bundles/apt: handle unattended-upgrades ourselves
This commit is contained in:
parent
b1992447f0
commit
366374b4e5
GPG key ID:
12E3D2136B818350
|
|
@ -1,3 +0,0 @@
|
|||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
Unattended-Upgrade::Origins-Pattern {
|
||||
"origin=Debian,codename=${os_release},label=Debian";
|
||||
"origin=Debian,codename=${os_release},label=Debian-Security";
|
||||
|
||||
% if node_has_backports:
|
||||
"a=${os_release}-backports,n=${os_release}-backports";
|
||||
% endif
|
||||
|
||||
// External packages
|
||||
% for item in sorted(data.get('origins', set())):
|
||||
"${item}";
|
||||
% endfor
|
||||
};
|
||||
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "false";
|
||||
|
||||
% if data.get('mail', None):
|
||||
Unattended-Upgrade::Mail "${data['mail']}";
|
||||
Unattended-Upgrade::MailOnlyOnError "false";
|
||||
% endif
|
||||
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
|
||||
% if data.get('reboot', True):
|
||||
Unattended-Upgrade::Automatic-Reboot "true";
|
||||
% else:
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
% endif
|
||||
52
bundles/apt/files/upgrade-and-reboot
Normal file
52
bundles/apt/files/upgrade-and-reboot
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
#!/bin/bash
|
||||
|
||||
# With systemd, we can force logging to the journal. This is better than
|
||||
# spamming the world with cron mails. You can then view these logs using
|
||||
# "journalctl -rat upgrade-and-reboot".
|
||||
if [[ "$1" != '-w' ]]
|
||||
then
|
||||
if which systemd-cat >/dev/null 2>&1
|
||||
then
|
||||
if [[ "$1" != "is-logging" ]]
|
||||
then
|
||||
exec systemd-cat -t upgrade-and-reboot "$0" is-logging "$@"
|
||||
else
|
||||
shift
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
logins=$(ps h -C sshd -o euser | awk '$1 != "root" && $1 != "sshd"')
|
||||
if [[ -n "$logins" ]]
|
||||
then
|
||||
echo "Will abort now, there are active SSH logins: $logins"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
softlockdir=/var/lib/bundlewrap/soft-${node.name}
|
||||
mkdir -p "$softlockdir"
|
||||
printf '{"comment": "UPDATE", "date": %s, "expiry": %s, "id": "UNATTENDED", "items": ["*"], "user": "root@localhost"}\n' \
|
||||
$(date +%s) \
|
||||
$(date -d 'now + 30 mins' +%s) \
|
||||
>"$softlockdir"/UNATTENDED
|
||||
trap 'rm -f "$softlockdir"/UNATTENDED' EXIT
|
||||
|
||||
apt-get update
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -q -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef dist-upgrade
|
||||
|
||||
ret=$?
