8ff52c8717## Problem - Using the new `inst.listen_on` boot option to disable remote access to the server looks inconsistent (for disabling the SSH access you can use the `systemd.mask=sshd.service` boot option) - Simplify the implementation, limiting access to some interface or IP address was not requested - Related to https://github.com/agama-project/agama/pull/3269 ## Solution - Use systemd services to implement disabling the remote access - ~~Implement new `agama-web-server-local` and `agama-web-server-remote` services~~ - ~~By default the remote service is enabled, but the user can disable it and enable the local service instead using the `systemd.mask=agama-web-server-remote.service systemd.wants=agama-web-server-local.service` boot parameters.~~ - Support new `inst.remote=0` boot option ## Testing - Tested manually ## Notes I tried several approaches but either they did not work or were a bit hacky: 1. First a wanted to be the both local and remote services enabled by default. Because of conflicts only one of them should be running at a time. I used `Before` and `After` so the remote service starts first and the conflict should block the local service from running. Disabling the remote service allows running the local service automatically. The problem was that there is probably some race condition and sometimes the local service was actually running instead of the remote by default. I tried several changes but nothing helped. 2. Then I added code to the local service to explicitly check whether the remote service is disabled or not (using `ExecCondition` attribute). But that feels a bit hacky and it is a hidden magic. 3. Then I realized that the same way how you can disable a service at boot using `systemd.mask` option you can also enable a disabled service using the `systemd.wants` parameter. So instead of enabling both services enable only the default remote one. The users then can explicitly disable the remote service and enable the local one using the `systemd.mask=agama-web-server-remote.service systemd.wants=agama-web-server-local.service` boot options. But that turned out to be quite complicated. 4. So let's implement simple `inst.remote=0` boot option which disables the remotes access to the Agama installer. The SSH service can be disabled using the standard `systemd.mask=sshd.service` option.
296 lines
8.7 KiB
RPMSpec
296 lines
8.7 KiB
RPMSpec
#
|
|
# spec file for package agama
|
|
#
|
|
# Copyright (c) 2023-2025 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
Name: agama
|
|
# This will be set by osc services, that will run after this.
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Agama Installer
|
|
# If you know the license, put it's SPDX string here.
|
|
# Alternately, you can use cargo lock2rpmprovides to help generate this.
|
|
License: GPL-2.0-or-later
|
|
Url: https://github.com/agama-project/agama
|
|
Source0: agama.tar
|
|
Source1: vendor.tar.zst
|
|
|
|
# zypp-c-api dependencies
|
|
BuildRequires: gcc
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: make
|
|
BuildRequires: libzypp-devel
|
|
BuildRequires: libsuseconnect
|
|
# do not build on 32bits, the dependant libsuseconnect is 64bit only
|
|
ExcludeArch: %ix86 s390 ppc64
|
|
|
|
# defines the "limit_build" macro used in the "build" section below
|
|
BuildRequires: memory-constraints
|
|
BuildRequires: cargo-packaging
|
|
BuildRequires: pkgconfig(openssl)
|
|
# for msgfmt
|
|
BuildRequires: gettext-runtime
|
|
# used in tests for dbus service
|
|
BuildRequires: dbus-1-common
|
|
Requires: dbus-1-common
|
|
BuildRequires: dbus-1-daemon
|
|
BuildRequires: clang-devel
|
|
BuildRequires: pkgconfig(pam)
|
|
# includes findmnt
|
|
BuildRequires: util-linux-systemd
|
|
Requires: util-linux-systemd
|
|
# required by autoinstallation
|
|
BuildRequires: jsonnet
|
|
Requires: jsonnet
|
|
Requires: lshw
|
|
# required by the password checking
|
|
BuildRequires: libpwquality-tools
|
|
Requires: libpwquality-tools
|
|
# required by "agama logs store"
|
|
Requires: gzip
|
|
# required to compress the manual pages
|
|
Requires: tar
|
|
# required for translating the keyboards descriptions
|
|
BuildRequires: xkeyboard-config-lang
|
|
Requires: xkeyboard-config-lang
|
|
# required for getting the list of timezones
|
|
Requires: timezone
|
|
BuildRequires: timezone
|
|
# required for getting the languages information
|
|
BuildRequires: python-langtable-data
|
|
Requires: python-langtable-data
|
|
# dependency on the YaST part of Agama
|
|
Requires: agama-yast
|
|
Requires: agama-common
|
|
# required for importing SSL certificates
|
|
Requires: ca-certificates
|
|
|
|
%description
|
|
Agama is a service-based Linux installer. It is composed of an HTTP-based API,
|
|
a web user interface, a command-line interface and a D-Bus service which exposes
|
|
part of the YaST libraries.
