.envrc

@@ -1,3 +0,0 @@
-layout python3
-
-source_env_if_exists .envrc.local

.gitignore

@@ -1,6 +1,3 @@
 .secrets.cfg*
 __pycache__
 *.swp
-.direnv
-.envrc.local
-.bw_debug_history

bundles/apt/files/sources.list-debian-trixie

@@ -1,3 +0,0 @@
-deb http://deb.debian.org/debian/ trixie main non-free contrib non-free-firmware
-deb http://security.debian.org/debian-security trixie-security main contrib non-free
-deb http://deb.debian.org/debian/ trixie-updates main contrib non-free

bundles/apt/files/sources.list-raspbian-buster

@@ -0,0 +1 @@
+deb http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi

bundles/apt/items.py

@@ -5,9 +5,11 @@ supported_os = {
         10: 'buster',
         11: 'bullseye',
         12: 'bookworm',
-        13: 'trixie',
         99: 'unstable',
     },
+    'raspbian': {
+        10: 'buster',
+    },
 }
 
 try:
@@ -25,10 +27,6 @@ actions = {
         'triggered': True,
         'cascade_skip': False,
     },
-    'apt_execute_update_commands': {
-        'command': ' && '.join(sorted(node.metadata.get('apt/additional_update_commands', {'true'}))),
-        'triggered': True,
-    },
 }
 
 files = {

bundles/apt/metadata.py

@@ -21,9 +21,6 @@ defaults = {
     'cron/jobs/upgrade-and-reboot'
 )
 def patchday(metadata):
-    if not node.metadata.get('apt/unattended-upgrades/enabled', True):
-        return {}
-
     day = metadata.get('apt/unattended-upgrades/day')
     hour = metadata.get('apt/unattended-upgrades/hour')
 

bundles/arch-with-gui/files/50-network.conf

@@ -0,0 +1,5 @@
+context.exec = [
+    { path = "pactl" args = "load-module module-native-protocol-tcp" }
+    { path = "pactl" args = "load-module module-zeroconf-discover" }
+    { path = "pactl" args = "load-module module-zeroconf-publish" }
+]

bundles/arch-with-gui/files/autologin.conf

@@ -0,0 +1,3 @@
+[Autologin]
+User=${user}
+Session=i3.desktop

bundles/arch-with-gui/items.py

@@ -0,0 +1,110 @@
+from os import listdir
+from os.path import join
+
+actions = {
+    'fc-cache_flush': {
+        'command': 'fc-cache -f',
+        'triggered': True,
+        'needs': {
+            'pkg_pacman:fontconfig',
+        },
+    },
+    'i3pystatus_create_virtualenv': {
+        'command': '/usr/bin/python3 -m virtualenv -p python3 /opt/i3pystatus/venv/',
+        'unless': 'test -d /opt/i3pystatus/venv/',
+        'needs': {
+            'directory:/opt/i3pystatus/src',
+            'pkg_pacman:python-virtualenv',
+        },
+    },
+    'i3pystatus_install': {
+        'command': ' && '.join([
+            'cd /opt/i3pystatus/src',
+            '/opt/i3pystatus/venv/bin/pip install --upgrade pip colour netifaces basiciw pytz',
+            '/opt/i3pystatus/venv/bin/pip install --upgrade -e .',
+        ]),
+        'needs': {
+            'action:i3pystatus_create_virtualenv',
+        },
+        'triggered': True,
+    },
+}
+
+directories = {
+    '/etc/sddm.conf.d': {
+        'purge': True,
+    },
+    '/opt/i3pystatus/src': {},
+    '/usr/share/fonts/bundlewrap': {
+        'purge': True,
+        'triggers': {
+            'action:fc-cache_flush',
+        },
+    },
+}
+
+svc_systemd = {
+    'avahi-daemon': {
+        'needs': {
+            'pkg_pacman:avahi',
+        },
+    },
+    'sddm': {
+        'needs': {
+            'pkg_pacman:sddm',
+        },
+    },
+}
+
+git_deploy = {
+    '/opt/i3pystatus/src': {
+        'repo': 'https://github.com/enkore/i3pystatus.git',
+        'rev': 'current',
+        'triggers': {
+            'action:i3pystatus_install',
+        },
+    },
+}
+
+files['/etc/pipewire/pipewire-pulse.conf.d/50-network.conf'] = {}
+
+for filename in listdir(join(repo.path, 'data', 'arch-with-gui', 'files', 'fonts')):
+    if filename.startswith('.'):
+        continue
+
+    if filename.endswith('.vault'):
+        # XXX remove this once we have a new bundlewrap release
+        # https://github.com/bundlewrap/bundlewrap/commit/2429b153dd1ca6781cf3812e2dec9c2b646a546b
+        from os import environ
+        if environ.get('BW_VAULT_DUMMY_MODE', '0') == '1':
+            continue
+
+        font_name = filename[:-6]
+        attrs = {
+            'content': repo.vault.decrypt_file_as_base64(join('arch-with-gui', 'files', 'fonts', filename)),
+            'content_type': 'base64',
+        }
+    else:
+        font_name = filename
+        attrs = {
+            'source': join('fonts', filename),
+            'content_type': 'binary',
+        }
+
+    files[f'/usr/share/fonts/bundlewrap/{font_name}'] = {
+        'triggers': {
+            'action:fc-cache_flush',
+        },
+        **attrs,
+    }
+
+if node.metadata.get('arch-with-gui/autologin_as', None):
+    files['/etc/sddm.conf.d/autologin.conf'] = {
+        'context': {
+            'user': node.metadata.get('arch-with-gui/autologin_as'),
+        },
+        'content_type': 'mako',
+        'before': {
+            'svc_systemd:sddm',
+        },
+    }

bundles/arch-with-gui/metadata.py

@@ -0,0 +1,124 @@
+assert node.os == 'arch'
+
+defaults = {
+    'backups': {
+        'paths': {
+            '/etc/netctl',
+        },
+    },
+    'icinga_options': {
+        'exclude_from_monitoring': True,
+    },
+    'nftables': {
+        'input': {
+            '50-avahi': {
+                'udp dport 5353 accept',
+                'udp sport 5353 accept',
+            },
+        },
+    },
+    'pacman': {
+        'packages': {
+            # fonts
+            'fontconfig': {},
+            'ttf-dejavu': {
+                'needed_by': {
+                    'pkg_pacman:sddm',
+                },
+            },
+
+            # login management
+            'sddm': {},
+
+            # networking
+            'avahi': {},
+            'netctl': {},
+            'rfkill': {},
+            'wpa_supplicant': {},
+            'wpa_actiond': {},
+
+            # shell and other gui stuff
+            'dunst': {},
+            'fish': {},
+            'kitty': {},
+            'libnotify': {}, # provides notify-send
+            'light': {},
+            'redshift': {},
+            'rofi': {},
+
+            # sound
+            'calf': {},
+            'easyeffects': {},
+            'lsp-plugins': {},
+            'pavucontrol': {},
+            'pipewire': {},
+            'pipewire-jack': {},
+            'pipewire-pulse': {},
+            'pipewire-zeroconf': {},
+            'qpwgraph': {},
+
+            # window management
+            'i3-wm': {},
+            'i3lock': {},
+            'xss-lock': {},
+
+            # i3pystatus dependencies
+            'iw': {},
+            'wireless_tools': {},
+
+            # Xorg
+            'xf86-input-libinput': {},
+            'xf86-input-wacom': {},
+            'xorg-server': {},
+            'xorg-setxkbmap': {},
+            'xorg-xev': {},
+            'xorg-xinput': {},
+            'xorg-xset': {},
+
+            # all them apps
+            'browserpass': {},
+            'browserpass-firefox': {},
+            'ffmpeg': {},
+            'firefox': {},
+            'gimp': {},
+            'imagemagick': {},
+            'inkscape': {},
+            'kdenlive': {},
+            'maim': {},
+            'mosh': {},
+            'mosquitto': {},
+            'mpv': {},
+            'pass': {},
+            'pass-otp': {},
+            'pdftk': {},
+            'pwgen': {},
+            'qpdfview': {},
+            'samba': {},
+            'shotcut': {},
+            'sipcalc': {},
+            'the_silver_searcher': {},
+            'tlp': {},
+            'virt-manager': {},
+            'xclip': {},
+            'xdotool': {}, # needed for maim window selection
+        },
+    },
+}
+
+@metadata_reactor.provides(
+    'backups/paths',
+)
+def backup_every_user_home(metadata):
+    paths = set()
+
+    for user, config in metadata.get('users', {}).items():
+        if config.get('delete', False):
+            continue
+
+        paths.add(config.get('home', f'/home/{user}'))
+
+    return {
+        'backups': {
+            'paths': paths,
+        },
+    }

bundles/avahi-daemon/files/avahi-daemon.conf

@@ -1,22 +0,0 @@
-[server]
-host-name=${node.name.split('.')[-1]}
-use-ipv4=yes
-use-ipv6=${'yes' if node.metadata.get('avahi-daemon/use-ipv6') else 'no'}
-allow-interfaces=${','.join(sorted(node.metadata.get('interfaces', {}).keys()))}
-ratelimit-interval-usec=1000000
-ratelimit-burst=1000
-
-[wide-area]
-enable-wide-area=yes
-
-[publish]
-disable-publishing=no
-disable-user-service-publishing=no
-publish-hinfo=yes
-publish-workstation=no
-publish-aaaa-on-ipv4=no
-publish-a-on-ipv6=no
-
-[reflector]
-
-[rlimits]

bundles/avahi-daemon/items.py

@@ -1,18 +0,0 @@
-directories['/etc/avahi/services'] = {
-    'purge': True,
-}
-
-files['/etc/avahi/avahi-daemon.conf'] = {
-    'content_type': 'mako',
-    'triggers': {
-        'svc_systemd:avahi-daemon:restart',
-    },
-}
-
-svc_systemd['avahi-daemon'] = {
-    'needs': {
-        'file:/etc/avahi/avahi-daemon.conf',
-        'pkg_apt:avahi-daemon',
-        'pkg_apt:libnss-mdns',
-    },
-}

bundles/avahi-daemon/metadata.py

@@ -1,11 +0,0 @@
-defaults = {
-    'apt': {
-        'packages': {
-            'avahi-daemon': {},
-            'libnss-mdns': {},
-        },
-    },
-    'avahi-daemon': {
-        'use-ipv6': True,
-    }
-}

bundles/backup-client/files/generate-backup

@@ -62,13 +62,10 @@ trap "on_exit" EXIT
 
 # redirect stdout and stderr to logfile
 prepare_and_cleanup_logdir
-if [[ -z "$DEBUG" ]]
+logfile="$logdir/backup--$(date '+%F--%H-%M-%S')--$$.log.gz"
-then
+echo "All log output will go to $logfile" | logger -it backup-client
-    logfile="$logdir/backup--$(date '+%F--%H-%M-%S')--$$.log.gz"
+exec > >(gzip >"$logfile")
-    echo "All log output will go to $logfile" | logger -it backup-client
+exec 2>&1
-    exec > >(gzip >"$logfile")
-    exec 2>&1
-fi
 
 # this is where the real work starts
 ts_begin=$(date +%s)

bundles/backup-server/files/check_backup_for_node

@@ -2,6 +2,7 @@
 
 from datetime import datetime
 from json import load
+from subprocess import check_output
 from sys import argv, exit
 from time import time
 
@@ -17,17 +18,29 @@ try:
     with open(f'/etc/backup-server/config.json', 'r') as f:
         server_settings = load(f)
 
-    with open(f'/etc/backup-server/backups.json', 'r') as f:
+    # get all existing snapshots for NODE
-        backups = load(f)
+    for line in check_output('LC_ALL=C zfs list -H -t snapshot -o name', shell=True).splitlines():
+        line = line.decode('UTF-8')
 
-    if NODE not in backups:
+        if line.startswith('{}/{}@'.format(server_settings['zfs-base'], NODE)):
+            _, snapname = line.split('@', 1)
+
+            if 'zfs-auto-snap' in snapname:
+                # migration from auto-snapshots, ignore
+                continue
+
+            ts, bucket = snapname.split('-', 1)
+            snaps.add(int(ts))
+
+    if not snaps:
         print('No backups found!')
         exit(2)
 
-    delta = NOW - backups[NODE]
+    last_snap = sorted(snaps)[-1]
+    delta = NOW - last_snap
 
     print('Last backup was on {} UTC'.format(
-        datetime.fromtimestamp(backups[NODE]).strftime('%Y-%m-%d %H:%M:%S'),
+        datetime.fromtimestamp(last_snap).strftime('%Y-%m-%d %H:%M:%S'),
     ))
 
