b1 -linux-image-4.9.0-0.bpo.3-amd64 4.9.25-1~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1 +mysql-common 5.5.55-0+deb8u1 +php5-cgi 5.6.30+dfsg-0+deb8u1 +php5-cli 5.6.30+dfsg-0+deb8u1 +php5-curl 5.6.30+dfsg-0+deb8u1 +php5-fpm 5.6.30+dfsg-0+deb8u1 +php5-mysql 5.6.30+dfsg-0+deb8u1 +php5-sqlite 5.6.30+dfsg-0+deb8u1

Package changes: -libgraphite2-3 1.3.6-1~deb8u1 +libgraphite2-3 1.3.10-1~deb8u1 -linux-image-4.9.0-0.bpo.3-amd64 4.9.25-1~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1

I broke direct root access in #176, and not having LDAP-independent methods for administering the shell servers is problematic.

Package changes: -libexpat1 2.1.0-6+deb8u3 -libexpat1-dev 2.1.0-6+deb8u3 +libexpat1 2.1.0-6+deb8u4 +libexpat1-dev 2.1.0-6+deb8u4 -weechat 1.8-1 -weechat-core 1.8-1 -weechat-curses 1.8-1 -weechat-plugins 1.8-1 +weechat 1.9-1 +weechat-core 1.9-1 +weechat-curses 1.9-1 +weechat-plugins 1.9-1

