Repository navigation
feat(roles/repo_linuxfabrik): add role - #489
Merged
Merged
Conversation
Deploy repo.linuxfabrik.ch with the same files, repository IDs and key paths as the linuxfabrik-release package (Linuxfabrik/packaging): EL 8/9/10, Fedora 44, SLE 15/16, Debian 12/13, Ubuntu 22.04/24.04/26.04, one template per platform. Packages are signature-checked (gpgcheck=1, repo_gpgcheck=0 as in the package), the APT metadata via Signed-By. The testing channel is optional (repo_linuxfabrik__testing_repo_enabled). Adds playbooks/repo_linuxfabrik.yml and the molecule scenario.
…eachable Align the .repo templates with linuxfabrik-release 1-2 (Linuxfabrik/packaging 57af302): skip_if_unavailable=1 for linuxfabrik and linuxfabrik-testing, and the same explanatory comment block as the package.
…EPEL Run repo_linuxfabrik right after repo_epel on RHEL 8 to 10 and their derivatives, skippable with setup_basic__skip_repo_linuxfabrik. Left out: EL 7, where the role aborts; Debian and Ubuntu, where lfops__repo_mirror_url often names a mirror without the repository and a failing `apt update` would stop the play; Fedora, which has no mirror. The 001 mirrors (mirror-rhel8/9/10.linuxfabrik.ch) serve the release channel below linuxfabrik/el/<N>/x86_64/linuxfabrik/release/. verify.yml resolves exoscale-cli from the repository on the Red Hat family and checks that Debian and Ubuntu stay without it. Tested with Molecule: the full scenario on rocky8/9/10 and debian13 (debian13 check green; the Rocky hosts stopped earlier at the AIDE and about-me checks because of rewritten and truncated .pyc files in the monitoring plugins venv, unrelated to this change), then converge with --tags repo_baseos,repo_epel,repo_linuxfabrik on rocky8/9/10, where dnf resolves exoscale-cli 1.103.2-1 from the repository.
…k in pre_tasks repo_linuxfabrik runs in the play but was missing from setup_basic__roles__internal_var, so its variables were only validated once the play reached the role. tests/unit/test_playbooks.py caught it.
…ian and Ubuntu Drop the Debian and Ubuntu exclusion from b62eb69. A mirror in lfops__repo_mirror_url that does not serve the repository now stops the play at `apt update`, which is acceptable: the fix is to sync the repository to the mirror or to set repo_linuxfabrik__mirror_url: ''. verify.yml checks that apt offers acme.sh from the release channel instead of checking that the repository is absent.
NavidSassan
force-pushed
the
feat/repo_linuxfabrik
branch
from
October 27, 2026 12:54
bb583ed to
7773e6a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
roles/repo_linuxfabrikandplaybooks/repo_linuxfabrik.yml. They deploy the Linuxfabrik package repository repo.linuxfabrik.ch with thereleasechannel enabled andtestingoptional (repo_linuxfabrik__testing_repo_enabled, defaultfalse).Design
linuxfabrik,linuxfabrik-testing) and key paths as thelinuxfabrik-releasepackage from Linuxfabrik/packaging, so role and package don't define the repository twice. Apart from the 3-line Ansible header, the rendered files were compared byte for byte against the published packages for all 11 platforms.templates/<platform>/and onevars/<platform>.yml, selected viashared/platform-variables.yml(same pattern asrepo_epel): RedHat8/9/10, Fedora44, Suse15/16, Debian12/13, Ubuntu22/24/26. Unsupported platforms or architectures abort with the supported list.files/), like inrepo_openvpn.gpgcheck=1,repo_gpgcheck=0, matching the next iteration oflinuxfabrik-release. Withrepo_gpgcheck=1,rpm --importdoes not fill dnf's per-repo keyring, so non-interactive dnf CLI calls failed (dnf 4) or skipped the repository (dnf 5).<mirror>/linuxfabrik/<upstream path>, the upstream layout 1:1. Basic auth works on the Red Hat family and SUSE (in the URL for zypper, as inrepo_icinga).Deliberate deviation from CONTRIBUTING
On Debian/Ubuntu the key goes to
/usr/share/keyrings/linuxfabrik.gpg(binary), not/etc/apt/keyrings/, so thatSigned-Byand the file match the package. The reason is documented intasks/Debian.ymland the README.Tests
repo_linuxfabrikon Debian 12/13, Rocky 8/9/10 and Ubuntu 22.04/24.04/26.04: converge, verify, idempotence and verify are green. Verify checks that the package manager reads both channels without a terminal,rpm --checksigon a downloaded package, and that apt fetches both suites without W:/E:.ansible-lint(production profile),pre-commitandtests/unit/test_playbooks.pypass.setup_basic
setup_basicrunsrepo_linuxfabrikright afterrepo_epelon Debian, Ubuntu and RHEL 8 to 10 and their derivatives (setup_basic__skip_repo_linuxfabrik). EL 7 and Fedora are left out, see the comment in the playbook. A mirror inlfops__repo_mirror_urlhas to serve the repository: dnf skips it otherwise, apt stops the play atapt update. The 001 mirrors serve the release channel belowlinuxfabrik/el/<N>/x86_64/linuxfabrik/release/. Moleculesetup_basicon Debian 12/13 and Ubuntu 22.04/24.04/26.04 is green, including the check that apt offersacme.shfrom the release channel.