     # One day without backups is still okay. There may be fluctuations

bundles/backup-server/files/check_backup_for_node-cron

@@ -1,39 +0,0 @@
-#!/usr/bin/env python3
-
-from json import load, dump
-from subprocess import check_output
-from shutil import move
-from os import remove
-from collections import defaultdict
-
-with open('/etc/backup-server/config.json', 'r') as f:
-    server_settings = load(f)
-
-snapshots = defaultdict(set)
-
-for line in check_output('LC_ALL=C zfs list -H -t snapshot -o name', shell=True).splitlines():
-    line = line.decode('UTF-8')
-
-    if line.startswith('{}/'.format(server_settings['zfs-base'])):
-        dataset, snapname = line.split('@', 1)
-
-        dataset = dataset.split('/')[-1]
-        ts, bucket = snapname.split('-', 1)
-
-        if not ts.isdigit():
-            # garbage, ignore
-            continue
-
-        snapshots[dataset].add(int(ts))
-
-backups = {}
-for dataset, snaps in snapshots.items():
-    backups[dataset] = sorted(snaps)[-1]
-
-with open('/etc/backup-server/backups.tmp.json', 'w') as f:
-    dump(backups, f)
-
-move(
-    '/etc/backup-server/backups.tmp.json',
-    '/etc/backup-server/backups.json',
-)

bundles/backup-server/files/rotate-single-backup-client

@@ -33,11 +33,12 @@ for line in check_output('LC_ALL=C zfs list -H -t snapshot -o name', shell=True)
 
     if line.startswith('{}/{}@'.format(server_settings['zfs-base'], NODE)):
         _, snapname = line.split('@', 1)
-        ts, bucket = snapname.split('-', 1)
 
-        if not ts.isdigit():
+        if 'zfs-auto-snap' in snapname:
+            # migration from auto-snapshots, ignore
             continue
 
+        ts, bucket = snapname.split('-', 1)
         buckets.setdefault(bucket, set()).add(int(ts))
         syslog(f'classified {line} as {bucket} from {ts}')
 

bundles/backup-server/items.py

@@ -18,9 +18,6 @@ files = {
     '/usr/local/share/icinga/plugins/check_backup_for_node': {
         'mode': '0755',
     },
-    '/usr/local/share/icinga/plugins/check_backup_for_node-cron': {
-        'mode': '0755',
-    },
 }
 
 directories['/etc/backup-server/clients'] = {

bundles/backup-server/metadata.py

@@ -1,5 +1,3 @@
-from bundlewrap.exceptions import BundleError
-
 defaults = {
     'backup-server': {
         'my_ssh_port': 22,
@@ -10,14 +8,6 @@ defaults = {
             'c-*',
         },
     },
-    'systemd-timers': {
-        'timers': {
-            'check_backup_for_node-cron': {
-                'command': '/usr/local/share/icinga/plugins/check_backup_for_node-cron',
-                'when': '*-*-* *:00/5:00', # every five minutes
-            }
-        },
-    },
     'zfs': {
         # The whole point of doing backups is to keep them for a long
         # time, which eliminates the need for this check.
@@ -79,51 +69,25 @@ def zfs_pool(metadata):
         return {}
 
     crypt_devices = {}
+    pool_devices = set()
     unlock_actions = set()
 
-    devices = metadata.get('backup-server/encrypted-devices')
+    for number, (device, passphrase) in enumerate(sorted(metadata.get('backup-server/encrypted-devices', {}).items())):
+        crypt_devices[device] = {
+            'dm-name': f'backup{number}',
+            'passphrase': passphrase,
+        }
+        pool_devices.add(f'/dev/mapper/backup{number}')
+        unlock_actions.add(f'action:dm-crypt_open_backup{number}')
 
-    # TODO remove this once we have migrated all systems
+    pool_opts = {
-    if isinstance(devices, dict):
+        'devices': pool_devices,
-        pool_devices = set()
+    }
 
-        for number, (device, passphrase) in enumerate(sorted(devices.items())):
+    if len(pool_devices) > 2:
-            crypt_devices[device] = {
+        pool_opts['type'] = 'raidz'
-                'dm-name': f'backup{number}',
+    elif len(pool_devices) > 1:
-                'passphrase': passphrase,
+        pool_opts['type'] = 'mirror'
-            }
-            pool_devices.add(f'/dev/mapper/backup{number}')
-            unlock_actions.add(f'action:dm-crypt_open_backup{number}')
-
-        pool_config = [{
-            'devices': pool_devices,
-        }]
-
-        if len(pool_devices) > 2:
-            pool_config[0]['type'] = 'raidz'
-        elif len(pool_devices) > 1:
-            pool_config[0]['type'] = 'mirror'
-
-    elif isinstance(devices, list):
-        pool_config = []
-
-        for idx, intended_pool in enumerate(devices):
-            pool_devices = set()
-
-            for number, (device, passphrase) in enumerate(sorted(intended_pool.items())):
-                crypt_devices[device] = {
-                    'dm-name': f'backup{idx}-{number}',
-                    'passphrase': passphrase,
-                }
-                pool_devices.add(f'/dev/mapper/backup{idx}-{number}')
-                unlock_actions.add(f'action:dm-crypt_open_backup{idx}-{number}')
-
-            pool_config.append({
-                'devices': pool_devices,
-                'type': 'raidz',
-            })
-    else:
-        raise BundleError(f'{node.name}: unsupported configuration for backup-server/encrypted-devices')
 
     return {
         'backup-server': {
@@ -136,8 +100,9 @@ def zfs_pool(metadata):
             'pools': {
                 'backups': {
                     'when_creating': {
-                        'config': pool_config,
+                        'config': [
-                        **metadata.get('backup-server/zpool_create_options', {}),
+                            pool_opts,
+                        ],
                     },
                     'needs': unlock_actions,
                     # That's a bit hacky. We do it this way to auto-import
@@ -191,11 +156,11 @@ def monitoring(metadata):
             continue
 
         services[f'BACKUPS FOR NODE {client}'] = {
-            'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_backup_for_node {} {}'.format(
+            'command_on_monitored_host': 'sudo /usr/local/share/icinga/plugins/check_backup_for_node {} {}'.format(
                 client,
                 config['one_backup_every_hours'],
             ),
-            'vars.sshmon_timeout': 40,
+            'vars.sshmon_timeout': 20,
         }
 
     return {

bundles/basic/items.py

@@ -24,6 +24,7 @@ files = {
         'before': {
             'action:',
             'pkg_apt:',
+            'pkg_pacman:',
         },
     },
 }

bundles/bird/items.py

@@ -1,5 +1,10 @@
+if node.os == 'arch':
+    filename = '/etc/bird.conf'
+else:
+    filename = '/etc/bird/bird.conf'
+
 files = {
-    '/etc/bird/bird.conf': {
+    filename: {
         'content_type': 'mako',
         'triggers': {
             'svc_systemd:bird:reload',
@@ -10,7 +15,7 @@ files = {
 svc_systemd = {
     'bird': {
         'needs': {
-            f'file:/etc/bird/bird.conf',
+            f'file:{filename}',
         },
     },
 }

bundles/bird/metadata.py

@@ -13,6 +13,15 @@ defaults = {
             },
         },
     },
+    'pacman': {
+        'packages': {
+            'bird': {
+                'needed_by': {
+                    'svc_systemd:bird',
+                },
+            },
+        },
+    },
     'sysctl': {
         'options': {
             'net.ipv4.conf.all.forwarding': '1',

bundles/c3voc-addons/items.py

@@ -7,6 +7,9 @@ supported_os = {
         12: 'bookworm',
         99: 'unstable',
     },
+    'raspbian': {
+        10: 'buster',
+    },
 }
 
 try:
@@ -79,10 +82,6 @@ actions = {
         'triggered': True,
         'cascade_skip': False,
     },
-    'apt_execute_update_commands': {
-        'command': ' && '.join(sorted(node.metadata.get('apt/additional_update_commands', {'true'}))),
-        'triggered': True,
-    },
 }
 
 directories = {

bundles/cron/items.py

@@ -1,3 +1,10 @@
+if node.os == 'arch':
+    service_name = 'cronie'
+    package_name = 'pkg_pacman:cronie'
+else:
+    service_name = 'cron'
+    package_name = 'pkg_apt:cron'
+
 files = {
     '/etc/crontab': {
         'content_type': 'mako',
@@ -17,9 +24,9 @@ directories = {
 }
 
 svc_systemd = {
-    'cron': {
+    service_name: {
         'needs': {
-            'pkg_apt:cron',
+            package_name,
         },
     },
 }

bundles/cron/metadata.py

@@ -4,4 +4,9 @@ defaults = {
             'cron': {},
         },
     },
+    'pacman': {
+        'packages': {
+            'cronie': {},
+        },
+    },
 }

bundles/docker-engine/files/check_docker_container

@@ -1,45 +0,0 @@
-#!/usr/bin/env python3
-
-from json import loads
-from subprocess import check_output
-from sys import argv
-
-try:
-    container_name = argv[1]
-
-    docker_ps = check_output([
-        'docker',
-        'container',
-        'ls',
-        '--all',
-        '--format',
-        'json',
-        '--filter',
-        f'name={container_name}'
-    ])
-
-    docker_json = loads(f"[{','.join([l for l in docker_ps.decode().splitlines() if l])}]")
-
-    containers = [
-        container
-        for container in docker_json
-        if container['Names'] == container_name
-    ]
-
-    if not containers:
-        print(f'CRITICAL: container {container_name} not found!')
-        exit(2)
-
-    if len(containers) > 1:
-        print(f'Found more than one container matching {container_name}!')
-        print(docker_ps)
-        exit(3)
-
-    if containers[0]['State'] != 'running':
-        print(f'WARNING: container {container_name} not "running"')
-        exit(2)
-
-    print(f"OK: {containers[0]['Status']}")
-except Exception as e:
-    print(repr(e))
-    exit(2)

bundles/docker-engine/files/docker-wrapper

@@ -1,67 +0,0 @@
-#!/bin/bash
-
-[[ -n "$DEBUG" ]] && set -x
-
-ACTION="$1"
-
-set -euo pipefail
-
-if [[ -z "$ACTION" ]]
-then
-    echo "Usage: $0 start|stop"
-    exit 1
-fi
-
-PUID="$(id -u "${user}")"
-PGID="$(id -g "${user}")"
-
-if [ "$ACTION" == "start" ]
-then
-    # just exit if the container is actually running already.
-    set +e
-    /usr/local/share/icinga/plugins/check_docker_container "${name}" && exit 0
-    set -e
-
-    docker rm "${name}" || true
-
-    docker pull "${image}"
-
-    docker run -d \
-        --name "${name}" \
-        --env "PUID=$PUID" \
-        --env "PGID=$PGID" \
-        --env "TZ=${timezone}" \
-% for k, v in sorted(environment.items()):
-        --env "${k}=${v}" \
-% endfor
-        --network aaarghhh \
-% for host_port, container_port in sorted(ports.items()):
-        --publish "127.0.0.1:${host_port}:${container_port}" \
-% endfor
-% for host_path, container_path in sorted(volumes.items()):
-%  if host_path.startswith('/'):
-        --volume "${host_path}:${container_path}" \
-%  else:
-        --volume "/var/opt/docker-engine/${name}/${host_path}:${container_path}" \
-%  endif
-% endfor
-        --restart unless-stopped \
-% if command:
-        "${image}" \
-        "${command}"
-% else:
-        "${image}"
-% endif
-
-elif [ "$ACTION" == "stop" ]
-then
-    docker stop "${name}"
-
-else
-    echo "Unknown action $ACTION"
-    exit 1
-fi
-
-% if node.has_bundle('nftables'):
-systemctl reload nftables
-% endif

bundles/docker-engine/files/docker-wrapper.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=docker-engine app ${name}
-After=network.target
-Requires=${' '.join(sorted(requires))}
-
-[Service]
-WorkingDirectory=/var/opt/docker-engine/${name}/
-ExecStart=/opt/docker-engine/${name} start
-ExecStop=/opt/docker-engine/${name} stop
-Type=simple
-RemainAfterExit=true
-
-[Install]
-WantedBy=multi-user.target