Package changes: -base-files 8+deb8u8 +base-files 8+deb8u9 -bind9-host 1:9.9.5.dfsg-9+deb8u11 +bind9-host 1:9.9.5.dfsg-9+deb8u13 -cvs 2:1.12.13+real-15 +cvs 2:1.12.13+real-15+deb8u1 -debconf 1.5.56 -debconf-i18n 1.5.56 -debconf-utils 1.5.56 +debconf 1.5.56+deb8u1 +debconf-i18n 1.5.56+deb8u1 +debconf-utils 1.5.56+deb8u1 -debian-archive-keyring 2014.3 +debian-archive-keyring 2017.5~deb8u1 -dnsutils 1:9.9.5.dfsg-9+deb8u11 +dnsutils 1:9.9.5.dfsg-9+deb8u13 -git 1:2.1.4-2.1+deb8u3 -git-email 1:2.1.4-2.1+deb8u3 -git-man 1:2.1.4-2.1+deb8u3 +git 1:2.1.4-2.1+deb8u4 +git-email 1:2.1.4-2.1+deb8u4 +git-man 1:2.1.4-2.1+deb8u4 -imagemagick 8:6.8.9.9-5+deb8u9 -imagemagick-6.q16 8:6.8.9.9-5+deb8u9 -imagemagick-common 8:6.8.9.9-5+deb8u9 +imagemagick 8:6.8.9.9-5+deb8u10 +imagemagick-6.q16 8:6.8.9.9-5+deb8u10 +imagemagick-common 8:6.8.9.9-5+deb8u10 -libasn1-8-heimdal 1.6~rc2+dfsg-9 +libasn1-8-heimdal 1.6~rc2+dfsg-9+deb8u1 -libbind9-90 1:9.9.5.dfsg-9+deb8u11 +libbind9-90 1:9.9.5.dfsg-9+deb8u13 -libc-ares-dev 1.10.0-2+deb8u1 -libc-ares2 1.10.0-2+deb8u1 +libc-ares-dev 1.10.0-2+deb8u2 +libc-ares2 1.10.0-2+deb8u2 -libdns-export100 1:9.9.5.dfsg-9+deb8u11 -libdns100 1:9.9.5.dfsg-9+deb8u11 +libdns-export100 1:9.9.5.dfsg-9+deb8u13 +libdns100 1:9.9.5.dfsg-9+deb8u13 -libdvdnav4 5.0.1-1 +libdvdnav4 5.0.1-1+deb8u1 -libgcrypt20 1.7.6-2 -libgd3 2.1.0-5+deb8u9 +libgcrypt20 1.7.6-2+deb9u2 +libgd3 2.1.0-5+deb8u10 -libgnutls-deb0-28 3.3.8-6+deb8u6 -libgnutls-openssl27 3.3.8-6+deb8u6 +libgnutls-deb0-28 3.3.8-6+deb8u7 +libgnutls-openssl27 3.3.8-6+deb8u7 -libgssapi3-heimdal 1.6~rc2+dfsg-9 +libgssapi3-heimdal 1.6~rc2+dfsg-9+deb8u1 -libgtk2.0-0 2.24.25-3+deb8u1 -libgtk2.0-bin 2.24.25-3+deb8u1 -libgtk2.0-common 2.24.25-3+deb8u1 +libgtk2.0-0 2.24.25-3+deb8u2 +libgtk2.0-bin 2.24.25-3+deb8u2 +libgtk2.0-common 2.24.25-3+deb8u2 -libhcrypto4-heimdal 1.6~rc2+dfsg-9 -libheimbase1-heimdal 1.6~rc2+dfsg-9 -libheimntlm0-heimdal 1.6~rc2+dfsg-9 +libhcrypto4-heimdal 1.6~rc2+dfsg-9+deb8u1 +libheimbase1-heimdal 1.6~rc2+dfsg-9+deb8u1 +libheimntlm0-heimdal 1.6~rc2+dfsg-9+deb8u1 -libhx509-5-heimdal 1.6~rc2+dfsg-9 +libhx509-5-heimdal 1.6~rc2+dfsg-9+deb8u1 -libirs-export91 1:9.9.5.dfsg-9+deb8u11 -libisc-export95 1:9.9.5.dfsg-9+deb8u11 -libisc95 1:9.9.5.dfsg-9+deb8u11 -libisccc90 1:9.9.5.dfsg-9+deb8u11 -libisccfg-export90 1:9.9.5.dfsg-9+deb8u11 -libisccfg90 1:9.9.5.dfsg-9+deb8u11 +libirs-export91 1:9.9.5.dfsg-9+deb8u13 +libisc-export95 1:9.9.5.dfsg-9+deb8u13 +libisc95 1:9.9.5.dfsg-9+deb8u13 +libisccc90 1:9.9.5.dfsg-9+deb8u13 +libisccfg-export90 1:9.9.5.dfsg-9+deb8u13 +libisccfg90 1:9.9.5.dfsg-9+deb8u13 -libkrb5-26-heimdal 1.6~rc2+dfsg-9 +libkrb5-26-heimdal 1.6~rc2+dfsg-9+deb8u1 -liblua5.3-0 5.3.1-1 -liblua5.3-dev 5.3.1-1 +liblua5.3-0 5.3.3-1~bpo8+1 +liblua5.3-dev 5.3.3-1~bpo8+1 -liblwres90 1:9.9.5.dfsg-9+deb8u11 +liblwres90 1:9.9.5.dfsg-9+deb8u13 -libmagickcore-6.q16-2 8:6.8.9.9-5+deb8u9 -libmagickwand-6.q16-2 8:6.8.9.9-5+deb8u9 +libmagickcore-6.q16-2 8:6.8.9.9-5+deb8u10 +libmagickwand-6.q16-2 8:6.8.9.9-5+deb8u10 -libmysqlclient18 5.5.55-0+deb8u1 +libmysqlclient18 5.5.57-0+deb8u1 -libonig2 5.9.5-3.2 +libonig2 5.9.5-3.2+deb8u1 -libpam-modules 1.1.8-3.1+deb8u2 -libpam-modules-bin 1.1.8-3.1+deb8u2 +libpam-modules 1.1.8-3.1+deb8u2+b1 +libpam-modules-bin 1.1.8-3.1+deb8u2+b1 -libpam0g 1.1.8-3.1+deb8u2 +libpam0g 1.1.8-3.1+deb8u2+b1 -libperl5.20 5.20.2-3+deb8u7 +libperl5.20 5.20.2-3+deb8u8 -libroken18-heimdal 1.6~rc2+dfsg-9 +libroken18-heimdal 1.6~rc2+dfsg-9+deb8u1 -libsoup-gnome2.4-1 2.48.0-1 -libsoup2.4-1 2.48.0-1 +libsoup-gnome2.4-1 2.48.0-1+deb8u1 +libsoup2.4-1 2.48.0-1+deb8u1 -libspice-server1 0.12.5-1+deb8u4 +libspice-server1 0.12.5-1+deb8u5 -libsvn1 1.8.10-6+deb8u4 +libsvn1 1.8.10-6+deb8u5 -libtiff5 4.0.3-12.3+deb8u3 +libtiff5 4.0.3-12.3+deb8u4 -libwbclient0 2:4.2.14+dfsg-0+deb8u6 +libwbclient0 2:4.2.14+dfsg-0+deb8u7+b1 -libwind0-heimdal 1.6~rc2+dfsg-9 +libwind0-heimdal 1.6~rc2+dfsg-9+deb8u1 -libxml2 2.9.1+dfsg1-5+deb8u4 -libxml2-dev 2.9.1+dfsg1-5+deb8u4 +libxml2 2.9.1+dfsg1-5+deb8u5 +libxml2-dev 2.9.1+dfsg1-5+deb8u5 -linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2+deb9u2~bpo8+1 -linux-libc-dev 3.16.43-2+deb8u1 +linux-libc-dev 3.16.43-2+deb8u3 -lua5.3 5.3.1-1 +lua5.3 5.3.3-1~bpo8+1 -mysql-common 5.5.55-0+deb8u1 +mysql-common 5.5.57-0+deb8u1 -os-prober 1.65 +os-prober 1.65+deb8u1 -perl 5.20.2-3+deb8u7 -perl-base 5.20.2-3+deb8u7 -perl-modules 5.20.2-3+deb8u7 +perl 5.20.2-3+deb8u8 +perl-base 5.20.2-3+deb8u8 +perl-modules 5.20.2-3+deb8u8 -samba-libs 2:4.2.14+dfsg-0+deb8u6 +samba-libs 2:4.2.14+dfsg-0+deb8u7+b1 -subversion 1.8.10-6+deb8u4 +subversion 1.8.10-6+deb8u5 -tor 0.2.9.11-1~d80.jessie+1 +tor 0.3.0.10-1~d80.jessie+1 -w3m 0.5.3-19+deb8u1 +w3m 0.5.3-19+deb8u2

