CI has never been green; current blocker is a duplicate Package[certbot] in profiles::grafana catalogs

[miharp]

Every pull request CI run currently fails in the unit-test job with:

Cannot alias Package[certbot] to [nil, "certbot", nil]
  (profiles/manifests/certbot.pp, line 6);
  resource already declared (letsencrypt/manifests/install.pp, line 16)

All 14 failures are profiles::grafana examples. The chain:

• 26d19db (2026-03-16, "configure tls") added include profiles::lets_encrypt to profiles::nginx
• profiles::lets_encrypt declares class { 'letsencrypt': }, whose install class declares Package['letsencrypt'] with name => 'certbot'
• profiles::grafana does require profiles::nginx and require profiles::certbot, and profiles::certbot declares Package['certbot']

Two packages resolving to the same name is a compile error, so every catalog containing both profiles has been uncompilable since March. Renovate PR runs confirm the timeline: identical failure signature on 2026-07-28, 08-06, 08-07, 08-08 (and the red CI on #153 in April was this, not the PR).

I verified it is not fixture drift: the spec fails identically with the letsencrypt fixture checked out at the Puppetfile pin (v13.3.0). The conflict is real in the manifests.

Two questions this raises:

1. Does grafana.voxpupu.li still apply cleanly? If its role composes these same profiles, the node has been failing agent runs since March, not just CI.
2. Is profiles::certbot still needed? The letsencrypt module manages the package itself now. Setup Matrix Synapse (continues #153) #202 hit this exact collision in the matrix role and fixed it by dropping the profiles::certbot include; the same one-line fix likely applies to profiles::grafana (the certbot.timer management in profiles::certbot would need a home, or the letsencrypt module's renewal handling replaces it).

Happy to PR the fix, but it touches the grafana node so I wanted eyes on question 1 first.

Found while working on #202. Investigated with Claude (Claude Code), per the AI usage policy.

[miharp]

Dug into when this started: it goes deeper than March. The CI workflow has zero successful runs in GitHub's entire retained history, all 238 runs back through January 2025 failed. Logs older than ~90 days are expired so I can't say what the pre-March runs died on, but the certbot signature above is confirmed from the first runs after 26d19db (2026-03-29) through today. So red CI has been the ambient normal here for a long time, which is probably why nobody chased this particular failure.

[miharp]

Traced question 1 to its answer: profiles::grafana is part of roles::voxpupuli, which data/nodes/voxpupu.li.yaml assigns to the main voxpupu.li web server. Catalog compilation is deterministic, so that node cannot have applied cleanly since 26d19db reached production: roughly five months of failed agent runs on the flagship host, meaning no package updates or drift correction via Puppet in that time. What I cannot see without access is Foreman's report history for voxpupu.li, which would confirm the exact date runs went red (useful since CI logs from before May are expired). Given the node question answers itself, I will put up the fix PR.

[miharp]

Lab-verified the fix. I added the real node's role to my Vagrant lab: a fresh Ubuntu 24.04 VM with hostname voxpupu.li applying roles::voxpupuli masterless, exactly like the fleet does. With the two requires removed (profiles::grafana and profiles::postfix, which is the second path to the same collision), the catalog compiles and applies: 247s first run, idempotent second run, certbot 2.9.0-1 installed via the letsencrypt class, postfix/postgresql/prometheus/choria all running. Full console log: https://github.com/miharp/matrix-lab/blob/main/evidence/vox01-certbot-fix-2026-08-14.log

The run also surfaced three fresh-bootstrap gaps that predate and are unrelated to the certbot issue, noting them here for completeness: the puppetmodule user wants an rvm group nothing in the role manages (puppetmodule.pp line 80, presumably hand-installed on the live node long ago); the puppet-grafana plugin provider fails against current grafana-cli (could not find config defaults / homepath, blocks grafana-server on a fresh node); and the static sentry.voxpupu.li.conf references certbot's options-ssl-nginx.conf unguarded, so nginx -t fails until certbot has really run. Happy to split those into their own issues.

Fix branch: production...miharp:controlrepo:grafana-certbot-fix