bundles/docker-engine/items.py

@@ -1,126 +0,0 @@
-from bundlewrap.metadata import metadata_to_json
-
-deps = {
-    'pkg_apt:docker-ce',
-    'pkg_apt:docker-ce-cli',
-}
-
-directories['/opt/docker-engine'] = {
-    'purge': True,
-}
-directories['/var/opt/docker-engine'] = {}
-
-files['/etc/docker/daemon.json'] = {
-    'content': metadata_to_json(node.metadata.get('docker-engine/config')),
-    'triggers': {
-        'svc_systemd:docker:restart',
-    },
-    # install config before installing packages to ensure the config is
-    # applied to the first start as well
-    'before': deps,
-}
-
-svc_systemd['docker'] = {
-    'needs': deps,
-}
-
-files['/usr/local/share/icinga/plugins/check_docker_container'] = {
-    'mode': '0755',
-}
-
-actions['docker_create_nondefault_network'] = {
-    # <https://docs.docker.com/engine/network/#dns-services>
-    # By default, containers inherit the DNS settings as defined in the
-    # /etc/resolv.conf configuration file. Containers that attach to the
-    # default bridge network receive a copy of this file. Containers that
-    # attach to a custom network use Docker's embedded DNS server. The embedded
-    # DNS server forwards external DNS lookups to the DNS servers configured on
-    # the host.
-    'command': 'docker network create aaarghhh',
-    'unless': 'docker network ls | grep -q -F aaarghhh',
-    'needs': {
-        'svc_systemd:docker',
-    },
-}
-
-for app, config in node.metadata.get('docker-engine/containers', {}).items():
-    volumes = config.get('volumes', {})
-    user = config.get('user', f'docker-{app}')
-    directories[f'/var/opt/docker-engine/{app}'] = {
-        'owner': user,
-        'group': user,
-    }
-
-    files[f'/opt/docker-engine/{app}'] = {
-        'source': 'docker-wrapper',
-        'content_type': 'mako',
-        'context': {
-            'command': config.get('command'),
-            'environment': config.get('environment', {}),
-            'image': config['image'],
-            'name': app,
-            'ports': config.get('ports', {}),
-            'timezone': node.metadata.get('timezone'),
-            'user': user,
-            'volumes': volumes,
-        },
-        'mode': '0755',
-        'triggers': {
-            f'svc_systemd:docker-{app}:restart',
-        },
-    }
-
-    users[user] = {
-        'groups': {
-            'docker',
-        },
-        'after': {
-            'action:docker_create_nondefault_network',
-            'svc_systemd:docker',
-        },
-    }
-    if user == f'docker-{app}':
-        users[user]['home'] = f'/var/opt/docker-engine/{app}'
-
-    files[f'/usr/local/lib/systemd/system/docker-{app}.service'] = {
-        'source': 'docker-wrapper.service',
-        'content_type': 'mako',
-        'context': {
-            'name': app,
-            'requires': {
-                *set(config.get('requires', set())),
-                'docker.service',
-            }
-        },
-        'triggers': {
-            'action:systemd-reload',
-            f'svc_systemd:docker-{app}:restart',
-        },
-    }
-
-    svc_systemd[f'docker-{app}'] = {
-        'needs': {
-            *deps,
-            f'directory:/var/opt/docker-engine/{app}',
-            f'file:/opt/docker-engine/{app}',
-            f'file:/usr/local/lib/systemd/system/docker-{app}.service',
-            f'user:{user}',
-            'svc_systemd:docker',
-            *set(config.get('needs', set())),
-        },
-    }
-
-    for volume in volumes:
-        if not volume.startswith('/'):
-            volume = f'/var/opt/docker-engine/{app}/{volume}'
-
-        directories[volume] = {
-            'owner': user,
-            'group': user,
-            'needed_by': {
-                f'svc_systemd:docker-{app}',
-            },
-            # don't do anything if the directory exists, docker images
-            # mangle owners
-            'unless': f'test -d {volume}',
-        }

bundles/docker-engine/metadata.py

@@ -1,92 +0,0 @@
-defaults = {
-    'apt': {
-        'packages': {
-            'docker-ce': {},
-            'docker-ce-cli': {},
-            'docker-compose-plugin': {},
-        },
-        'repos': {
-            'docker': {
-                'items': {
-                    'deb https://download.docker.com/linux/debian {os_release} stable',
-                },
-            },
-        },
-    },
-    'nftables': {
-        'forward': {
-            'docker-engine': [
-                'ct state { related, established } accept',
-                'ip saddr 172.16.0.0/12 accept',
-            ],
-        },
-        'postrouting': {
-            'docker-engine': [
-                'ip saddr 172.16.0.0/12 masquerade',
-            ],
-        },
-    },
-    'docker-engine': {
-        'config': {
-            'iptables': False,
-            'no-new-privileges': True,
-        },
-    },
-    'zfs': {
-        'datasets': {
-            'tank/docker-data': {},
-        },
-    },
-}
-
-
-@metadata_reactor.provides(
-    'icinga2_api/docker-engine/services',
-)
-def monitoring(metadata):
-    services = {
-        'DOCKER PROCESS': {
-            'command_on_monitored_host': '/usr/lib/nagios/plugins/check_procs -C dockerd -c 1:',
-        },
-    }
-
-    for app in metadata.get('docker-engine/containers', {}):
-        services[f'DOCKER CONTAINER {app}'] = {
-            'command_on_monitored_host': f'sudo /usr/local/share/icinga/plugins/check_docker_container {app}'
-        }
-
-    return {
-        'icinga2_api': {
-            'docker-engine': {
-                'services': services,
-            },
-        },
-    }
-
-
-@metadata_reactor.provides(
-    'backups/paths',
-    'zfs/datasets',
-)
-def zfs(metadata):
-    datasets = {}
-
-    for app in metadata.get('docker-engine/containers', {}):
-        datasets[f'tank/docker-data/{app}'] = {
-            'mountpoint': f'/var/opt/docker-engine/{app}',
-            'needed_by': {
-                f'directory:/var/opt/docker-engine/{app}',
-            },
-        }
-
-    return {
-        'backups': {
-            'paths': {
-                v['mountpoint']
-                for v in datasets.values()
-            },
-        },
-        'zfs': {
-            'datasets': datasets,
-        },
-    }

bundles/docker-goauthentik/metadata.py

@@ -1,89 +0,0 @@
-assert node.has_bundle('docker-engine')
-
-defaults = {
-    'docker-engine': {
-        'containers': {
-            'goauthentik-server': {
-                'image': 'ghcr.io/goauthentik/server:latest',
-                'command': 'server',
-                'environment': {
-                    'AUTHENTIK_POSTGRESQL__HOST': 'goauthentik-postgresql',
-                    'AUTHENTIK_POSTGRESQL__NAME': 'goauthentik',
-                    'AUTHENTIK_POSTGRESQL__PASSWORD': repo.vault.password_for(f'{node.name} postgresql goauthentik'),
-                    'AUTHENTIK_POSTGRESQL__USER': 'goauthentik',
-                    'AUTHENTIK_REDIS__HOST': 'goauthentik-redis',
-                    'AUTHENTIK_SECRET_KEY': repo.vault.password_for(f'{node.name} goauthentik secret key'),
-                },
-                'volumes': {
-                    'media': '/media',
-                    'templates': '/templates',
-                },
-                'ports': {
-                    '9000': '9000',
-                    '9443': '9443',
-                },
-                'needs': {
-                    'svc_systemd:docker-goauthentik-postgresql',
-                    'svc_systemd:docker-goauthentik-redis',
-                },
-                'requires': {
-                    'docker-goauthentik-postgresql.service',
-                    'docker-goauthentik-redis.service',
-                },
-            },
-            'goauthentik-worker': {
-                'image': 'ghcr.io/goauthentik/server:latest',
-                'command': 'worker',
-                'user': 'docker-goauthentik-server',
-                'environment': {
-                    'AUTHENTIK_POSTGRESQL__HOST': 'goauthentik-postgresql',
-                    'AUTHENTIK_POSTGRESQL__NAME': 'goauthentik',
-                    'AUTHENTIK_POSTGRESQL__PASSWORD': repo.vault.password_for(f'{node.name} postgresql goauthentik'),
-                    'AUTHENTIK_POSTGRESQL__USER': 'goauthentik',
-                    'AUTHENTIK_REDIS__HOST': 'goauthentik-redis',
-                    'AUTHENTIK_SECRET_KEY': repo.vault.password_for(f'{node.name} goauthentik secret key'),
-                },
-                'volumes': {
-                    '/var/opt/docker-engine/goauthentik-server/media': '/media',
-                    '/var/opt/docker-engine/goauthentik-server/certs': '/certs',
-                    '/var/opt/docker-engine/goauthentik-server/templates': '/templates',
-                },
-                'needs': {
-                    'svc_systemd:docker-goauthentik-postgresql',
-                    'svc_systemd:docker-goauthentik-redis',
-                },
-                'requires': {
-                    'docker-goauthentik-postgresql.service',
-                    'docker-goauthentik-redis.service',
-                },
-            },
-            'goauthentik-postgresql': {
-                'image': 'docker.io/library/postgres:16-alpine',
-                'environment': {
-                    'POSTGRES_PASSWORD': repo.vault.password_for(f'{node.name} postgresql goauthentik'),
-                    'POSTGRES_USER': 'goauthentik',
-                    'POSTGRES_DB': 'goauthentik',
-                },
-                'volumes': {
-                    'database': '/var/lib/postgresql/data',
-                },
-            },
-            'goauthentik-redis': {
-                'image': 'docker.io/library/redis:alpine',
-            },
-        },
-    },
-    'nginx': {
-        'vhosts': {
-            'goauthentik': {
-                'locations': {
-                    '/': {
-                        'target': 'http://127.0.0.1:9000/',
-                        'websockets': True,
-                        'max_body_size': '5000m',
-                    },
-                },
-            },
-        },
-    },
-}

bundles/docker-immich/files/immich-auto-album-share.py

@@ -1,80 +0,0 @@
-#!/usr/bin/env python3
-
-from json import loads
-from os import environ
-from subprocess import check_output
-from sys import exit
-
-import psycopg2
-
-PSQL_HOST = environ['DB_HOSTNAME']
-PSQL_USER = environ['DB_USERNAME']
-PSQL_PASS = environ['DB_PASSWORD']
-PSQL_DB = environ['DB_DATABASE_NAME']
-
-docker_networks = loads(check_output(['docker', 'network', 'inspect', 'aaarghhh']))
-
-container_ip = None
-# why the fuck is this a list of networks, even though we have to provide
-# a network name to inspect ...
-for network in docker_networks:
-    if network['Name'] != 'aaarghhh':
-        continue
-
-    for _, container in network['Containers'].items():
-        if container['Name'] == PSQL_HOST:
-            container_ip = container['IPv4Address'].split('/')[0]
-
-if not container_ip:
-    print(f'could not find ip address for container {PSQL_HOST=} in json')
-    print(docker_networks)
-    exit(1)
-
-print(f'{PSQL_HOST=} {container_ip=}')
-
-conn = psycopg2.connect(
-    dbname=PSQL_DB,
-    host=container_ip,
-    password=PSQL_PASS,
-    user=PSQL_USER,
-)
-
-with conn:
-    with conn.cursor() as cur:
-        cur.execute('SELECT "id","ownerId","albumName" FROM albums;')
-        albums = {
-            i[0]: {
-                'owner': i[1],
-                'name': i[2],
-            }
-            for i in cur.fetchall()
-        }
-
-    with conn.cursor() as cur:
-        cur.execute('SELECT "id","name" FROM users;')
-        users = {
-            i[0]: i[1]
-            for i in cur.fetchall()
-        }
-
-for album_id, album in albums.items():
-    print(f'----- working on album: {album["name"]}')
-    with conn:
-        with conn.cursor() as cur:
-            cur.execute('SELECT "usersId" FROM albums_shared_users_users WHERE "albumsId" = %s;', (album_id,))
-            album_shares = [i[0] for i in cur.fetchall()]
-        print(f' album is shared with {len(album_shares)} users: {album_shares}')
-        for user_id, user_name in users.items():
-            if user_id == album['owner'] or user_id in album_shares:
-                continue
-
-            print(f' sharing album with user {user_name} ... ', end='')
-            with conn.cursor() as cur:
-                cur.execute(
-                    'INSERT INTO albums_shared_users_users ("albumsId","usersId","role") VALUES (%s, %s, %s);',
-                    (album_id, user_id, 'viewer'),
-                )
-            print('done')
-    print()
-
-conn.close()

bundles/docker-immich/items.py

@@ -1,3 +0,0 @@
-files['/usr/local/bin/immich-auto-album-share.py'] = {
-    'mode': '0755',
-}