…git-infra/sf1'

This avoid dealing with changed fingerprints when we renew certificates.

Reviewed-by: DeviaVir, KellerFuchs

daurnimator · 2017-09-17T05:31:59Z

Status update on this branch?

RyanSquared · 2017-09-17T14:25:51Z

Waiting on a review from @lrvick for whether the configuration looks decent, then a few steps need to happen for this branch:

~~Data files (in this branch, under data/) need to be converted to YAML~~
~~Ansible can read JSON files, but that's not consistent with what we do in admin-tools~~
The templates belong in a separate PR
Automate the deployment of the config
- In systems already managed in this style (or pristine systems)
- In systems that need to be migrated from the current etckeeper-based system
Include this configuration in admin-tools
Either as a directory, or as a submodule (as we do for roles)

KellerFuchs · 2017-09-19T00:17:31Z

Removed @RyanSquared and my comments, clarified the current list of blockers.

daurnimator · 2017-09-19T01:32:17Z

Data files (in this branch, under data/) need to be converted to YAML

That's a nice to have. No need for it to be a blocker.
Though it shouldn't be hard... my system has a json2yaml command line tool installed that should do the conversion easily enough?

KellerFuchs · 2017-09-19T02:01:44Z

@daurnimator Oh, I should have updated that after the discussion on IRC.
I convinced @RyanSquared that the templating shouldn't be a blocker for now, and if I'm well enough I will update this PR (and the script that generates the “cleaned up” history) tomorrow.

Not entirely sure why it was deleted...

daurnimator · 2018-02-15T02:11:57Z

So.... what's current status?

RyanSquared · 2018-02-15T15:51:03Z

Right now, we have a branch for hashbang/shell-server here which we need to make work with templates. Unfortunately, the templates have gone missing - I have no clue where they are, and the branch they used to exist on (stripped-stow of shell-etc) seems to be deleted. They can just be copied over from shell-etc into a new repo and then added as a submodule to shell-server under the folder templates.

lrvick and others added 30 commits June 26, 2016 15:43

direct people to end-to-end setup for more complex changes

a99c4c8

remove cumbersome and near pointless multi-commit signing instruction

75d69be

Merge pull request #98 from hashbang/new-flow

4d8e05a

remove setup.sh, document new update flow

Merge remote-tracking branch 'origin/master'

b85be3a

@lrvick Please stop leaving messes behind you. :V

apt: Switch to deb.debian.org

3396ead

httpredir.debian.org is currently unmaintained. This should solve the security issues lrvick had.

apt: Add security mirror for Stretch

0921602

Merge pull request #101 from KellerFuchs/mirrors

b4121f9

Use deb.debian.org as general-purpose & security mirror

Add a firejail profile for mutt

ba9f45b

This is part of #86 and required for hashbang/dotfiles#25

Do not expose Unbound's secrets

c446095

Remove spurious /etc/etc directory

bd2a8e3

Merge remote-tracking branch 'origin/master'

08aad9a

committing changes in /etc after apt run

ebdbc4f

Package changes:

committing changes in /etc after apt run

1ac3ffc

Package changes:

committing changes in /etc after apt run

538b2dd

Package changes: -libpcre2-32-0 10.21-1 -libstdc++6 6.1.1-10 +libstdc++6 4.9.2-10

committing changes in /etc after apt run

b46022d

Package changes: -fish 2.3.1-1 -fish-common 2.3.1-1 +fish 2.2.0-3~bpo8+1 +fish-common 2.2.0-3~bpo8+1 +python3-decorator 3.4.0-2 +python3-numpy 1:1.8.2-2 +python3-scipy 0.14.0-2

Merge pull request #104 from KellerFuchs/no-testing

e12498b

apt: Never install silently from testing

apt: Never install silently from testing

ba30a9f

This has caused too many issues, and I just replaced the last package that was pulling in stretch's libstdc++6, creating ABI breakage.

committing changes in /etc after apt run

7067e84

Package changes: +travis 140902-1

committing changes in /etc after apt run

962ad3e

Package changes: -travis 140902-1

Merge remote-tracking branch 'KellerFuchs/stow-dotfiles'

aa84fd4

Reviewed-by: @lrvick

sudoers: Do not keep SSH_AUTH_SOCK

63f87f7

This was required to push directly to Github from the server, but we do not do this anymore.

