feat(roles/curaline): install the client from the Linuxfabrik repository

CHANGELOG.md

@@ -68,7 +68,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * **role:exoscale_vm**: Security group rules support every protocol Exoscale offers, ICMP with `icmp_type` and `icmp_code`, private networks can be detached with `state: 'absent'`, and an existing instance is attached to a security group added later.
 * **role:collabora**: Add support for Collabora Online Enterprise 25.04.14.
 * **execution-environment**: Add the `telekom_mms.icinga_director` collection, so inventories using its Icinga Director inventory plugin work inside the EE.
-* **role:curaline, playbook:curaline**: Add a role and playbook that install and configure the curaLINE Client of Swisscom, which exchanges files with the curaLINE Document Routing service.
+* **role:curaline, playbook:curaline**: Add a role and playbook that install the curaLINE Client of Swisscom from the Linuxfabrik repository and configure its connectors and folders; the client exchanges files with the curaLINE Document Routing service.
 * **role:gitlab_ce**: Behind a reverse proxy, GitLab can show and log the real client IP address instead of the address of the proxy, for example under "Current sign-in IP". Set `gitlab_ce__rb_nginx_real_ip_trusted_addresses` to the address of the proxy.
 * **role:apache_tomcat**: With `lfops__remove_rpmnew_rpmsave`, the role also removes the `.rpmnew` and `.rpmsave` files next to the Tomcat configuration files it deploys.
 * **role:apache_tomcat**: Add support for Tomcat 10.1 on RHEL 10.

extensions/molecule/curaline/install/inventory/group_vars/systems_under_test.yml

@@ -1,5 +1,3 @@
-curaline__version: '6.2.1'
-
 # the credentials are not valid: the client keeps running and reports the denied login in its
 # health endpoint, which is all this scenario needs to see that it reads its configuration.
 curaline__client_id: 'linuxfabrik'

extensions/molecule/curaline/install/inventory/hosts.yml

@@ -2,9 +2,9 @@
 
 # curaline targets 'lfops_curaline' (see playbooks/curaline.yml: hosts).
 #
-# All platforms of COMPATIBILITY.md are covered: the client is a self-contained download
-# with its own Java runtime, so the role differs between the families only in the packages
-# and in SELinux, which the RHEL family has enforcing.
+# All platforms of COMPATIBILITY.md are covered: the package of the client brings its own
+# Java runtime, so the role is the same on all of them, and only the RHEL family has SELinux
+# enforcing.
 lfops_curaline:
   children:
     systems_under_test:

extensions/molecule/curaline/install/molecule.yml

@@ -2,6 +2,6 @@
 # `molecule test --scenario-name curaline/install`.
 #
 # The shared config.yml already provisions libvirt/KVM VMs, so this
-# scenario needs no driver override: the role sets the SELinux file context that lets systemd
-# execute the client from /usr/lib, which only a VM with an enforcing SELinux proves, and the
-# Debian family needs systemd, which the Debian and Ubuntu container images do not ship.
+# scenario needs no driver override: whether systemd may execute the packaged client from
+# /usr/lib only a VM with an enforcing SELinux proves, and the client runs as a systemd
+# service, which the container images do not ship.

extensions/molecule/curaline/install/verify.yml

@@ -1,7 +1,8 @@
-# What only the running system can confirm is that the client starts from the unpacked
-# download under the configured account, that SELinux lets systemd execute it, and that it reads the
-# configuration the role wrote: the client is asked for its health and its version, and it
-# reports the values it parsed in its log. The configuration files themselves are not checked.
+# What only the running system can confirm is that the client starts from the package under
+# its account, that SELinux lets systemd execute it, that the drop-in lets it write to the
+# folders of its connectors, and that it reads the configuration the role wrote: the client is
+# asked for its health and its version, and it reports the values it parsed in its log. The
+# configuration files themselves are not checked.
 - name: 'Verify curaline'
   hosts: 'systems_under_test'
   gather_facts: false
@@ -43,9 +44,12 @@
         return_content: true
       register: '__molecule__curaline_info_result'
 
-    - name: 'Assert that the client is the installed version'
+    - name: 'Gather the package facts'
+      ansible.builtin.package_facts:  # yamllint disable-line rule:empty-values
+
+    - name: 'Assert that the client is the version of the installed package'
       ansible.builtin.assert:
-        that: '__molecule__curaline_info_result["json"]["build"]["version"] == curaline__version'
+        that: '__molecule__curaline_info_result["json"]["build"]["version"] == ansible_facts["packages"]["swisscom-schweiz-ag-cdr-client"][0]["version"]'
 