bundles/docker-immich/metadata.py

@@ -1,92 +0,0 @@
-assert node.has_bundle('docker-engine')
-
-defaults = {
-    'apt': {
-        'packages': {
-            'python3-psycopg2': {},
-        },
-    },
-    'docker-engine': {
-        'containers': {
-            'immich': {
-                'image': 'ghcr.io/imagegenius/immich:latest',
-                'environment': {
-                    'DB_DATABASE_NAME': 'immich',
-                    'DB_HOSTNAME': 'immich-postgresql',
-                    'DB_PASSWORD': repo.vault.password_for(f'{node.name} postgresql immich'),
-                    'DB_USERNAME': 'immich',
-                    'REDIS_HOSTNAME': 'immich-redis',
-                },
-                'volumes': {
-                    'config': '/config',
-                    'libraries': '/libraries',
-                    'photos': '/photos',
-                },
-                'ports': {
-                    '8080': '8080',
-                },
-                'needs': {
-                    'svc_systemd:docker-immich-postgresql',
-                    'svc_systemd:docker-immich-redis',
-                },
-                'requires': {
-                    'docker-immich-postgresql.service',
-                    'docker-immich-redis.service',
-                },
-            },
-            'immich-postgresql': {
-                'image': 'tensorchord/pgvecto-rs:pg14-v0.2.0',
-                'environment': {
-                    'POSTGRES_PASSWORD': repo.vault.password_for(f'{node.name} postgresql immich'),
-                    'POSTGRES_USER': 'immich',
-                    'POSTGRES_DB': 'immich',
-                },
-                'volumes': {
-                    'database': '/var/lib/postgresql/data',
-                },
-            },
-            'immich-redis': {
-                'image': 'docker.io/redis:6.2-alpine',
-            },
-        },
-    },
-    'docker-immich': {
-        'enable_auto_album_share': False,
-    },
-    'nginx': {
-        'vhosts': {
-            'immich': {
-                'locations': {
-                    '/': {
-                        'target': 'http://127.0.0.1:8080/',
-                        'websockets': True,
-                        'max_body_size': '5000m',
-                    },
-                },
-            },
-        },
-    },
-}
-
-
-@metadata_reactor.provides(
-    'systemd-timers/timers/immich-auto-album-share',
-)
-def auto_album_share(metadata):
-    if not metadata.get('docker-immich/enable_auto_album_share'):
-        return {}
-
-    return {
-        'systemd-timers': {
-            'timers': {
-                'immich-auto-album-share': {
-                    'command': '/usr/local/bin/immich-auto-album-share.py',
-                    'environment': metadata.get('docker-engine/containers/immich/environment'),
-                    'when': 'minutely',
-                    'requisite': {
-                        'docker-immich-postgresql.service',
-                    },
-                },
-            },
-        },
-    }

bundles/dovecot/files/dovecot.conf

@@ -29,8 +29,8 @@ mail_location = maildir:/var/mail/vmail/%d/%n
 protocols = imap lmtp sieve
 
 ssl = required
-ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/fullchain.pem
+ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/fullchain.pem
-ssl_key =  </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/privkey.pem
+ssl_key =  </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/privkey.pem
 ssl_dh = </etc/ssl/certs/dhparam.pem
 ssl_min_protocol = TLSv1.2
 ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305

bundles/element-web/items.py

@@ -33,7 +33,7 @@ actions = {
             'yarn build',
         ]),
         'needs': {
-            'action:apt_execute_update_commands',
+            'action:nodejs_install_yarn',
             'pkg_apt:nodejs',
         },
         'triggered': True,

bundles/element-web/metadata.py

@@ -11,26 +11,6 @@ defaults = {
     },
 }
 
-@metadata_reactor.provides(
-    'nodejs/version',
-)
-def nodejs(metadata):
-    version = tuple([int(i) for i in metadata.get('element-web/version')[1:].split('.')])
-
-    if version >= (1, 11, 71):
-        return {
-            'nodejs': {
-                'version': 22,
-            },
-        }
-    else:
-        return {
-            'nodejs': {
-                'version': 18,
-            },
-        }
-
-
 @metadata_reactor.provides(
     'nginx/vhosts/element-web',
 )

bundles/forgejo/metadata.py

@@ -100,7 +100,7 @@ def nginx(metadata):
                         },
                     },
                     'website_check_path': '/user/login',
-                    'website_check_string': 'Sign in',
+                    'website_check_string': 'Sign In',
                 },
             },
         },

bundles/grafana/metadata.py

@@ -43,7 +43,6 @@ def nginx(metadata):
                     'locations': {
                         '/': {
                             'target': 'http://127.0.0.1:21010',
-                            'websockets': True,
                         },
                         '/api/ds/query': {
                             'target': 'http://127.0.0.1:21010',

bundles/hedgedoc/items.py

@@ -72,6 +72,7 @@ actions = {
             'yarn build',
         ]),
         'needs': {
+            'action:nodejs_install_yarn',
             'file:/opt/hedgedoc/config.json',
             'git_deploy:/opt/hedgedoc',
             'pkg_apt:nodejs',

bundles/homeassistant/files/check_homeassistant_update

@@ -2,42 +2,48 @@
 
 from sys import exit
 
-from packaging.version import parse
+import requests
-from requests import get
+from packaging import version
 
-API_TOKEN = "${token}"
+bearer = "${bearer}"
-DOMAIN = "${domain}"
+domain = "${domain}"
+OK = 0
+WARN = 1
+CRITICAL = 2
+UNKNOWN = 3
+
+status = 3
+message = "Unknown Update Status"
+
+
+domain = "hass.home.kunbox.net"
+
+s = requests.Session()
+s.headers.update({"Content-Type": "application/json"})
 
 try:
-    r = get("https://version.home-assistant.io/stable.json")
+    stable_version = version.parse(
-    r.raise_for_status()
+        s.get("https://version.home-assistant.io/stable.json").json()["homeassistant"][
-    stable_version = parse(r.json()["homeassistant"]["generic-x86-64"])
+            "generic-x86-64"
-except Exception as e:
+        ]
-    print(f"Could not get stable version information from home-assistant.io: {e!r}")
-    exit(3)
-
-try:
-    r = get(
-        f"https://{DOMAIN}/api/config",
-        headers={"Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json"},
     )
-    r.raise_for_status()
+    s.headers.update(
-    running_version = parse(r.json()["version"])
+        {"Authorization": f"Bearer {bearer}", "Content-Type": "application/json"}
-except Exception as e:
+    )
-    print(f"Could not get running version information from homeassistant: {e!r}")
+    running_version = version.parse(
-    exit(3)
+        s.get(f"https://{domain}/api/config").json()["version"]
-
+    )
-try:
+    if running_version == stable_version:
-    if stable_version > running_version:
+        status = 0
-        print(
+        message = f"OK - running version {running_version} equals stable version {stable_version}"
-            f"There is a newer version available: {stable_version} (currently installed: {running_version})"
+    elif running_version > stable_version:
-        )
+        status = 1
-        exit(2)
+        message = f"WARNING - stable version {stable_version} is lower than running version {running_version}, check if downgrade is necessary."
     else:
-        print(
+        status = 2
-            f"Currently running version {running_version} matches newest release on home-assistant.io"
+        message = f"CRITICAL - update necessary, running version {running_version} is lower than stable version {stable_version}"
-        )
-        exit(0)
 except Exception as e:
-    print(repr(e))
+    message = f"{message}: {repr(e)}"
-    exit(3)
+
+print(message)
+exit(status)

bundles/homeassistant/files/homeassistant.service

@@ -5,8 +5,6 @@ After=network-online.target
 [Service]
 Type=simple
 User=homeassistant
-Environment="VIRTUAL_ENV=/opt/homeassistant/venv"
-Environment="PATH=/opt/homeassistant/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 WorkingDirectory=/var/opt/homeassistant
 ExecStart=/opt/homeassistant/venv/bin/hass -c "/var/opt/homeassistant"
 RestartForceExitStatus=100

bundles/homeassistant/items.py

@@ -30,7 +30,7 @@ files = {
     '/usr/local/share/icinga/plugins/check_homeassistant_update': {
         'content_type': 'mako',
         'context': {
-            'token': node.metadata.get('homeassistant/api_secret'),
+            'bearer': repo.vault.decrypt(node.metadata.get('homeassistant/api_secret')),
             'domain': node.metadata.get('homeassistant/domain'),
         },
         'mode': '0755',

bundles/icinga2/files/check_spam_blocklist

@@ -50,13 +50,17 @@ def check_list(ip_list, blocklist, warn_ips):
         ]).decode().splitlines()
         for item in result:
             if item.startswith(';;'):
-                continue
+                msgs.append('{} - {}'.format(
-            msgs.append('{} listed in {} as {}'.format(
+                    blocklist,
-                ip,
+                    item,
-                blocklist,
+                ))
-                item,
+            else:
-            ))
+                msgs.append('{} listed in {} as {}'.format(
-            if item in warn_ips and returncode < 2:
+                    ip,
+                    blocklist,
+                    item,
+                ))
+            if (item in warn_ips or item.startswith(';;')) and returncode < 2:
                 returncode = 1
             else:
                 returncode = 2

bundles/icinga2/files/icinga2/hosts_template.conf

@@ -23,25 +23,6 @@ object Host "${rnode.name}" {
     vars.notification.mail = true
 }
 
-% if rnode.ipmi_hostname:
-object Host "${rnode.name} IPMI" {
-    import "generic-host"
-
-    address = "${rnode.ipmi_hostname}"
-
-    vars.location = "${rnode.metadata.get('location', 'unknown')}"
-    vars.os = "ipmi"
-
-    vars.pretty_name = "${rnode.metadata.get('icinga_options/pretty_name', rnode.metadata.get('hostname'))} IPMI"
-    vars.show_on_statuspage = false
-
-    vars.period = "${rnode.metadata.get('icinga_options/period', '24x7')}"
-
-    vars.notification.sms = ${str(rnode.metadata.get('icinga_options/vars.notification.sms', True)).lower()}
-    vars.notification.mail = true
-}
-% endif
-
 % for depends_on_host in sorted(rnode.metadata.get('icinga_options/also_affected_by', set())):
 object Dependency "${rnode.name}_depends_on_${depends_on_host}" {
     parent_host_name = "${depends_on_host}"

bundles/icinga2/files/scripts/icinga_notification_wrapper

@@ -129,14 +129,11 @@ def notify_per_ntfy():
             data=message_text,
             headers=headers,
             auth=(CONFIG['ntfy']['user'], CONFIG['ntfy']['password']),
-            timeout=10,
         )
 
         r.raise_for_status()
     except Exception as e:
         log_to_syslog('Sending a Notification failed: {}'.format(repr(e)))
-        return False
-    return True
 
 
 def notify_per_mail():
@@ -202,8 +199,7 @@ if __name__ == '__main__':
         notify_per_mail()
 
     if args.sms:
-        ntfy_worked = False
+        if args.service_name:
-        if CONFIG['ntfy']['user']:
-            ntfy_worked = notify_per_ntfy()
-        if not args.service_name or not ntfy_worked:
             notify_per_sms()
+        if CONFIG['ntfy']['user']:
+            notify_per_ntfy()

bundles/icinga2/items.py

@@ -401,6 +401,22 @@ for rnode in sorted(repo.nodes):
                 DAYS_TO_STRING[day%7]: f'{hour}:{minute}-{hour}:{minute+15}',
             },
         })
+    elif (
+        rnode.has_bundle('pacman')
+        and rnode.metadata.get('pacman/unattended-upgrades/is_enabled', False)
+    ):
+        day = rnode.metadata.get('pacman/unattended-upgrades/day')
+        hour = rnode.metadata.get('pacman/unattended-upgrades/hour')
+        minute = rnode.magic_number%30
+
+        downtimes.append({
+            'name': 'unattended-upgrades',
+            'host': rnode.name,
+            'comment': f'Downtime for upgrade-and-reboot of node {rnode.name}',
+            'times': {
+                DAYS_TO_STRING[day%7]: f'{hour}:{minute}-{hour}:{minute+15}',
+            },
+        })
 
 files['/etc/icinga2/conf.d/groups.conf'] = {
     'source': 'icinga2/groups.conf',

bundles/icinga2/metadata.py

@@ -17,6 +17,7 @@ defaults = {
             'icinga2': {},
             'icinga2-ido-pgsql': {},
             'icingaweb2': {},
+            'icingaweb2-module-monitoring': {},
             'python3-easysnmp': {},
             'python3-flask': {},
             'snmp': {},
@@ -54,6 +55,7 @@ defaults = {
         'setup-token': repo.vault.password_for(f'{node.name} icingaweb2 setup-token'),
     },
     'php': {
+        'version': '8.2',
         'packages': {
             'curl',
             'gd',

bundles/infobeamer-cms/items.py

@@ -23,7 +23,7 @@ actions = {
 git_deploy = {
     '/opt/infobeamer-cms/src': {
         'rev': 'master',
-        'repo': 'https://github.com/voc/infobeamer-cms.git',
+        'repo': 'https://github.com/sophieschi/36c3-cms.git',
         'needs': {
             'directory:/opt/infobeamer-cms/src',
         },
@@ -96,6 +96,14 @@ files = {
     },
 }
 
