078af95a65## Problem - https://jira.suse.com/browse/AGM-153 - For security reasons it should be possible to disable remote access to the Agama web server. A server which is not reachable cannot be hacked. 😃 ## Solution - Add a new `inst.listen_on` boot option, the possible values: - `inst.listen_on=all` - listen on all network interfaces (allow local and remote access). This is the default behavior used even without the `inst.listen_on` option, added just for completeness. - `inst.listen_on=localhost` - listen only on loop back (localhost) device. This disables remote access, Agama can be accessed only locally. - `inst.listen_on=<ip>` - listen on the specified IP address. Both IPv4 and IPv6 addresses are supported. It is possible to use multiple IP addresses separated by comma. Addresses not found in the system are ignored. - `inst.listen_on=<interface>` - listen on the specified network interface. Multiple interfaces can be separated by comma. Not found interfaces are ignored. Agama always listens on the local loop back interface even when specifying a specific network interface or IP address for listening. The reason is to avoid reporting connection errors by the Firefox started in the Live ISO. ## Details - The `--address2` CLI option has been removed, instead it is possible to specify `--address` option multiple times. - The PR includes the @mvidner's patch https://github.com/agama-project/agama/pull/3111 - fallback to an IPv4 address when listening to IPv6 address fails (when IPv6 is disabled with the `ipv6.disable=1` boot option) - Added the `agama-web-server.sh` wrapper script started from the systemd service. It evaluates the boot parameters and builds the address parameters for the Agama server. ## Notes - The other network services like SSH can be disabled using the standard `systemd.mask` boot option. For example to disable the SSH service use this boot option: `systemd.mask=sshd.service`. (I'll document this as well...) ## Testing - Tested manually in all scenarios: with disabled remote access, listening on the specified IPv6 (including link local address) or IPv4 address, listening on specified interface, listening on multiple interfaces - Tested Martin's patch with the `ipv6.disable=1` boot option, Agama properly listens on the IPv4 addresses in that case. --------- Co-authored-by: Martin Vidner <mvidner@suse.com>
295 lines
8.7 KiB
RPMSpec
295 lines
8.7 KiB
RPMSpec
#
|
|
# spec file for package agama
|
|
#
|
|
# Copyright (c) 2023-2025 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
Name: agama
|
|
# This will be set by osc services, that will run after this.
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Agama Installer
|
|
# If you know the license, put it's SPDX string here.
|
|
# Alternately, you can use cargo lock2rpmprovides to help generate this.
|
|
License: GPL-2.0-or-later
|
|
Url: https://github.com/agama-project/agama
|
|
Source0: agama.tar
|
|
Source1: vendor.tar.zst
|
|
|
|
# zypp-c-api dependencies
|
|
BuildRequires: gcc
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: make
|
|
BuildRequires: libzypp-devel
|
|
BuildRequires: libsuseconnect
|
|
# do not build on 32bits, the dependant libsuseconnect is 64bit only
|
|
ExcludeArch: %ix86 s390 ppc64
|
|
|
|
# defines the "limit_build" macro used in the "build" section below
|
|
BuildRequires: memory-constraints
|
|
BuildRequires: cargo-packaging
|
|
BuildRequires: pkgconfig(openssl)
|
|
# for msgfmt
|
|
BuildRequires: gettext-runtime
|
|
# used in tests for dbus service
|
|
BuildRequires: dbus-1-common
|
|
Requires: dbus-1-common
|
|
BuildRequires: dbus-1-daemon
|
|
BuildRequires: clang-devel
|
|
BuildRequires: pkgconfig(pam)
|
|
# includes findmnt
|
|
BuildRequires: util-linux-systemd
|
|
Requires: util-linux-systemd
|
|
# required by autoinstallation
|
|
BuildRequires: jsonnet
|
|
Requires: jsonnet
|
|
Requires: lshw
|
|
# required by the password checking
|
|
BuildRequires: libpwquality-tools
|
|
Requires: libpwquality-tools
|
|
# required by "agama logs store"
|
|
Requires: gzip
|
|
# required to compress the manual pages
|
|
Requires: tar
|
|
# required for translating the keyboards descriptions
|
|
BuildRequires: xkeyboard-config-lang
|
|
Requires: xkeyboard-config-lang
|
|
# required for getting the list of timezones
|
|
Requires: timezone
|
|
BuildRequires: timezone
|
|
# required for getting the languages information
|
|
BuildRequires: python-langtable-data
|
|
Requires: python-langtable-data
|
|
# dependency on the YaST part of Agama
|
|
Requires: agama-yast
|
|
Requires: agama-common
|
|
# required for importing SSL certificates
|
|
Requires: ca-certificates
|
|
|
|
%description
|
|
Agama is a service-based Linux installer. It is composed of an HTTP-based API,
|
|
a web user interface, a command-line interface and a D-Bus service which exposes
|
|
part of the YaST libraries.