|
|
|
|
%package -n agama-autoinstall
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Agama auto-installation service
|
|
License: GPL-2.0-or-later
|
|
Url: https://github.com/agama-project/agama
|
|
|
|
%description -n agama-autoinstall
|
|
Agama is a service-based Linux installer. This package contains the
|
|
auto-installation service.
|
|
|
|
%package -n agama-common
|
|
# This will be set by osc services, that will run after this.
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Common files for Agama server and CLI.
|
|
License: GPL-2.0-only
|
|
Url: https://github.com/agama-project/agama
|
|
|
|
%description -n agama-common
|
|
Files that are needed by the Agama server and the command-line interface, like
|
|
the JSON schemas or the Jsonnet libraries.
|
|
|
|
%package -n agama-cli
|
|
# This will be set by osc services, that will run after this.
|
|
Version: 0
|
|
Release: 0
|
|
Summary: Agama command-line interface
|
|
License: GPL-2.0-only
|
|
Url: https://github.com/agama-project/agama
|
|
Requires: agama-common
|
|
|
|
%description -n agama-cli
|
|
Command line program to interact with the Agama installer.
|
|
|
|
%package -n agama-cli-bash-completion
|
|
Summary: Bash Completion for %{name}-cli
|
|
Group: System/Shells
|
|
Supplements: (%{name}-cli and bash-completion)
|
|
Requires: %{name}-cli = %{version}
|
|
Requires: bash-completion
|
|
BuildArch: noarch
|
|
|
|
%description -n agama-cli-bash-completion
|
|
Bash command-line completion support for %{name}.
|
|
|
|
%package -n agama-cli-fish-completion
|
|
Summary: Fish Completion for %{name}-cli
|
|
Group: System/Shells
|
|
Supplements: (%{name}-cli and fish)
|
|
Requires: %{name}-cli = %{version}
|
|
Requires: fish
|
|
BuildArch: noarch
|
|
|
|
%description -n agama-cli-fish-completion
|
|
Fish command-line completion support for %{name}-cli.
|
|
|
|
%package -n agama-cli-zsh-completion
|
|
Summary: Zsh Completion for %{name}-cli
|
|
Group: System/Shells
|
|
Supplements: (%{name}-cli and zsh)
|
|
Requires: %{name}-cli = %{version}
|
|
Requires: zsh
|
|
BuildArch: noarch
|
|
|
|
%description -n agama-cli-zsh-completion
|
|
Zsh command-line completion support for %{name}-cli.
|
|
|
|
%package -n agama-openapi
|
|
Summary: Agama's OpenAPI Specification
|
|
|
|
%description -n agama-openapi
|
|
The OpenAPI Specification (OAS) allows describing an HTTP API in an standard and
|
|
language-agnostic way. This package contains the specification for Agama's HTTP
|
|
API.
|
|
|
|
%package -n agama-scripts
|
|
Summary: Agama support for running user-defined scripts
|
|
|
|
%description -n agama-scripts
|
|
The Agama installer supports running user-defined scripts during and after the installation. This
|
|
package contains a systemd service to run scripts when booting the installed system.