Merge branch 'git-infra'

e853d5a

Reviewed-by: @lrvick

committing changes in /etc after apt run

2c8837c

Package changes: +znc 1.4-2

Merge remote-tracking branch 'git-infra/to1'

d9b34cd

apt: Pull mosh from jessie-backports

7498811

Merge remote-tracking branch 'git-infra/ny1'

2241693

Pull mosh from jessie-backports, so as to have mouse support.

Merge branch 'firejail-mutt'

0b1095c

Reviewed-by: lrvick

committing changes in /etc after apt run

d6ad08c

Package changes: +python3-venv 3.4.2-2 +python3.4-venv 3.4.2-1

Merge remote-tracking branch 'git-infra/to1'

ddb9dbf

KellerFuchs and others added 11 commits June 24, 2017 16:18

etckeeper: Do not deinstall mysql

1b27345

Merge branch 'ssh_authorizedkeys'

4c40f5f

Reviewed-by: DeviaVir, singlerider

committing changes in /etc after apt run

2950e70

Package changes: -libgraphite2-3 1.3.6-1~deb8u1 +libgraphite2-3 1.3.10-1~deb8u1 -libuuid-perl 0.05-1+b1 -linux-image-4.9.0-0.bpo.3-amd64 4.9.25-1~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1

committing changes in /etc after apt run

865b8b6

Package changes: -libgraphite2-3 1.3.6-1~deb8u1 +libgraphite2-3 1.3.10-1~deb8u1 -linux-image-4.9.0-0.bpo.3-amd64 4.9.25-1~bpo8+1 +linux-image-4.9.0-0.bpo.3-amd64 4.9.30-2~bpo8+1

ssh: Allow root to use authorized_keys file (HOTFIX)

afebc98

I broke direct root access in #176, and not having LDAP-independent methods for administering the shell servers is problematic.

Merge branches 'da1', 'ny1', 'to1' and 'sf1' from 'git-infra'

6cd287f

ssh: Hotfix for the previous hotfix

a0f7319

RyanSquared mentioned this pull request Aug 15, 2017

Stripped "stow-like" branch #178

Merged

root and others added 8 commits August 29, 2017 21:23

Merge remote-tracking branches 'git-infra/ny1', 'git-infra/to1' and '…

a193338

…git-infra/sf1'

Merge remote-tracking branch 'git-infra/da1'

9abbd77

msmtp: Require valid certificate, rather than pinning by fingerprint

06cc3d5

This avoid dealing with changed fingerprints when we renew certificates.

Merge PR#181: Fix msmtp after the mail server's fingerprint changed

94febc2

Reviewed-by: DeviaVir, KellerFuchs

hashbang deleted a comment from RyanSquared Sep 19, 2017

Bringing back skel/

3b1e942

Not entirely sure why it was deleted...

KellerFuchs force-pushed the stripped branch from aef7272 to 3b1e942 Compare September 20, 2017 15:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

!DO NOT MERGE! Stripped branch #175

!DO NOT MERGE! Stripped branch #175

lrvick commented Jun 15, 2017 •

edited by KellerFuchs

Loading

daurnimator commented Sep 17, 2017

RyanSquared commented Sep 17, 2017 •

edited by KellerFuchs

Loading

KellerFuchs commented Sep 19, 2017

daurnimator commented Sep 19, 2017

KellerFuchs commented Sep 19, 2017

daurnimator commented Feb 15, 2018

RyanSquared commented Feb 15, 2018

!DO NOT MERGE! Stripped branch #175

Are you sure you want to change the base?

!DO NOT MERGE! Stripped branch #175

Conversation

lrvick commented Jun 15, 2017 • edited by KellerFuchs Loading

daurnimator commented Sep 17, 2017

RyanSquared commented Sep 17, 2017 • edited by KellerFuchs Loading

KellerFuchs commented Sep 19, 2017

daurnimator commented Sep 19, 2017

KellerFuchs commented Sep 19, 2017

daurnimator commented Feb 15, 2018

RyanSquared commented Feb 15, 2018

lrvick commented Jun 15, 2017 •

edited by KellerFuchs

Loading

RyanSquared commented Sep 17, 2017 •

edited by KellerFuchs

Loading