|
|
|
|
%package -n agama-autoinstall
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Agama auto-installation service
|
|
License: GPL-2.0-or-later
|
|
Url: https://github.com/agama-project/agama
|
|
|
|
%description -n agama-autoinstall
|
|
Agama is a service-based Linux installer. This package contains the
|
|
auto-installation service.
|
|
|
|
%package -n agama-common
|
|
# This will be set by osc services, that will run after this.
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Common files for Agama server and CLI.
|
|
License: GPL-2.0-only
|
|
Url: https://github.com/agama-project/agama
|
|
|
|
%description -n agama-common
|
|
Files that are needed by the Agama server and the command-line interface, like
|
|
the JSON schemas or the Jsonnet libraries.
|
|
|
|
%package -n agama-cli
|
|
# This will be set by osc services, that will run after this.
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Agama command-line interface
|
|
License: GPL-2.0-only
|
|
Url: https://github.com/agama-project/agama
|
|
Requires: agama-common
|
|
|
|
%description -n agama-cli
|
|
Command line program to interact with the Agama installer.
|
|
|
|
%package -n agama-cli-bash-completion
|
|
Summary: Bash Completion for %{name}-cli
|
|
Group: System/Shells
|
|
Supplements: (%{name}-cli and bash-completion)
|
|
Requires: %{name}-cli = %{version}
|
|
Requires: bash-completion
|
|
BuildArch: noarch
|
|
|
|
%description -n agama-cli-bash-completion
|
|
Bash command-line completion support for %{name}.
|
|
|
|
%package -n agama-cli-fish-completion
|
|
Summary: Fish Completion for %{name}-cli
|
|
Group: System/Shells
|
|
Supplements: (%{name}-cli and fish)
|
|
Requires: %{name}-cli = %{version}
|
|
Requires: fish
|
|
BuildArch: noarch
|
|
|
|
%description -n agama-cli-fish-completion
|
|
Fish command-line completion support for %{name}-cli.
|
|
|
|
%package -n agama-cli-zsh-completion
|
|
Summary: Zsh Completion for %{name}-cli
|
|
Group: System/Shells
|
|
Supplements: (%{name}-cli and zsh)
|
|
Requires: %{name}-cli = %{version}
|
|
Requires: zsh
|
|
BuildArch: noarch
|
|
|
|
%description -n agama-cli-zsh-completion
|
|
Zsh command-line completion support for %{name}-cli.
|
|
|
|
%package -n agama-openapi
|
|
Summary: Agama's OpenAPI Specification
|
|
|
|
%description -n agama-openapi
|
|
The OpenAPI Specification (OAS) allows describing an HTTP API in an standard and
|
|
language-agnostic way. This package contains the specification for Agama's HTTP
|
|
API.
|
|
|
|
%package -n agama-scripts
|
|
Summary: Agama support for running user-defined scripts
|
|
|
|
%description -n agama-scripts
|
|
The Agama installer supports running user-defined scripts during and after the installation. This
|
|
package contains a systemd service to run scripts when booting the installed system.