     - name: 'systemctl show swisscom-schweiz-ag-cdr-client.service --property=MainPID --value' # noqa command-instead-of-module (read-only property query)
       ansible.builtin.command: 'systemctl show swisscom-schweiz-ag-cdr-client.service --property=MainPID --value'
@@ -57,11 +61,9 @@
         path: '/proc/{{ __molecule__curaline_mainpid_result["stdout"] }}'
       register: '__molecule__curaline_proc_result'
 
-    # the hnet scenario imports this playbook and sets curaline__user, the install scenario
-    # relies on the role default.
-    - name: 'Assert that the client runs as {{ curaline__user | d("swisscom-schweiz-ag-cdr-client") }}'
+    - name: 'Assert that the client runs as swisscom-schweiz-ag-cdr-client'
       ansible.builtin.assert:
-        that: '__molecule__curaline_proc_result["stat"]["pw_name"] == curaline__user | d("swisscom-schweiz-ag-cdr-client")'
+        that: '__molecule__curaline_proc_result["stat"]["pw_name"] == "swisscom-schweiz-ag-cdr-client"'
 
     # the client logs the schedule delay and the folders it watches after it has parsed them.
     - name: 'Wait for the client to log the polling of the source folder'
@@ -87,9 +89,33 @@
       ansible.builtin.assert:
         that: 'not __molecule__curaline_absent_result["stat"]["exists"]'
 
-    # without the bin_t file context systemd cannot execute the client from /usr/lib, and the
-    # service would not run at all. a host that happens to run permissive would pass that
-    # assertion without proving anything, so the mode is asserted too.
+    # the sandbox of the packaged unit only lets the client write to the folders of the
+    # drop-in, so the folders of the connector must be in it, created for the group of the
+    # account.
+    - name: 'systemctl show swisscom-schweiz-ag-cdr-client.service --property=ReadWritePaths --value' # noqa command-instead-of-module (read-only property query)
+      ansible.builtin.command: 'systemctl show swisscom-schweiz-ag-cdr-client.service --property=ReadWritePaths --value'
+      changed_when: false
+      register: '__molecule__curaline_readwritepaths_result'
+
+    - name: 'stat /data/xml/outbox-test/XMLDatenforum'
+      ansible.builtin.stat:
+        path: '/data/xml/outbox-test/XMLDatenforum'
+      register: '__molecule__curaline_outbox_result'
+
+    - name: 'Assert that the client may write to the folders of its connector'
+      ansible.builtin.assert:
+        that:
+          - '"/data/xml/archive-test" in __molecule__curaline_readwritepaths_result["stdout"]'
+          - '"/data/xml/inbox-test/XMLDatenforum" in __molecule__curaline_readwritepaths_result["stdout"]'
+          - '"/data/xml/outbox-test/XMLDatenforum" in __molecule__curaline_readwritepaths_result["stdout"]'
+          - '__molecule__curaline_outbox_result["stat"]["pw_name"] == "swisscom-schweiz-ag-cdr-client"'
+          - '__molecule__curaline_outbox_result["stat"]["mode"] == "2770"'
+
+    # the packaged unit starts the client through /usr/bin/env (bin_t), so that systemd
+    # transitions to unconfined_service_t; the client itself below /usr/lib is lib_t, which
+    # systemd could not execute directly, and the service would not run at all. a host that
+    # happens to run permissive would pass that assertion without proving anything, so the
+    # mode is asserted too.
     - name: 'Verify the SELinux context of the client'
       when:
         - 'inventory_hostname is match("rocky")'

playbooks/README.md

@@ -215,6 +215,7 @@ Calls the following roles (in order):
 
 Calls the following roles (in order):
 
+* [repo_linuxfabrik](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_linuxfabrik): `curaline__skip_repo_linuxfabrik`
 * [curaline](https://github.com/Linuxfabrik/lfops/tree/main/roles/curaline)
 
 

playbooks/curaline.yml

@@ -19,6 +19,10 @@
 
   roles:
 
+    - role: 'linuxfabrik.lfops.repo_linuxfabrik'
+      when:
+        - 'not curaline__skip_repo_linuxfabrik | d(false)'
+
     - role: 'linuxfabrik.lfops.curaline'