+pkg_pip = {
+    'github-flask': {
+        'needed_by': {
+            'svc_systemd:infobeamer-cms',
+        },
+    },
+}
+
 svc_systemd = {
     'infobeamer-cms': {
         'needs': {

bundles/infobeamer-cms/metadata.py

@@ -1,13 +1,10 @@
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timedelta
-
-assert node.has_bundle('redis')
 
 defaults = {
     'infobeamer-cms': {
         'config': {
             'MAX_UPLOADS': 5,
             'PREFERRED_URL_SCHEME': 'https',
-            'REDIS_HOST': '127.0.0.1',
             'SESSION_COOKIE_NAME': '__Host-sess',
             'STATIC_PATH': '/opt/infobeamer-cms/static',
             'URL_KEY': repo.vault.password_for(f'{node.name} infobeamer-cms url key'),
@@ -52,7 +49,7 @@ def nginx(metadata):
     'infobeamer-cms/config/TIME_MIN',
 )
 def event_times(metadata):
-    event_start = datetime.strptime(metadata.get('infobeamer-cms/event_start_date'), '%Y-%m-%d').replace(tzinfo=timezone.utc)
+    event_start = datetime.strptime(metadata.get('infobeamer-cms/event_start_date'), '%Y-%m-%d')
     event_duration = metadata.get('infobeamer-cms/event_duration_days', 4)
 
     event_end = event_start + timedelta(days=event_duration)

bundles/infobeamer-monitor/files/monitor.py

@@ -1,10 +1,9 @@
 #!/usr/bin/env python3
 
 import logging
-from datetime import datetime
+from datetime import datetime, timezone
 from json import dumps
 from time import sleep
-from zoneinfo import ZoneInfo
 
 import paho.mqtt.client as mqtt
 from requests import RequestException, get
@@ -25,8 +24,7 @@ logging.basicConfig(
 )
 
 LOG = logging.getLogger("main")
-TZ = ZoneInfo("Europe/Berlin")
+MLOG = logging.getLogger("mqtt")
-DUMP_TIME = "0900"
 
 state = None
 
@@ -40,10 +38,7 @@ def mqtt_out(message, level="INFO", device=None):
     key = "infobeamer"
     if device:
         key += f"/{device['id']}"
-        if device["description"]:
+        message = f"[{device['description']}] {message}"
-            message = f"[{device['description']}] {message}"
-        else:
-            message = f"[{device['serial']}] {message}"
 
     client.publish(
         CONFIG["mqtt"]["topic"],
@@ -66,14 +61,14 @@ def mqtt_dump_state(device):
         out.append("Location: {}".format(device["location"]))
     out.append("Setup: {} ({})".format(device["setup"]["name"], device["setup"]["id"]))
     out.append("Resolution: {}".format(device["run"].get("resolution", "unknown")))
+    if not device["is_synced"]:
+        out.append("syncing ...")
 
     mqtt_out(
         " - ".join(out),
         device=device,
     )
 
-def is_dump_time():
-    return datetime.now(TZ).strftime("%H%M") == DUMP_TIME
 
 mqtt_out("Monitor starting up")
 while True:
@@ -86,14 +81,15 @@ while True:
             r.raise_for_status()
             ib_state = r.json()["devices"]
         except RequestException as e:
-            LOG.exception("Could not get device data from info-beamer")
+            LOG.exception("Could not get data from info-beamer")
             mqtt_out(
-                f"Could not get device data from info-beamer: {e!r}",
+                f"Could not get data from info-beamer: {e!r}",
                 level="WARN",
             )
         else:
             new_state = {}
-            for device in sorted(ib_state, key=lambda x: x["id"]):
+            online_devices = set()
+            for device in ib_state:
                 did = str(device["id"])
 
                 if did in new_state:
@@ -101,8 +97,7 @@ while True:
                     continue
 
                 new_state[did] = device
-                # force information output for every online device at 09:00 CE(S)T
+                must_dump_state = False
-                must_dump_state = is_dump_time()
 
                 if state is not None:
                     if did not in state:
@@ -145,15 +140,17 @@ while True:
                         if device["is_online"]:
                             if device["maintenance"]:
                                 mqtt_out(
-                                    "maintenance required: {}".format(
+                                    "maintenance required: {}".join(
-                                        " ".join(sorted(device["maintenance"]))
+                                        sorted(device["maintenance"])
                                     ),
                                     level="WARN",
                                     device=device,
                                 )
+                                must_dump_state = True
 
                         if (
-                            device["location"] != state[did]["location"]
+                            device["is_synced"] != state[did]["is_synced"]
+                            or device["location"] != state[did]["location"]
                             or device["setup"]["id"] != state[did]["setup"]["id"]
                             or device["run"].get("resolution")
                             != state[did]["run"].get("resolution")
@@ -165,52 +162,23 @@ while True:
                 else:
                     LOG.info("adding device {} to empty state".format(device["id"]))
 
+                if device["is_online"]:
+                    online_devices.add(
+                        "{} ({})".format(
+                            device["id"],
+                            device["description"],
+                        )
+                    )
+
             state = new_state
 
-        try:
+            if (
-            r = get(
+                datetime.now(timezone.utc).strftime("%H%M") == "1312"
-                "https://info-beamer.com/api/v1/account",
+                and online_devices
-                auth=("", CONFIG["api_key"]),
+                and int(datetime.now(timezone.utc).strftime("%S")) < 30
-            )
+            ):
-            r.raise_for_status()
+                mqtt_out("Online Devices: {}".format(", ".join(sorted(online_devices))))
-            ib_account = r.json()
+        sleep(30)
-        except RequestException as e:
-            LOG.exception("Could not get account data from info-beamer")
-            mqtt_out(
-                f"Could not get account data from info-beamer: {e!r}",
-                level="WARN",
-            )
-        else:
-            available_credits = ib_account["balance"]
-            if is_dump_time():
-                mqtt_out(f"Available Credits: {available_credits}")
-
-            if available_credits < 50:
-                mqtt_out(
-                    f"balance has dropped below 50 credits! (available: {available_credits})",
-                    level="ERROR",
-                )
-            elif available_credits < 100:
-                mqtt_out(
-                    f"balance has dropped below 100 credits! (available: {available_credits})",
-                    level="WARN",
-                )
-
-            for quota_name, quota_config in sorted(ib_account["quotas"].items()):
-                value = quota_config["count"]["value"]
-                limit = quota_config["count"]["limit"]
-                if value > limit * 0.9:
-                    mqtt_out(
-                        f"quota {quota_name} is over 90% (limit {limit}, value {value})",
-                        level="ERROR",
-                    )
-                elif value > limit * 0.8:
-                    mqtt_out(
-                        f"quota {quota_name} is over 80% (limit {limit}, value {value})",
-                        level="WARN",
-                    )
-
-        sleep(60)
     except KeyboardInterrupt:
         break
 

bundles/ipmitool/metadata.py

@@ -19,4 +19,9 @@ defaults = {
             '/usr/bin/ipmitool *',
         },
     },
+    'pacman': {
+        'packages': {
+            'ipmitool': {},
+        },
+    },
 }

bundles/letsencrypt/items.py

@@ -12,10 +12,6 @@ actions = {
         'needs': {
             'svc_systemd:nginx',
         },
-        'after': {
-            'svc_systemd:nginx:reload',
-            'svc_systemd:nginx:restart',
-        },
     },
 }
 

bundles/letsencrypt/metadata.py

@@ -13,6 +13,15 @@ defaults = {
             },
         },
     },
+    'pacman': {
+        'packages': {
+            'dehydrated': {
+                'needed_by': {
+                    'action:letsencrypt_update_certificates',
+                },
+            },
+        },
+    },
 }
 
 

bundles/lldp/metadata.py

@@ -10,4 +10,15 @@ defaults = {
             },
         },
     },
+    'pacman': {
+        'packages': {
+            'lldpd': {
+                'needed_by': {
+                    'directory:/etc/lldpd.d',
+                    'file:/etc/lldpd.conf',
+                    'svc_systemd:lldpd',
+                },
+            },
+        },
+    },
 }

bundles/lm-sensors/metadata.py

@@ -4,6 +4,11 @@ defaults = {
             'lm-sensors': {},
         },
     },
+    'pacman': {
+        'packages': {
+            'lm_sensors': {},
+        },
+    },
     'telegraf': {
         'input_plugins': {
             'builtin': {

bundles/matrix-media-repo/files/config.yaml

@@ -3,9 +3,6 @@ repo:
   bindAddress: '${node.metadata.get('matrix-media-repo/listen-addr', '127.0.0.1')}'
   port: ${node.metadata.get('matrix-media-repo/port', 20090)}
   logDirectory: '-'
-  logColors: false
-  jsonLogs: false
-  logLevel: 'info'
   trustAnyForwardedAddress: false
   useForwardedHost: true
 
@@ -25,13 +22,10 @@ homeservers:
     csApi: "${config['domain']}"
     backoffAt: ${config.get('backoff_at', 10)}
     adminApiKind: "${config.get('api', 'matrix')}"
-%  if config.get('signing_key_path'):
-    signingKeyPath: "${config['signing_key_path']}"
-%  endif
 % endfor
 
 accessTokens:
-  maxCacheTimeSeconds: 10
+  maxCacheTimeSeconds: 0
   useLocalAppserviceConfig: false
 
 admins:
@@ -59,9 +53,7 @@ archiving:
 uploads:
   maxBytes: ${node.metadata.get('matrix-media-repo/upload_max_mb')*1024*1024}
   minBytes: 100
-  #reportedMaxBytes: 0
+  reportedMaxBytes: 0
-  maxPending: 5
-  maxAgeSeconds: 1800
   quotas:
     enabled: false
 
@@ -69,6 +61,14 @@ downloads:
   maxBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*1024*1024}
   numWorkers: ${node.metadata.get('matrix-media-repo/workers')}
   failureCacheMinutes: 5
+  cache:
+    enabled: true
+    maxSizeBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*10*1024*1024}
+    maxFileSizeBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*1024*1024}
+    trackedMinutes: 30
+    minDownloads: 5
+    minCacheTimeSeconds: 300
+    minEvictedTimeSeconds: 60
   expireAfterDays: 0
 
 urlPreviews:
@@ -137,8 +137,8 @@ thumbnails:
 
 rateLimit:
   enabled: true
-  requestsPerSecond: 100
+  requestsPerSecond: 10
-  burst: 5000
+  burst: 50
 
 identicons:
   enabled: true

bundles/matrix-media-repo/items.py

@@ -19,6 +19,9 @@ files = {
     '/opt/matrix-media-repo/config.yaml': {
         'owner': 'matrix-media-repo',
         'content_type': 'mako',
+        'triggers': {
+            'svc_systemd:matrix-media-repo:restart',
+        },
     },
     '/etc/systemd/system/matrix-media-repo.service': {
         'triggers': {

bundles/matrix-registration/files/config.yaml

@@ -0,0 +1,40 @@
+server_location: 'http://[::1]:20080'
+server_name: '${server_name}'
+registration_shared_secret: '${reg_secret}'
+admin_api_shared_secret: '${admin_secret}'
+base_url: '${base_url}'
+client_redirect: '${client_redirect}'
+client_logo: 'static/images/element-logo.png' # use '{cwd}' for current working directory
+#db: 'sqlite:///opt/matrix-registration/data/db.sqlite3'
+db: 'postgresql://${database['user']}:${database['password']}@localhost/${database['database']}'
+host: 'localhost'
+port: 20100
+rate_limit: ["100 per day", "10 per minute"]
+allow_cors: false
+ip_logging: false
+logging:
+  disable_existing_loggers: false
+  version: 1
+  root:
+    level: DEBUG
+    handlers: [console]
+  formatters:
+    brief:
+      format: '%(name)s - %(levelname)s - %(message)s'
+  handlers:
+    console:
+      class: logging.StreamHandler
+      level: INFO
+      formatter: brief
+      stream: ext://sys.stdout
+# password requirements
+password:
+  min_length: 8
+# username requirements
+username:
+  validation_regex: [] #list of regexes that the selected username must match.        Example: '[a-zA-Z]\.[a-zA-Z]'
+  invalidation_regex:  #list of regexes that the selected username must NOT match.  Example: '(admin|support)'
+    - '^abuse'
+    - 'admin'
+    - 'support'
+    - 'help'