|
|
|
|
%prep
|
|
%autosetup -a1 -n agama
|
|
# Remove exec bits to prevent an issue in fedora shebang checking. Uncomment only if required.
|
|
# find vendor -type f -name \*.rs -exec chmod -x '{}' \;
|
|
|
|
%build
|
|
# Require at least 1.3GB RAM per each parallel job (the size is in MB),
|
|
# this can limit the number of parallel jobs on systems with relatively small memory.
|
|
%{limit_build -m 1300}
|
|
|
|
%{cargo_build}
|
|
cargo run --package xtask -- manpages
|
|
gzip out/man/*
|
|
cargo run --package xtask -- completions
|
|
cargo run --package xtask -- openapi
|
|
make -C po
|
|
|
|
%install
|
|
env \
|
|
SRCDIR=%{_builddir}/agama \
|
|
DESTDIR=%{buildroot} \
|
|
NAME=%{name} \
|
|
bindir=%{_bindir} \
|
|
datadir=%{_datadir} \
|
|
pamvendordir=%{_pam_vendordir} \
|
|
unitdir=%{_unitdir} \
|
|
libexecdir=%{_libexecdir} \
|
|
mandir=%{_mandir} \
|
|
%{_builddir}/agama/install.sh
|
|
%find_lang agama
|
|
|
|
%check
|
|
PATH=$PWD/share/bin:$PATH
|
|
%ifarch aarch64
|
|
/usr/bin/cargo auditable test -j1 --offline --no-fail-fast
|
|
%else
|
|
echo $PATH
|
|
%{cargo_test}
|
|
%endif
|
|
|
|
%pre
|
|
%service_add_pre agama-web-server.service agama-proxy-setup.service
|
|
|
|
%pre -n agama-autoinstall
|
|
%service_add_pre agama-autoinstall.service
|
|
|
|
%pre -n agama-scripts
|
|
%service_add_pre agama-scripts.service
|
|
|
|
%post
|
|
%service_add_post agama-web-server.service agama-proxy-setup.service
|
|
|
|
%post -n agama-autoinstall
|
|
%service_add_post agama-autoinstall.service
|
|
|
|
%post -n agama-scripts
|
|
%service_add_post agama-scripts.service
|
|
|
|
%preun
|
|
%service_del_preun agama-web-server.service agama-proxy-setup.service
|
|
|
|
%preun -n agama-autoinstall
|
|
%service_del_preun agama-autoinstall.service
|
|
|
|
%preun -n agama-scripts
|
|
%service_del_preun agama-scripts.service
|
|
|
|
%postun
|
|
%service_del_postun_with_restart agama-web-server.service agama-proxy-setup.service
|
|
|
|
%postun -n agama-autoinstall
|
|
%service_del_postun_with_restart agama-autoinstall.service
|
|
|
|
%postun -n agama-scripts
|
|
%service_del_postun_with_restart agama-scripts.service
|
|
|
|
%files -f agama.lang
|
|
%doc README.md
|
|
%license LICENSE
|
|
%{_bindir}/agama-web-server
|
|
%{_bindir}/agama-web-server.sh
|
|
%{_bindir}/agama-proxy-setup
|
|
%{_pam_vendordir}/agama
|
|
%{_unitdir}/agama-web-server.service
|
|
%{_unitdir}/agama-proxy-setup.service
|
|
%dir %{_datadir}/agama/eula
|
|
|
|
%files -n agama-common
|
|
%dir %{_datadir}/agama/jsonnet
|
|
%{_datadir}/agama/jsonnet/agama.libsonnet
|
|
%dir %{_datadir}/agama/schema
|
|
%{_datadir}/agama/schema/dasd.schema.json
|
|
%{_datadir}/agama/schema/iscsi.schema.json
|
|
%{_datadir}/agama/schema/profile.schema.json
|
|
%{_datadir}/agama/schema/software.schema.json
|
|
%{_datadir}/agama/schema/storage.schema.json
|
|
%{_datadir}/agama/schema/storage.model.schema.json
|
|
%{_datadir}/agama/schema/zfcp.schema.json
|
|
|
|
%files -n agama-autoinstall
|
|
%{_bindir}/agama-autoinstall
|
|
%{_unitdir}/agama-autoinstall.service
|
|
|
|
%files -n agama-cli
|
|
%{_bindir}/agama
|
|
%{_mandir}/man1/agama*1%{?ext_man}
|
|
|
|
%files -n agama-cli-bash-completion
|
|
%{_datadir}/bash-completion/*
|
|
|
|
%files -n agama-cli-fish-completion
|
|
%dir %{_datadir}/fish
|
|
%{_datadir}/fish/*
|
|
|
|
%files -n agama-cli-zsh-completion
|
|
%dir %{_datadir}/zsh
|
|
%{_datadir}/zsh/*
|
|
|
|
%files -n agama-openapi
|
|
%dir %{_datadir}/agama
|
|
%dir %{_datadir}/agama/openapi
|
|
%{_datadir}/agama/openapi/*.json
|
|
|
|
%files -n agama-scripts
|
|
%{_unitdir}/agama-scripts.service
|
|
%{_libexecdir}/agama-scripts.sh
|
|
|
|
%changelog
|