A lot of modules are requiring puppet versions >5.5, so we should upgrade puppet. Note: [Puppet](https://packages.debian.org/bookworm/puppet), [Puppet Server](https://packages.debian.org/bookworm/puppetserver) and [Puppet DB](https://packages.debian.org/bookworm/puppet) version 7 are now in Bookworm. ## Preparation - [x] Install a dev Puppet Server VM in Skink with Bookworm. - [x] Deploy a Puppet Server there using a dev env, add itself as a Puppet node. - [x] Fix whatever is needed so it's able to properly run and configure itself. - [x] Upgrade all submodules to the lowest version compatible with Puppet 7 (we are unsure about backwards compatibility and want to have a working setup as soon as possible) ## Reinstall the production Puppet Server using Bookworm - [x] Disable Puppet Agent in all machines - [x] Stop the Puppet Server VM - [x] Install a fresh Puppet Server VM with Bookworm, use the same Libvirt config (name, IP, resources, etc) (related: #17982) - [x] Push to the new VM the changes made to the dev env in the preparation step - [x] Add `puppet.lizard` as a node to itself --- --- --- :warning: Up to this point, everything is "easily" reversible. Continuing from here means no turning back! --- --- --- ## Add all machines to the new Puppet Server For each machine: - Allow connections from the node to the Puppet VM (VPN and firewall will be broken, so this might need custom net/forward iptables rules locally and on lizard) - Add `noop = true` to `/etc/puppet/puppet.conf` - Check what would change or break and needs fix by running the Puppet Agent with `--noop` - Fix whatever is needed - Remove `noop = true` from `/etc/puppet/puppet.conf` - Run Puppet Agent in the machine until it stops complaining and is happy Add physical servers: - [x] Skink - [x] Iguana - [x] Dragon - [x] Lizard - ~~Stone~~ (Masterless node) Add 3rd-party VMs: - [x] `teels.tails.boum.org` - [x] `ecours.tails.boum.org` Add self-hosted VMs: - [x] `apt.lizard` - [x] `apt-proxy.lizard` - [x] `bitcoin.lizard` - [x] `bittorrent.lizard` - [x] `bridge.lizard` - [x] `dns.lizard` - [x] `mail.lizard` - [x] `misc.lizard` - [x] `puppet.lizard` - [x] `puppet-git.lizard` - [x] `rsync.lizard` - [x] `survey.lizard` - [x] `translate.lizard` - [x] `whisperback.lizard` - [x] `www.lizard` - [x] `isoworker1.dragon` - [x] `isoworker2.dragon` - [x] `isoworker3.dragon` - [x] `isoworker4.dragon` - [x] `isoworker5.dragon` - [x] `jenkins.dragon` - [x] `gitlab-runner.iguana` - [x] `isoworker6.iguana` - [x] `isoworker7.iguana` - [x] `isoworker8.iguana` ## Needfix - [x] Mirroring of `puppet-code.git` from the Puppet VM to GitLab is broken - [x] Puppet Server can't find the `gpgme` gem -- :warning: Breaks yapgp! - [x] Document the issue with `hiera-eyaml`: https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1927662.html - [x] Document manual creation of the `puppet@puppet` SSH or Puppetize it - [x] Make sure GitLab knows about all new SSH keys - [x] Make sure Gitolite knows about all new SSH keys - [x] Make sure there's documentation about the manual installation of SSH keys (GitLab, Gitolite, something else?) - [x] Decide about the unmaintained translate module - [x] Decide about the future of tails/puppet-reprepro> ## Upgrade submodules to latest version compatible For each 3rd-party submodule: - Upgrade it to the latest version compatible with Puppet 7 - Fix whatever is needed to make our code compatible with that version Submodules: - [x] `modules/apt` - [x] `modules/apt_listchanges` - [x] `modules/archive` - [x] `modules/augeas` - [x] `modules/augeasproviders_core` - [x] `modules/augeasproviders_ssh` - [x] `modules/backupninja` - [x] `modules/bitcoind` - [x] `modules/borgbackup` - [x] `modules/concat` - [x] `modules/docker` - [x] `modules/dovecot` - [x] `modules/etckeeper` - [x] `modules/extlib` - [x] `modules/firewall` - [x] `modules/git` - [x] `modules/gitlab_ci_runner` - [x] `modules/gitolite` - [x] `modules/groupmembership` - [x] `modules/healthcheck` - [x] `modules/icinga2` - [x] `modules/icingaweb2` - [x] `modules/inifile` - [x] `modules/jenkins` - [x] `modules/letsencrypt` - [x] `modules/libvirt` - [x] `modules/loginrecords` - [x] `modules/mailalias` - [x] `modules/munin` - [x] `modules/mysql` - [x] `modules/network` - [x] `modules/nginx` - [x] `modules/openssl` - [x] `modules/podman` - [x] `modules/postfix` - [x] `modules/postgresql` - [x] `modules/powerdns` - [x] `modules/puppet` - [x] `modules/puppetdb` - [x] `modules/rbac` - [x] `modules/reboot` - [x] `modules/redis` - [x] `modules/reprepro` - [x] `modules/rspamd` - [x] `modules/rss2email` - [x] `modules/schleuder` - [x] `modules/sshkeys` - [x] `modules/stdlib` - [x] `modules/sudo` - [x] `modules/sysctl` - [x] `modules/systemd` - [x] `modules/tails` - [x] `modules/timezone` - [x] `modules/tirewall` - [x] `modules/tor` - [x] `modules/translate` - [x] `modules/unattended_upgrades` - [x] `modules/vcsrepo` - [x] `modules/weblate` - [x] `modules/yapgp`