bundles/matrix-registration/files/matrix-registration.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=matrix-registration
+After=network.target
+
+[Service]
+User=matrix-registration
+Group=matrix-registration
+WorkingDirectory=/opt/matrix-registration/src
+ExecStart=/opt/matrix-registration/venv/bin/matrix-registration --config-path /opt/matrix-registration/config.yaml serve
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

bundles/matrix-registration/items.py

@@ -0,0 +1,65 @@
+actions['matrix-registration_create_virtualenv'] = {
+    'command': '/usr/bin/python3 -m virtualenv -p python3 /opt/matrix-registration/venv/',
+    'unless': 'test -d /opt/matrix-registration/venv/',
+    'needs': {
+        # actually /opt/matrix-registration, but we don't create that
+        'directory:/opt/matrix-registration/src',
+    },
+}
+
+actions['matrix-registration_install'] = {
+    'command': ' && '.join([
+        'cd /opt/matrix-registration/src',
+        '/opt/matrix-registration/venv/bin/pip install psycopg2-binary',
+        '/opt/matrix-registration/venv/bin/pip install -e .',
+    ]),
+    'needs': {
+        'action:matrix-registration_create_virtualenv',
+    },
+    'triggered': True,
+}
+
+users['matrix-registration'] = {
+    'home': '/opt/matrix-registration',
+}
+
+directories['/opt/matrix-registration/src'] = {}
+
+git_deploy['/opt/matrix-registration/src'] = {
+    'repo': 'https://github.com/zeratax/matrix-registration.git',
+    'rev': 'master',
+    'triggers': {
+        'action:matrix-registration_install',
+        'svc_systemd:matrix-registration:restart',
+    },
+}
+
+files['/opt/matrix-registration/config.yaml'] = {
+    'content_type': 'mako',
+    'context': {
+        'admin_secret': node.metadata.get('matrix-registration/admin_secret'),
+        'base_url': node.metadata.get('matrix-registration/base_path', ''),
+        'client_redirect': node.metadata.get('matrix-registration/client_redirect'),
+        'database': node.metadata.get('matrix-registration/database'),
+        'reg_secret': node.metadata.get('matrix-synapse/registration_shared_secret'),
+        'server_name': node.metadata.get('matrix-synapse/server_name'),
+    },
+    'triggers': {
+        'svc_systemd:matrix-registration:restart',
+    },
+}
+
+files['/usr/local/lib/systemd/system/matrix-registration.service'] = {
+    'triggers': {
+        'action:systemd-reload',
+        'svc_systemd:matrix-registration:restart',
+    },
+}
+
+svc_systemd['matrix-registration'] = {
+    'needs': {
+        'action:matrix-registration_install',
+        'file:/opt/matrix-registration/config.yaml',
+        'file:/usr/local/lib/systemd/system/matrix-registration.service',
+    },
+}

bundles/matrix-registration/metadata.py

@@ -0,0 +1,25 @@
+defaults = {
+    'bash_aliases': {
+        'matrix-registration': '/opt/matrix-registration/venv/bin/matrix-registration --config-path /opt/matrix-registration/config.yaml',
+    },
+    'matrix-registration': {
+        'admin_secret': repo.vault.password_for(f'{node.name} matrix-registration admin secret'),
+        'database': {
+            'user': 'matrix-registration',
+            'password': repo.vault.password_for(f'{node.name} postgresql matrix-registration'),
+            'database': 'matrix-registration',
+        },
+    },
+    'postgresql': {
+        'roles': {
+            'matrix-registration': {
+                'password': repo.vault.password_for(f'{node.name} postgresql matrix-registration'),
+            },
+        },
+        'databases': {
+            'matrix-registration': {
+                'owner': 'matrix-registration',
+            },
+        },
+    },
+}

bundles/matrix-synapse/items.py

@@ -57,3 +57,32 @@ svc_systemd = {
         },
     },
 }
+
+if node.metadata.get('matrix-synapse/sliding_sync/version', None):
+    files['/usr/local/bin/matrix-sliding-sync'] = {
+        'content_type': 'download',
+        'source': 'https://github.com/matrix-org/sliding-sync/releases/download/{}/syncv3_linux_amd64'.format(
+            node.metadata.get('matrix-synapse/sliding_sync/version'),
+        ),
+        'content_hash': node.metadata.get('matrix-synapse/sliding_sync/sha1', None),
+        'mode': '0755',
+        'triggers': {
+            'svc_systemd:matrix-sliding-sync:restart',
+        },
+    }
+
+    files['/usr/local/lib/systemd/system/matrix-sliding-sync.service'] = {
+        'content_type': 'mako',
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:matrix-sliding-sync:restart',
+        },
+    }
+
+    svc_systemd['matrix-sliding-sync'] = {
+        'needs': {
+            'file:/usr/local/bin/matrix-sliding-sync',
+            'file:/usr/local/lib/systemd/system/matrix-sliding-sync.service',
+            'postgres_db:synapse',
+        },
+    }

bundles/matrix-synapse/metadata.py

@@ -88,6 +88,14 @@ def nginx(metadata):
     if not node.has_bundle('nginx'):
         raise DoNotRunAgain
 
+    wellknown_client_sliding_sync = {}
+    if metadata.get('matrix-synapse/sliding_sync/version', None):
+        wellknown_client_sliding_sync = {
+            'org.matrix.msc3575.proxy': {
+                'url': 'https://{}'.format(metadata.get('matrix-synapse/baseurl')),
+            },
+        }
+
     wellknown = {
         '/.well-known/matrix/client': {
             'content': dumps({
@@ -97,6 +105,7 @@ def nginx(metadata):
                 'm.identity_server': {
                     'base_url': metadata.get('matrix-synapse/identity_server', 'https://matrix.org'),
                 },
+                **wellknown_client_sliding_sync,
                 **metadata.get('matrix-synapse/additional_client_config', {}),
             }, sort_keys=True),
             'return': 200,
@@ -125,6 +134,9 @@ def nginx(metadata):
             'target': 'http://[::1]:20080',
             'max_body_size': '50M',
         },
+        '/_matrix/client/unstable/org.matrix.msc3575/sync': {
+            'target': 'http://127.0.0.1:20070',
+        },
         '/_synapse': {
             'target': 'http://[::1]:20080',
         },
@@ -132,14 +144,13 @@ def nginx(metadata):
     }
 
     if node.has_bundle('matrix-media-repo'):
-        for path in ('/_matrix/media', '/_matrix/client/v1/media', '/_matrix/federation/v1/media'):
+        locations['/_matrix/media'] = {
-            locations[path] = {
+            'target': 'http://localhost:20090',
-                'target': 'http://localhost:20090',
+            'max_body_size': '{}M'.format(metadata.get('matrix-media-repo/upload_max_mb')),
-                'max_body_size': '{}M'.format(metadata.get('matrix-media-repo/upload_max_mb')),
+            # matrix-media-repo needs this to be the
-                # matrix-media-repo needs this to be the
+            # homeserver address.
-                # homeserver address.
+            'x_forwarded_host': metadata.get('matrix-synapse/server_name'),
-                'x_forwarded_host': metadata.get('matrix-synapse/server_name'),
+        }
-            }
 
     vhosts = {
         'matrix-synapse': {

bundles/mixcloud-downloader/files/download.sh

@@ -1,15 +1,11 @@
 #!/bin/bash
 
-OPTS="--netrc"
+OPTS=""
-OPTS="$OPTS --netrc-location /opt/mixcloud-downloader/netrc"
-OPTS="$OPTS --retry-sleep linear=1::2"
-OPTS="$OPTS --retry-sleep fragment:exp=1:60"
-OPTS="$OPTS --extractor-retries 5"
 if [[ -n "$DEBUG" ]]
 then
     set -x
 else
-    OPTS="$OPTS -q"
+    OPTS="-q"
 fi
 
 set -euo pipefail

bundles/mixcloud-downloader/files/netrc

@@ -1,3 +0,0 @@
-% for domain, data in sorted(node.metadata.get('mixcloud-downloader/netrc', {}).items()):
-machine ${domain} login ${data['username']} password ${data['password']}
-% endfor

bundles/mixcloud-downloader/items.py

@@ -6,9 +6,3 @@ files['/opt/mixcloud-downloader/download.sh'] = {
 directories['/opt/mixcloud-downloader'] = {
     'owner': 'kunsi',
 }
-
-files['/opt/mixcloud-downloader/netrc'] = {
-    'content_type': 'mako',
-    'mode': '0400',
-    'owner': 'kunsi',
-}

bundles/mosquitto/items.py

@@ -5,6 +5,12 @@ files = {
             'svc_systemd:mosquitto:restart',
         },
     },
+    '/usr/local/bin/tasmota-telegraf-plugin': {
+        'mode': '0755',
+        'needs': {
+            'pkg_apt:python3-paho-mqtt',
+        },
+    },
 }
 
 svc_systemd = {
@@ -17,12 +23,6 @@ svc_systemd = {
 }
 
 if node.has_bundle('telegraf'):
-    files['/usr/local/bin/tasmota-telegraf-plugin'] = {
+    files['/usr/local/bin/tasmota-telegraf-plugin']['triggers'] = {
-        'mode': '0755',
+        'svc_systemd:telegraf:restart',
-        'needs': {
-            'pkg_apt:python3-paho-mqtt',
-        },
-        'triggers': {
-            'svc_systemd:telegraf:restart',
-        },
     }

bundles/mosquitto/metadata.py

@@ -5,6 +5,7 @@ defaults = {
         'packages': {
             'mosquitto': {},
             'mosquitto-clients': {},
+            'python3-paho-mqtt': {}, # for telegraf plugin
         },
     },
     'icinga2_api': {
@@ -23,9 +24,6 @@ defaults = {
     },
 }
 
-if node.has_bundle('telegraf'):
-    defaults['apt']['packages']['python3-paho-mqtt'] = {}
-
 
 @metadata_reactor.provides(
     'firewall/port_rules',

bundles/nextcloud/metadata.py

@@ -45,9 +45,6 @@ defaults = {
                 'pwd': '/var/www/nextcloud',
                 'user': 'www-data',
                 'when': '*:00/5',
-                'requisite': {
-                    'postgresql.service',
-                },
             },
         },
     },

bundles/nfs-client/items.py

@@ -1,3 +1,8 @@
+if node.has_bundle('pacman'):
+    package = 'pkg_pacman:nfs-utils'
+else:
+    package = 'pkg_apt:nfs-common'
+
 for mount, data in node.metadata.get('nfs-client/mounts',{}).items():
     data['mount'] = mount
     data['mount_options'] = set(data.get('mount_options', set()))
@@ -37,7 +42,7 @@ for mount, data in node.metadata.get('nfs-client/mounts',{}).items():
                 'file:/etc/systemd/system/{}.automount'.format(unitname),
                 'directory:{}'.format(data['mountpoint']),
                 'svc_systemd:systemd-networkd',
-                'pkg_apt:nfs-common',
+                package,
             },
         }
     else:
@@ -53,7 +58,7 @@ for mount, data in node.metadata.get('nfs-client/mounts',{}).items():
                 'file:/etc/systemd/system/{}.mount'.format(unitname),
                 'directory:{}'.format(data['mountpoint']),
                 'svc_systemd:systemd-networkd',
-                'pkg_apt:nfs-common',
+                package,
             },
         }
 

bundles/nfs-client/metadata.py

@@ -4,6 +4,11 @@ defaults = {
             'nfs-common': {},
         },
     },
+    'pacman': {
+        'packages': {
+            'nfs-utils': {},
+        },
+    },
 }
 
 if node.has_bundle('telegraf'):

bundles/nftables/files/nftables.conf

@@ -23,8 +23,9 @@ table inet filter {
 
         icmp type timestamp-request drop
         icmp type timestamp-reply drop
-        meta l4proto {icmp, ipv6-icmp} accept
+        ip protocol icmp accept
 
+        ip6 nexthdr ipv6-icmp accept
 % for ruleset, rules in sorted(input.items()):
 
