Drop profiles::certbot requires that duplicate Package[certbot] - #204
Drop profiles::certbot requires that duplicate Package[certbot]#204miharp wants to merge 2 commits into
Conversation
profiles::nginx pulls in the letsencrypt class since 26d19db, and its install class declares Package['letsencrypt'] with name certbot. Any catalog that also reaches profiles::certbot fails to compile on the duplicate, which is every catalog containing profiles::grafana or profiles::postfix: roles::voxpupuli, so the voxpupu.li node, broken since March. Fixes voxpupuli#203. Verified in a Vagrant lab on a fresh Ubuntu 24.04 VM under the real hostname: the role compiles and applies with this change, certbot arrives via the letsencrypt class, and the distro package's own systemd timer covers renewal. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
rexml is a bundled gem since Ruby 3, so under Bundler it only loads if the Gemfile names it (same story as the syslog entry). The unit test job excludes the system_tests group whose beaker dependency was the only other path to it, so profiles::libvirt specs fail with 'cannot load such file -- rexml/document'. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
|
Deployment note for whoever merges: the fix itself is low risk (certbot stays installed, now owned by the letsencrypt class; the distro certbot.timer keeps running; the orphaned verbose.conf dropin just goes unmanaged). The thing to plan for is that merging turns Puppet back on for voxpupu.li after five months, so the first agent run applies the accumulated delta in one go. Most of that delta (systemd v10, stdlib v10, foreman_proxy v31, choria bumps) has been applying to the rest of the fleet all along. Unique to this node: puppet-nginx v8 re-renders its vhosts (the lab run rendered exactly these profiles under v8 without config errors), and puppet-grafana v15 may upgrade grafana-server and run its DB migrations, which is the one stateful change worth watching. Suggested first run: puppet agent -t --noop on voxpupu.li, read the change list (expect nginx config rewrites, possibly a grafana upgrade, a certbot version bump), then run enforcing. For reference, a fresh Ubuntu 24.04 VM applied this whole catalog from zero and came up with services running: https://github.com/miharp/controlrepo-lab/blob/main/evidence/vox01-certbot-fix-2026-08-14.log |
|
@bastelfreak ready for review/merge |
2 participants
Fixes #203. Two deleted requires: profiles::grafana and profiles::postfix both pulled in profiles::certbot, whose Package[certbot] collides with the letsencrypt class that profiles::nginx has included since 26d19db. Every catalog containing either profile has failed to compile since March, including the real voxpupu.li node.
Full diagnosis in #203. Lab-verified on a fresh Ubuntu 24.04 VM under the real hostname running roles::voxpupuli masterless: catalog compiles and applies, certbot arrives via the letsencrypt class, distro timer covers renewal (console log).
Worked on this with Claude (Claude Code) per the AI usage policy; commit carries the trailer.
Second commit: with the certbot wall gone, CI surfaced one more pre-existing failure, profiles::libvirt specs missing rexml (a bundled gem since Ruby 3, previously reachable only through the excluded system_tests group). Added to the Gemfile the same way the existing syslog entry handles that gem class. With it, this PR should be the first green CI run in the retained history of this repo.