|
|
|
|
%prep
|
|
%autosetup -a1 -n agama
|
|
# Remove exec bits to prevent an issue in fedora shebang checking. Uncomment only if required.
|
|
# find vendor -type f -name \*.rs -exec chmod -x '{}' \;
|
|
|
|
%build
|
|
# Require at least 1.3GB RAM per each parallel job (the size is in MB),
|
|
# this can limit the number of parallel jobs on systems with relatively small memory.
|
|
%{limit_build -m 1300}
|
|
|
|
%{cargo_build}
|
|
cargo run --package xtask -- manpages
|
|
gzip out/man/*
|
|
cargo run --package xtask -- completions
|
|
cargo run --package xtask -- openapi
|
|
make -C po
|
|
|
|
%install
|
|
env \
|
|
SRCDIR=%{_builddir}/agama \
|
|
DESTDIR=%{buildroot} \
|
|
NAME=%{name} \
|
|
bindir=%{_bindir} \
|
|
datadir=%{_datadir} \
|
|
pamvendordir=%{_pam_vendordir} \
|
|
unitdir=%{_unitdir} \
|
|
libexecdir=%{_libexecdir} \
|
|
mandir=%{_mandir} \
|
|
%{_builddir}/agama/install.sh
|
|
%find_lang agama
|
|
|
|
%check
|
|
PATH=$PWD/share/bin:$PATH
|
|
%ifarch aarch64
|
|
/usr/bin/cargo auditable test -j1 --offline --no-fail-fast
|
|
%else
|
|
echo $PATH
|
|
%{cargo_test}
|
|
%endif
|
|
|
|
%pre
|
|
%service_add_pre agama-web-server.service agama-proxy-setup.service
|
|
|
|
%pre -n agama-autoinstall
|
|
%service_add_pre agama-autoinstall.service
|
|
|
|
%pre -n agama-scripts
|
|
%service_add_pre agama-scripts.service
|
|
|
|
%post
|
|
%service_add_post agama-web-server.service agama-proxy-setup.service
|
|
|
|
%post -n agama-autoinstall
|
|
%service_add_post agama-autoinstall.service
|
|
|
|
%post -n agama-scripts
|
|
%service_add_post agama-scripts.service
|
|
|
|
%preun
|
|
%service_del_preun agama-web-server.service agama-proxy-setup.service
|
|
|
|
%preun -n agama-autoinstall
|
|
%service_del_preun agama-autoinstall.service
|
|
|
|
%preun -n agama-scripts
|
|
%service_del_preun agama-scripts.service
|
|
|
|
%postun
|
|
%service_del_postun_with_restart agama-web-server.service agama-proxy-setup.service
|
|
|
|
%postun -n agama-autoinstall
|
|
%service_del_postun_with_restart agama-autoinstall.service
|
|
|
|
%postun -n agama-scripts
|
|
%service_del_postun_with_restart agama-scripts.service
|
|
|
|
%files -f agama.lang
|
|
%doc README.md
|
|
%license LICENSE
|
|
%{_bindir}/agama-web-server
|
|
%{_bindir}/agama-journal
|
|
%{_bindir}/agama-zypp-journal
|
|
%{_bindir}/agama-proxy-setup
|
|
%{_pam_vendordir}/agama
|
|
%{_unitdir}/agama-web-server.service
|
|
%{_unitdir}/agama-proxy-setup.service
|
|
%dir %{_datadir}/agama/eula
|
|
|
|
%files -n agama-common
|
|
%dir %{_datadir}/agama/jsonnet
|
|
%{_datadir}/agama/jsonnet/agama.libsonnet
|
|
%dir %{_datadir}/agama/schema
|
|
%{_datadir}/agama/schema/dasd.schema.json
|
|
%{_datadir}/agama/schema/iscsi.schema.json
|
|
%{_datadir}/agama/schema/profile.schema.json
|
|
%{_datadir}/agama/schema/software.schema.json
|
|
%{_datadir}/agama/schema/storage.schema.json
|
|
%{_datadir}/agama/schema/storage.model.schema.json
|
|
%{_datadir}/agama/schema/zfcp.schema.json
|
|
|
|
%files -n agama-autoinstall
|
|
%{_bindir}/agama-autoinstall
|
|
%{_unitdir}/agama-autoinstall.service
|
|
|
|
%files -n agama-cli
|
|
%{_bindir}/agama
|
|
%{_mandir}/man1/agama*1%{?ext_man}
|
|
|
|
%files -n agama-cli-bash-completion
|
|
%{_datadir}/bash-completion/*
|
|
|
|
%files -n agama-cli-fish-completion
|
|
%dir %{_datadir}/fish
|
|
%{_datadir}/fish/*
|
|
|
|
%files -n agama-cli-zsh-completion
|
|
%dir %{_datadir}/zsh
|
|
%{_datadir}/zsh/*
|
|
|
|
%files -n agama-openapi
|
|
%dir %{_datadir}/agama
|
|
%dir %{_datadir}/agama/openapi
|
|
%{_datadir}/agama/openapi/*.json
|
|
|
|
%files -n agama-scripts
|
|
%{_unitdir}/agama-scripts.service
|
|
%{_libexecdir}/agama-scripts.sh
|
|
|
|
%changelog
|