         # ${ruleset}

bundles/nftables/items.py

@@ -1,3 +1,8 @@
+if node.has_bundle('pacman'):
+    package = 'pkg_pacman:nftables'
+else:
+    package = 'pkg_apt:nftables'
+
 directories = {
     # used by other bundles
     '/etc/nftables-rules.d': {
@@ -37,7 +42,7 @@ svc_systemd = {
     'nftables': {
         'needs': {
             'file:/etc/nftables.conf',
-            'pkg_apt:nftables',
+            package,
         },
     },
 }

bundles/nftables/metadata.py

@@ -10,9 +10,26 @@ defaults = {
         'blocked_v4': repo.libs.firewall.global_ip4_blocklist,
         'blocked_v6': repo.libs.firewall.global_ip6_blocklist,
     },
+    'pacman': {
+        'packages': {
+            'nftables': {},
+# https://github.com/bundlewrap/bundlewrap/issues/688
+#            'iptables': {
+#                'installed': False,
+#                'needed_by': {
+#                    'pkg_pacman:iptables-nft',
+#                },
+#            },
+            'iptables-nft': {
+                'needed_by': {
+                    'pkg_pacman:nftables',
+                },
+            },
+        },
+    },
 }
 
-if not node.has_bundle('vmhost') and not node.has_bundle('docker-engine'):
+if not node.has_bundle('vmhost'):
     # see comment in bundles/vmhost/items.py
     defaults['apt']['packages']['iptables'] = {
         'installed': False,

bundles/nginx/files/arch-override.conf

@@ -0,0 +1,9 @@
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
+
+ExecReload=
+ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /var/run/nginx.pid)"
+
+ExecStop=
+ExecStop=/bin/sh -c "/bin/kill -s TERM $(/bin/cat /var/run/nginx.pid)"

bundles/nginx/files/nginx.conf

@@ -1,4 +1,4 @@
-user  www-data;
+user  ${username};
 worker_processes  ${worker_processes};
 
 pid        /var/run/nginx.pid;
@@ -11,7 +11,7 @@ events {
 http {
     include       /etc/nginx/mime.types;
     types {
-        application/javascript mjs;
+        application/javascript js mjs;
     }
     default_type  application/octet-stream;
     charset UTF-8;
@@ -26,7 +26,7 @@ http {
     send_timeout 10;
 
     access_log off;
-    error_log /dev/null;
+    error_log off;
 
     client_body_buffer_size 16K;
     client_header_buffer_size 4k;

bundles/nginx/files/site_template

@@ -149,18 +149,18 @@ server {
 %   if 'target' in options:
         proxy_pass           ${options['target']};
         proxy_http_version   ${options.get('http_version', '1.1')};
-        proxy_set_header     Host ${options.get('proxy_pass_host', domain)};
+        proxy_set_header     Host ${domain};
 %    if options.get('websockets', False):
         proxy_set_header     Connection "upgrade";
         proxy_set_header     Upgrade $http_upgrade;
 %    endif
         proxy_set_header     X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header     X-Forwarded-Proto $scheme;
-        proxy_set_header     X-Forwarded-Host ${options.get('x_forwarded_host', options.get('proxy_pass_host', domain))};
+        proxy_set_header     X-Forwarded-Host ${options.get('x_forwarded_host', domain)};
 %    for option, value in options.get('proxy_set_header', {}).items():
         proxy_set_header     ${option} ${value};
 %    endfor
-%    if location != '/' and location != '= /':
+%    if location != '/':
         proxy_set_header     X-Script-Name ${location};
 %    endif
         proxy_buffering      off;
@@ -201,8 +201,6 @@ server {
         fastcgi_hide_header X-XSS-Protection;
 % endif
         fastcgi_hide_header Permissions-Policy;
-        fastcgi_request_buffering off;
-        proxy_buffering off;
     }
 %  if not max_body_size:
     client_max_body_size 5M;

bundles/nginx/items.py

@@ -1,5 +1,12 @@
 from datetime import datetime, timedelta
 
+if node.has_bundle('pacman'):
+    package = 'pkg_pacman:nginx'
+    username = 'http'
+else:
+    package = 'pkg_apt:nginx'
+    username = 'www-data'
+
 directories = {
     '/etc/nginx/sites': {
         'purge': True,
@@ -17,9 +24,9 @@ directories = {
         },
     },
     '/var/log/nginx-timing': {
-        'owner': 'www-data',
+        'owner': username,
         'needs': {
-            'pkg_apt:nginx',
+            package,
         },
     },
     '/var/www': {},
@@ -33,6 +40,7 @@ files = {
     '/etc/nginx/nginx.conf': {
         'content_type': 'mako',
         'context': {
+            'username': username,
             **node.metadata['nginx'],
         },
         'triggers': {
@@ -61,13 +69,21 @@ files = {
     '/var/www/error.html': {},
     '/var/www/not_found.html': {},
 }
+if node.has_bundle('pacman'):
+    files['/etc/systemd/system/nginx.service.d/bundlewrap.conf'] = {
+        'source': 'arch-override.conf',
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:nginx:restart',
+        },
+    }
 
 svc_systemd = {
     'nginx': {
         'needs': {
             'action:generate-dhparam',
             'directory:/var/log/nginx-timing',
-            'pkg_apt:nginx',
+            package,
         },
     },
 }
@@ -104,7 +120,7 @@ for vhost, config in node.metadata.get('nginx/vhosts', {}).items():
         'context': {
             'create_logs': config.get('create_logs', False),
             'create_timing_log': config.get('timing_log', True),
-            'php_version': node.metadata.get('php/__version', ''),
+            'php_version': node.metadata.get('php/version', ''),
             'security_txt': security_txt_enabled,
             'vhost': vhost,
             **config,

bundles/nginx/metadata.py

@@ -33,6 +33,11 @@ defaults = {
     'nginx': {
         'worker_connections': 768,
     },
+    'pacman': {
+        'packages': {
+            'nginx': {},
+        },
+    },
 }
 
 if node.has_bundle('telegraf'):

bundles/nodejs/items.py

@@ -0,0 +1,9 @@
+actions = {
+    'nodejs_install_yarn': {
+        'command': 'npm install -g yarn@latest',
+        'unless': 'test -e /usr/lib/node_modules/yarn',
+        'after': {
+            'pkg_apt:',
+        },
+    },
+}

bundles/nodejs/metadata.py

@@ -1,40 +1,54 @@
 defaults = {
     'apt': {
         'additional_update_commands': {
-            # update npm and yarn to latest version
+            # update npm to latest version
-            'npm install -g npm@latest',
             'npm install -g yarn@latest',
         },
         'packages': {
-            'nodejs': {
+            'nodejs': {},
-                'triggers': {
-                    'action:apt_execute_update_commands',
-                },
-            },
-            'npm': {
-                'installed': False,
-                'triggers': {
-                    'action:apt_execute_update_commands',
-                },
-            },
         },
     },
+    'nodejs': {
+        'version': 18,
+    },
+}
+
+VERSIONS_SHIPPED_BY_DEBIAN = {
+    10: 10,
+    11: 12,
+    12: 18,
+    13: 18,
 }
 
 @metadata_reactor.provides(
     'apt/repos/nodejs/items',
+    'apt/additional_update_commands',
 )
 def nodejs_from_version(metadata):
     version = metadata.get('nodejs/version')
 
-    return {
+    if version != VERSIONS_SHIPPED_BY_DEBIAN[node.os_version[0]]:
-        'apt': {
+        return {
-            'repos': {
+            'apt': {
-                'nodejs': {
+                'additional_update_commands': {
-                    'items': {
+                    # update npm to latest version
-                        f'deb https://deb.nodesource.com/node_{version}.x nodistro main',
+                    'npm install -g npm@latest',
+                },
+                'repos': {
+                    'nodejs': {
+                        'items': {
+                            f'deb https://deb.nodesource.com/node_{version}.x {{os_release}} main',
+                            f'deb-src https://deb.nodesource.com/node_{version}.x {{os_release}} main',
+                        },
                     },
                 },
             },
-        },
+        }
-    }
+    else:
+        return {
+            'apt': {
+                'packages': {
+                    'npm': {},
+                },
+            },
+        }

bundles/openssh/items.py

@@ -27,22 +27,29 @@ files = {
     },
 }
 
+if node.has_bundle('pacman'):
+    package = 'pkg_pacman:openssh'
+    service = 'sshd'
+else:
+    package = 'pkg_apt:openssh-server'
+    service = 'ssh'
+
 actions = {
     'sshd_check_config': {
         'command': 'sshd -T -C user=root -C host=localhost -C addr=localhost',
         'triggered': True,
         'triggers': {
-            'svc_systemd:ssh:restart',
+            'svc_systemd:{}:restart'.format(service),
         },
     },
 }
 
 svc_systemd = {
-    'ssh': {
+    service: {
         'needs': {
             'file:/etc/systemd/system/ssh.service.d/bundlewrap.conf',
             'file:/etc/ssh/sshd_config',
-            'pkg_apt:openssh-server',
+            package,
         },
     },
 }

bundles/openssh/metadata.py

@@ -8,6 +8,11 @@ defaults = {
             'openssh-sftp-server': {},
         },
     },
+    'pacman': {
+        'packages': {
+            'openssh': {},
+        },
+    },
 }
 
 @metadata_reactor.provides(

bundles/pacman/files/check_unattended_upgrades

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+statusfile="/var/tmp/unattended_upgrades.status"
+if ! [[ -f "$statusfile" ]]
+then
+    echo "Status file not found"
+    exit 3
+fi
+
+mtime=$(stat -c %Y $statusfile)
+now=$(date +%s)
+if (( $now - $mtime > 60*60*24*8 ))
+then
+    echo "Status file is older than 8 days!"
+    exit 3
+fi
+
+exitcode=$(cat $statusfile)
+case "$exitcode" in
+    abort_ssh)
+        echo "Upgrades skipped due to active SSH login"
+        exit 1
+        ;;
+    0)
+        if [[ -f /var/run/reboot-required ]]
+        then
+            echo "OK, but updates require a reboot"
+            exit 1
+        else
+            echo "OK"
+            exit 0
+        fi
+        ;;
+    *)
+        echo "Last exitcode was $exitcode"
+        exit 2
+        ;;
+esac

bundles/pacman/files/do-unattended-upgrades

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -xeuo pipefail
+
+pacman -Syu --noconfirm --noprogressbar
+
+% for affected, restarts in sorted(restart_triggers.items()):
+up_since=$(systemctl show "${affected}" | sed -n 's/^ActiveEnterTimestamp=//p' || echo 0)
+up_since_ts=$(date -d "$up_since" +%s || echo 0)
+now=$(date +%s)
+
+if [ $((now - up_since_ts)) -lt 3600 ]
+then
+% for restart in sorted(restarts):
+    systemctl restart "${restart}" || true
+% endfor
+fi
+% endfor

bundles/pacman/files/faillock.conf

@@ -0,0 +1,2 @@
+# just disable faillock.
+deny = 0

bundles/pacman/files/pacman.conf

@@ -0,0 +1,52 @@
+[options]
+Architecture = auto
+CheckSpace
+Color
+HoldPkg = ${' '.join(sorted(node.metadata.get('pacman/ask_before_removal')))}
+ILoveCandy
+IgnorePkg = ${' '.join(sorted(node.metadata.get('pacman/ignore_packages', set())))}
+LocalFileSigLevel = Optional
+NoExtract=${' '.join(sorted(node.metadata.get('pacman/no_extract', set())))}
+ParallelDownloads = ${node.metadata.get('pacman/parallel_downloads')}
+SigLevel    = Required DatabaseOptional
+VerbosePkgLists
+
+% for line in sorted(node.metadata.get('pacman/additional_config', set())):
+${line}
+% endfor
+
+[core]
+Server = ${node.metadata.get('pacman/repository')}
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Server = ${node.metadata.get('pacman/repository')}
+Include = /etc/pacman.d/mirrorlist
+
+[community]
+Server = ${node.metadata.get('pacman/repository')}
+Include = /etc/pacman.d/mirrorlist
+% if node.metadata.get('pacman/enable_multilib', False):
+
+[multilib]
+Server = ${node.metadata.get('pacman/repository')}
+Include = /etc/pacman.d/mirrorlist
+% endif
+% if node.metadata.get('pacman/enable_aurto', True):
+
+[aurto]
+Server = https://aurto.kunbox.net/
+SigLevel = Optional TrustAll
+% endif
+% if node.has_bundle('zfs'):
+
+[archzfs]
+Server = http://archzfs.com/archzfs/x86_64
+
+%  if node.metadata.get('pacman/linux-lts', False):
+[zfs-linux-lts]
+%  else:
+[zfs-linux]
+%  endif
+Server = http://kernels.archzfs.com/$repo/
+% endif