|
||||
if (( $ret != 0 ))
|
||||
then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
apt-get autoclean
|
||||
apt-get autoremove
|
||||
|
||||
if [[ -f /var/run/reboot-required ]]
|
||||
then
|
||||
date | mail -s "SYSREBOOTNOW $(cat /etc/node.name)" ${data['mail']}
|
||||
systemctl reboot
|
||||
fi
|
||||
|
|
@ -23,18 +23,13 @@ actions = {
|
|||
}
|
||||
|
||||
files = {
|
||||
'/etc/apt/apt.conf.d/50unattended-upgrades': {
|
||||
'/usr/local/sbin/upgrade-and-reboot': {
|
||||
'content_type': 'mako',
|
||||
'source': 'apt.conf-unattended-upgrades',
|
||||
'mode': '0700',
|
||||
'context': {
|
||||
'data': node.metadata.get('apt', {}).get('unattended-upgrades', {}),
|
||||
'node_has_backports': ('backports' in node.metadata.get('apt', {}).get('repos', {})),
|
||||
'os_release': supported_os[node.os][node.os_version[0]],
|
||||
}
|
||||
},
|
||||
'/etc/apt/apt.conf.d/20auto-upgrades': {
|
||||
'source': 'apt.conf-auto-upgrades',
|
||||
},
|
||||
'/etc/cloud': {
|
||||
'delete': True,
|
||||
},
|
||||
|
|
@ -63,7 +58,6 @@ directories = {
|
|||
|
||||
pkg_apt = {
|
||||
'apt-transport-https': {},
|
||||
'unattended-upgrades': {},
|
||||
|
||||
'arping': {},
|
||||
'at': {},
|
||||
|
|
@ -112,6 +106,9 @@ pkg_apt = {
|
|||
'popularity-contest': {
|
||||
'installed': False,
|
||||
},
|
||||
'unattended-upgrades': {
|
||||
'installed': False,
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
7
bundles/apt/metadata.py
Normal file
7
bundles/apt/metadata.py
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
defaults = {
|
||||
'cron': {
|
||||
'upgrade-and-reboot': '{minute} 1 * * 5 root /usr/local/sbin/upgrade-and-reboot'.format(
|
||||
minute=node.magic_number % 30,
|
||||
),
|
||||
},
|
||||
}
|
||||
|
|
@ -7,11 +7,6 @@ defaults = {
|
|||
],
|
||||
},
|
||||
},
|
||||
'unattended-upgrades': {
|
||||
'origins': {
|
||||
'o=jenkins.io,a=binary',
|
||||
},
|
||||
},
|
||||
'packages': {
|
||||
'openjdk-11-jre': {},
|
||||
'jenkins': {
|
||||
|
|
|
|||
|
|
@ -7,11 +7,6 @@ defaults = {
|
|||
],
|
||||
},
|
||||
},
|
||||
'unattended-upgrades': {
|
||||
'origins': {
|
||||
'o=matrix.org,n=buster,c=main',
|
||||
},
|
||||
},
|
||||
'packages': {
|
||||
'matrix-synapse-py3': {},
|
||||
},
|
||||
|
|
|
|||
|
|
@ -7,11 +7,6 @@ defaults = {
|
|||
],
|
||||
},
|
||||
},
|
||||
'unattended-upgrades': {
|
||||
'origins': {
|
||||
'o=nginx,a=stable,l=nginx,c=nginx',
|
||||
},
|
||||
},
|
||||
'packages': {
|
||||
'nginx': {},
|
||||
},
|
||||
|
|
|
|||
|
|
@ -13,12 +13,6 @@ defaults = {
|
|||
],
|
||||
},
|
||||
},
|
||||
'unattended-upgrades': {
|
||||
'origins': {
|
||||
'o=Node Source,l=Node Source,c=main',
|
||||
'o=yarn,a=stable,n=stable,l=yarn-stable,c=main',
|
||||
},
|
||||
},
|
||||
'packages': {
|
||||
'nodejs': {},
|
||||
'yarn': {},
|
||||
|
|
|
|||
|
|
@ -43,21 +43,6 @@ nodes['htz.ex42-1048908'] = {
|
|||
'weechat-python': {},
|
||||
'weechat-ruby': {},
|
||||
},
|
||||
'unattended-upgrades': {
|
||||
'origins': {
|
||||
'site=weechat.org',
|
||||
|
||||
# TODO move to bundles
|
||||
'o=Rspamd,n=buster,l=Rspamd,c=main',
|
||||
|
||||
# FIXME We can't upgrade miniflux automatically,
|
||||
# because the apt package doesn't (currently?) do
|
||||
# database migrations by itself. This leads to
|
||||
# miniflux not starting up after being upgraded.
|
||||
#'site=apt.miniflux.app',
|
||||
},
|
||||
'reboot': False,
|
||||
},
|
||||
'repos': {
|
||||
'backports': {
|
||||
'install_gpg_key': False, # default debian signing key
|
||||
|
|
|
|||
Loading…
Reference in a new issue