bundles/pacman/files/upgrade-and-reboot

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# With systemd, we can force logging to the journal. This is better than
+# spamming the world with cron mails. You can then view these logs using
+# "journalctl -rat upgrade-and-reboot".
+if which logger >/dev/null 2>&1
+then
+    # Dump stdout and stderr to logger, which will then put everything
+    # into the journal.
+    exec 1> >(logger -t upgrade-and-reboot -p user.info)
+    exec 2> >(logger -t upgrade-and-reboot -p user.error)
+fi
+
+. /etc/upgrade-and-reboot.conf
+
+echo "Starting upgrade-and-reboot for node $nodename ..."
+
+statusfile="/var/tmp/unattended_upgrades.status"
+# Workaround, because /var/tmp is usually 1777
+[[ "$UID" == 0 ]] && chown root:root "$statusfile"
+
+logins=$(ps h -C sshd -o euser | awk '$1 != "root" && $1 != "sshd" && $1 != "sshmon" && $1 != "nobody"')
+if [[ -n "$logins" ]]
+then
+    echo "Will abort now, there are active SSH logins: $logins"
+    echo "abort_ssh" > "$statusfile"
+    exit 1
+fi
+
+softlockdir=/var/lib/bundlewrap/soft-$nodename
+mkdir -p "$softlockdir"
+printf '{"comment": "UPDATE", "date": %s, "expiry": %s, "id": "UNATTENDED", "items": ["*"], "user": "root@localhost"}\n' \
+    $(date +%s) \
+    $(date -d 'now + 30 mins' +%s) \
+    >"$softlockdir"/UNATTENDED
+trap 'rm -f "$softlockdir"/UNATTENDED' EXIT
+
+do-unattended-upgrades
+ret=$?
+
+echo "$ret" > "$statusfile"
+if (( $ret != 0 ))
+then
+    exit 1
+fi
+
+systemctl reboot
+
+echo "upgrade-and-reboot for node $nodename is DONE"

bundles/pacman/files/upgrade-and-reboot.conf

@@ -0,0 +1,3 @@
+nodename="${node.name}"
+reboot_mail_to="${node.metadata.get('apt/unattended-upgrades/reboot_mail_to', '')}"
+auto_reboot_enabled="${node.metadata.get('apt/unattended-upgrades/reboot_enabled', True)}"

bundles/pacman/items.py

@@ -0,0 +1,113 @@
+from bundlewrap.exceptions import BundleError
+
+if not node.os == 'arch':
+    raise BundleError(f'{node.name}: bundle:pacman requires arch linux')
+
+files = {
+    '/etc/pacman.conf': {
+        'content_type': 'mako',
+    },
+    '/etc/upgrade-and-reboot.conf': {
+        'content_type': 'mako',
+    },
+    '/etc/security/faillock.conf': {},
+    '/usr/local/sbin/upgrade-and-reboot': {
+        'mode': '0700',
+    },
+    '/usr/local/sbin/do-unattended-upgrades': {
+        'content_type': 'mako',
+        'mode': '0700',
+        'context': {
+            'restart_triggers': node.metadata.get('pacman/restart_triggers', {}),
+        }
+    },
+    '/usr/local/share/icinga/plugins/check_unattended_upgrades': {
+        'mode': '0755',
+    },
+}
+
+svc_systemd['paccache.timer'] = {
+    'needs': {
+        'pkg_pacman:pacman-contrib',
+    },
+}
+
+pkg_pacman = {
+    'at': {},
+    'autoconf': {},
+    'automake': {},
+    'bind': {},
+    'binutils': {},
+    'bison': {},
+    'bzip2': {},
+    'curl': {},
+    'dialog': {},
+    'diffutils': {},
+    'fakeroot': {},
+    'file': {},
+    'findutils': {},
+    'flex': {},
+    'fwupd': {},
+    'gawk': {},
+    'gcc': {},
+    'gettext': {},
+    'git': {},
+    'gnu-netcat': {},
+    'grep': {},
+    'groff': {},
+    'gzip': {},
+    'htop': {},
+    'jq': {},
+    'ldns': {},
+    'less': {},
+    'libtool': {},
+    'logrotate': {},
+    'lsof': {},
+    'm4': {},
+    'mailutils': {},
+    'make': {},
+    'man-db': {},
+    'man-pages': {},
+    'moreutils': {},
+    'mtr': {},
+    'ncdu': {},
+    'nmap': {},
+    'pacman-contrib': {},
+    'patch': {},
+    'pkgconf': {},
+    'python': {},
+    'python-setuptools': {
+        'needed_by': {
+            'pkg_pip:',
+        },
+    },
+    'python-pip': {
+        'needed_by': {
+            'pkg_pip:',
+        },
+    },
+    'python-virtualenv': {},
+    'rsync': {},
+    'run-parts': {},
+    'sed': {},
+    'tar': {},
+    'texinfo': {},
+    'tmux': {},
+    'tree': {},
+    'unzip': {},
+    'vim': {},
+    'wget': {},
+    'which': {},
+    'whois': {},
+    'zip': {},
+}
+
+if node.metadata.get('pacman/linux-lts', False):
+    pkg_pacman['linux-lts'] = {}
+    pkg_pacman['acpi_call-lts'] = {}
+else:
+    pkg_pacman['linux'] = {}
+    pkg_pacman['acpi_call'] = {}
+
+for pkg, config in node.metadata.get('pacman/packages', {}).items():
+    pkg_pacman[pkg] = config

bundles/pacman/metadata.py

@@ -0,0 +1,54 @@
+defaults = {
+    'pacman': {
+        'ask_before_removal': {
+            'glibc',
+            'pacman',
+        },
+        'no_extract': {
+            'etc/cron.d/0hourly',
+            # don't install systemd-homed pam module. It produces a lot of spam in
+            # journal about systemd-homed not being active, so just get rid of it.
+            # Requires reinstall of systemd package, though
+            'usr/lib/security/pam_systemd_home.so',
+        },
+        'parallel_downloads': 4,
+        'repository': 'http://ftp.uni-kl.de/pub/linux/archlinux/$repo/os/$arch',
+        'unattended-upgrades': {
+            'day': 5,
+            'hour': 21,
+        },
+    },
+}
+
+
+@metadata_reactor.provides(
+    'cron/jobs/upgrade-and-reboot',
+    'icinga2_api/pacman/services',
+)
+def patchday(metadata):
+    if not metadata.get('pacman/unattended-upgrades/is_enabled', False):
+        return {}
+
+    day = metadata.get('pacman/unattended-upgrades/day')
+    hour = metadata.get('pacman/unattended-upgrades/hour')
+
+    return {
+        'cron': {
+            'jobs': {
+                'upgrade-and-reboot': '{minute} {hour} * * {day}    root    /usr/local/sbin/upgrade-and-reboot'.format(
+                    minute=node.magic_number % 30,
+                    hour=hour,
+                    day=day,
+                ),
+            },
+        },
+        'icinga2_api': {
+            'pacman': {
+                'services': {
+                    'UNATTENDED UPGRADES': {
+                        'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_unattended_upgrades',
+                    },
+                },
+            },
+        },
+    }

bundles/paperless-ng/files/paperless.conf

@@ -12,7 +12,7 @@ PAPERLESS_CONSUMPTION_DIR=/mnt/paperless/consume
 PAPERLESS_DATA_DIR=/mnt/paperless/data
 PAPERLESS_MEDIA_ROOT=/mnt/paperless/media
 PAPERLESS_STATICDIR=/opt/paperless/src/paperless-ngx/static
-PAPERLESS_FILENAME_FORMAT={{ created_year }}/{{ created_month }}/{{ correspondent }}/{{ asn }}_{{ title }}
+PAPERLESS_FILENAME_FORMAT={created_year}/{created_month}/{correspondent}/{asn}_{title}
 
 # Security and hosting
 

bundles/paperless-ng/metadata.py

@@ -33,9 +33,6 @@ defaults = {
             '/mnt/paperless',
         },
     },
-    'nodejs': {
-        'version': 22,
-    },
     'postgresql': {
         'roles': {
             'paperless': {

bundles/php/items.py

@@ -1,4 +1,4 @@
-version = node.metadata.get('php/__version')
+version = node.metadata.get('php/version')
 
 directories['/var/lib/php/sessions'] = {
     'owner': 'www-data',

bundles/php/metadata.py

@@ -1,11 +1,12 @@
-OS_PHP_VERSION = {
-    12: '8.2',
-    13: '8.4',
-}
-
 defaults = {
-    'php': {
+    'apt': {
-        '__version': OS_PHP_VERSION[node.os_version[0]],
+        'repos': {
+            'php': {
+                'items': {
+                    'deb https://packages.sury.org/php/ {os_release} main',
+                },
+            },
+        },
     },
 }
 
@@ -14,7 +15,7 @@ defaults = {
     'apt/packages',
 )
 def php_packages_with_features(metadata):
-    version = metadata.get('php/__version')
+    version = metadata.get('php/version')
 
     packages = {
         f'php{version}': {},

bundles/postfix/files/arch-override.conf

@@ -0,0 +1,6 @@
+[Service]
+# arch postfix is not set up for chrooting by default
+ExecStartPre=-/usr/sbin/mkdir -p /var/spool/postfix/etc
+% for file in ['/etc/localtime', '/etc/nsswitch.conf', '/etc/resolv.conf', '/etc/services']:
+ExecStartPre=-/usr/sbin/cp -p ${file} /var/spool/postfix${file}
+% endfor

bundles/postfix/files/blocked_recipients

@@ -1,5 +1,3 @@
-devnull@${node.metadata.get('postfix/myhostname')} DISCARD DEV-NULL
-
 % for address in sorted(blocked):
 ${address} REJECT
 % endfor

bundles/postfix/files/main.cf

@@ -3,7 +3,7 @@ biff = no
 append_dot_mydomain = no
 readme_directory = no
 compatibility_level = 2
-myhostname = ${node.metadata.get('postfix/myhostname')}
+myhostname = ${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}
 myorigin = /etc/mailname
 mydestination = $myhostname, localhost
 mynetworks = ${' '.join(sorted(mynetworks))}
@@ -25,6 +25,7 @@ inet_interfaces = 127.0.0.1
 % endif
 
 <%text>
+smtp_use_tls = yes
 smtp_tls_loglevel = 1
 smtp_tls_note_starttls_offer = yes
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
@@ -37,8 +38,8 @@ smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
 </%text>
 
 % if node.has_bundle('postfixadmin'):
-smtpd_tls_cert_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/fullchain.pem
+smtpd_tls_cert_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/fullchain.pem
-smtpd_tls_key_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/privkey.pem
+smtpd_tls_key_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/privkey.pem
 <%text>
 smtpd_use_tls=yes
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
@@ -47,7 +48,7 @@ smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated
 smtpd_helo_required = yes
 smtpd_helo_restrictions = permit_mynetworks reject_invalid_helo_hostname
 smtpd_data_restrictions = reject_unauth_pipelining
-smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/blocked_recipients, permit_mynetworks
+smtpd_recipient_restrictions = permit_mynetworks, check_recipient_access hash:/etc/postfix/blocked_recipients
 smtpd_relay_before_recipient_restrictions = yes
 
 # https://ssl-config.mozilla.org/#server=postfix&version=3.7.10&config=intermediate&openssl=3.0.11&guideline=5.7

bundles/postfix/items.py

@@ -21,12 +21,13 @@ for identifier in node.metadata.get('postfix/mynetworks', set()):
             netmask = '128'
         mynetworks.add(f'[{ip6}]/{netmask}')
 
+my_package = 'pkg_pacman:postfix' if node.os == 'arch' else 'pkg_apt:postfix'
 
 files = {
     '/etc/mailname': {
-        'content': node.metadata.get('postfix/myhostname'),
+        'content': node.metadata.get('postfix/myhostname', node.metadata['hostname']),
         'before': {
-            'pkg_apt:postfix',
+            my_package,
         },
         'triggers': {
             'svc_systemd:postfix:restart',
@@ -81,7 +82,7 @@ actions = {
         'command': 'newaliases',
         'triggered': True,
         'needs': {
-            'pkg_apt:postfix',
+            my_package,
         },
         'before': {
             'svc_systemd:postfix',
@@ -91,7 +92,7 @@ actions = {
         'command': 'postmap hash:/etc/postfix/blocked_recipients',
         'triggered': True,
         'needs': {
-            'pkg_apt:postfix',
+            my_package,
         },
         'before': {
             'svc_systemd:postfix',
@@ -104,7 +105,17 @@ svc_systemd = {
         'needs': {
             'file:/etc/postfix/master.cf',
             'file:/etc/postfix/main.cf',
-            'pkg_apt:postfix',
+            my_package,
         },
     },
 }
+
+if node.os == 'arch':
+    files['/etc/systemd/system/postfix.service.d/bundlewrap.conf'] = {
+        'source': 'arch-override.conf',
+        'content_type': 'mako',
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:postfix:restart',
+        },
+    }