# SPDX-FileCopyrightText: William Moreno Reyes CP | MBA # SPDX-License-Identifier: Apache-2.0 %global commit 4be359df412f893d70ccab00dac5379fea555560 Name: admiral-common Version: 0.0.1rc2 Release: 1%{?dist} Summary: Common files and utilities for Admiral PaaS License: Apache-2.0 URL: https://github.com/admiral-project/admiral Source0: https://github.com/admiral-project/admiral/archive/%{commit}/admiral-%{version}.tar.gz BuildArch: noarch BuildRequires: systemd-rpm-macros Requires: python3 Requires: ansible-core Requires: ansible-collection-ansible-posix Requires: openssh-clients Requires: openssh-server Requires: systemd >= 250 Requires: wireguard-tools Requires: policycoreutils-python-utils Requires: openssl Requires: curl Requires: gnupg2 Requires: postgresql Source1: admiral-common.sysusers Source2: admiral_letsencrypt_deploy_hook.sh Source3: admiral-control-plane-backup.service Source4: admiral-control-plane-backup.timer %description Common configuration files, Ansible playbooks, and utility scripts shared by all Admiral components. Admiral is a lightweight PaaS for agencies to sell and operate SaaS applications on Enterprise Linux. %prep %autosetup -n admiral-v%{version} %build %install # Ansible playbooks mkdir -p %{buildroot}%{_datadir}/admiral/ansible cp -r ansible/* %{buildroot}%{_datadir}/admiral/ansible/ # Installer command install -Dm0755 scripts/install.sh %{buildroot}%{_bindir}/admiral-install install -Dm0755 scripts/admiral_known_host.py %{buildroot}%{_bindir}/admiral-known-host install -Dm0755 scripts/admiral_revoke_bootstrap_key.py %{buildroot}%{_bindir}/admiral-revoke-bootstrap-key install -Dm0755 scripts/admiral_ssh_delivery_cleanup.py %{buildroot}%{_bindir}/admiral-ssh-delivery-cleanup install -Dm0755 scripts/admiral_control_plane_backup.sh %{buildroot}%{_bindir}/admiral-control-plane-backup install -Dm0644 %{SOURCE3} %{buildroot}%{_unitdir}/admiral-control-plane-backup.service install -Dm0644 %{SOURCE4} %{buildroot}%{_unitdir}/admiral-control-plane-backup.timer # Man pages install -Dm0644 docs/admiral-install.1 %{buildroot}%{_mandir}/man1/admiral-install.1 install -Dm0644 docs/admiral-install.8 %{buildroot}%{_mandir}/man8/admiral-install.8 # Rootless subordinate ID allocator (operator-facing helper invoked by the installer) install -Dm0755 scripts/admiral_rootless_subids.py %{buildroot}%{_bindir}/admiral-rootless-subids # HTTPS setup script install -Dm0755 scripts/admiral_https_setup.py %{buildroot}%{_bindir}/admiral-https-setup install -Dm0755 %{SOURCE2} %{buildroot}%{_libexecdir}/admiral-letsencrypt-deploy-hook # Configuration directory (owned by root, 755) mkdir -p %{buildroot}%{_sysconfdir}/admiral mkdir -p %{buildroot}%{_sysconfdir}/admiral/tls mkdir -p %{buildroot}%{_sysconfdir}/admiral/ssh # Log directory (admiral user needs write) mkdir -p %{buildroot}%{_localstatedir}/log/admiral # Data directories (fleet runs as root then switches to admiral-apps) mkdir -p %{buildroot}%{_sysconfdir}/containers/systemd/admiral mkdir -p %{buildroot}%{_localstatedir}/lib/admiral/outbox mkdir -p %{buildroot}%{_localstatedir}/lib/admiral/backups mkdir -p %{buildroot}%{_localstatedir}/lib/admiral/instances mkdir -p %{buildroot}%{_localstatedir}/lib/admiral-apps install -D -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/%{name}.conf %pre %sysusers_create_package %{name} %{SOURCE1} %files %license LICENSE %doc README.md %dir %attr(0750, root, admiral) %{_sysconfdir}/admiral %dir %attr(0750, root, admiral) %{_sysconfdir}/admiral/ssh %dir %attr(0755, root, root) %{_sysconfdir}/containers/systemd/admiral %dir %attr(0750, root, admiral) %{_sysconfdir}/admiral/tls %dir %attr(0750, admiral, admiral) %{_localstatedir}/log/admiral %dir %attr(0751, admiral, admiral) %{_localstatedir}/lib/admiral %dir %attr(0755, admiral, admiral) %{_localstatedir}/lib/admiral/outbox %dir %attr(0755, admiral, admiral) %{_localstatedir}/lib/admiral/backups %dir %attr(0755, admiral, admiral) %{_localstatedir}/lib/admiral/instances %dir %attr(0755, admiral-apps, admiral-apps) %{_localstatedir}/lib/admiral-apps %{_sysusersdir}/%{name}.conf %{_bindir}/admiral-https-setup %{_bindir}/admiral-install %{_bindir}/admiral-known-host %{_bindir}/admiral-revoke-bootstrap-key %{_bindir}/admiral-ssh-delivery-cleanup %{_bindir}/admiral-rootless-subids %{_bindir}/admiral-control-plane-backup %{_unitdir}/admiral-control-plane-backup.service %{_unitdir}/admiral-control-plane-backup.timer %{_datadir}/admiral/ansible/ %{_libexecdir}/admiral-letsencrypt-deploy-hook %{_mandir}/man1/admiral-install.1* %{_mandir}/man8/admiral-install.8* %post %systemd_post admiral-control-plane-backup.service %systemd_post admiral-control-plane-backup.timer # Set ownership of log directory chown admiral:admiral %{_localstatedir}/log/admiral 2>/dev/null || : # Restore ownership and permissions of the shared Admiral data tree. # admirald runs as root but writes as the admiral user via su. chown -R admiral:admiral %{_localstatedir}/lib/admiral 2>/dev/null || : chmod 0751 %{_localstatedir}/lib/admiral 2>/dev/null || : # Ensure rootless runtime directories exist before admiral-fleet first start mkdir -p %{_sysconfdir}/containers/systemd/admiral if getent passwd admiral-apps >/dev/null 2>&1; then ADMIRAL_APPS_UID=$(id -u admiral-apps) mkdir -p %{_localstatedir}/lib/admiral-apps chown admiral-apps:admiral-apps %{_localstatedir}/lib/admiral-apps 2>/dev/null || : mkdir -p %{_sysconfdir}/containers/systemd/users/${ADMIRAL_APPS_UID} loginctl enable-linger admiral-apps >/dev/null 2>&1 || : mkdir -p /run/user/${ADMIRAL_APPS_UID}/libpod chmod 01700 /run/user/${ADMIRAL_APPS_UID}/libpod chown admiral-apps:admiral-apps /run/user/${ADMIRAL_APPS_UID} chown admiral-apps:admiral-apps /run/user/${ADMIRAL_APPS_UID}/libpod cat > /usr/lib/tmpfiles.d/admiral-apps.conf << TMPFILESEOF # Generated by admiral-common - ensure podman runtime directory exists # for the rootless admiral-apps user. d /run/user/${ADMIRAL_APPS_UID}/libpod 01700 admiral-apps admiral-apps - - TMPFILESEOF fi # SELinux contexts restorecon -R %{_sysconfdir}/admiral 2>/dev/null || : restorecon -R %{_sysconfdir}/containers 2>/dev/null || : restorecon -R %{_localstatedir}/lib/admiral 2>/dev/null || : restorecon -R %{_localstatedir}/lib/admiral/outbox 2>/dev/null || : restorecon -R %{_localstatedir}/lib/admiral/backups 2>/dev/null || : restorecon -R %{_localstatedir}/lib/admiral/instances 2>/dev/null || : restorecon -R %{_localstatedir}/lib/admiral-apps 2>/dev/null || : restorecon -F %{_bindir}/admiral-https-setup 2>/dev/null || : restorecon -F %{_bindir}/admiral-install 2>/dev/null || : restorecon -F %{_bindir}/admiral-known-host 2>/dev/null || : restorecon -F %{_bindir}/admiral-revoke-bootstrap-key 2>/dev/null || : restorecon -F %{_bindir}/admiral-rootless-subids 2>/dev/null || : # Set default SELinux context for rootless container storage # Files under admiral-apps' podman storage inherit var_lib_t from /var/lib, # but container_t domain needs container_file_t to read them. semanage fcontext -a -t container_file_t "/var/lib/admiral-apps/.local/share/containers/storage(/.*)?" 2>/dev/null || : restorecon -R /var/lib/admiral-apps/.local/share/containers/storage/ 2>/dev/null || : %preun %systemd_preun admiral-control-plane-backup.service %systemd_preun admiral-control-plane-backup.timer # Only remove runtime state on final package removal. On upgrade, %post creates # the current tmpfiles rule and SELinux mapping again. if [ "$1" -eq 0 ]; then rm -f /usr/lib/tmpfiles.d/admiral-apps.conf semanage fcontext -d -t container_file_t "/var/lib/admiral-apps/.local/share/containers/storage(/.*)?" 2>/dev/null || : if getent passwd admiral-apps >/dev/null 2>&1; then ADMIRAL_APPS_UID=$(id -u admiral-apps) loginctl disable-linger admiral-apps >/dev/null 2>&1 || : rm -rf /run/user/${ADMIRAL_APPS_UID}/libpod fi fi %postun %systemd_postun_with_restart admiral-control-plane-backup.service %systemd_postun admiral-control-plane-backup.timer if [ "$1" -eq 0 ]; then systemd-tmpfiles --remove /usr/lib/tmpfiles.d/admiral-apps.conf >/dev/null 2>&1 || : fi %changelog * Mon Sep 21 2026 William Moreno Reyes - 0.0.1rc2-1 - Release 0.0.1rc2 with immutable recovery backup validation * Mon Sep 21 2026 William Moreno Reyes - 0.0.1rc1-141 - Require Object Lock retention on encrypted control-plane recovery backups * Fri Aug 07 2026 William Moreno Reyes - 0.0.1rc1-124 - Retry per-node SSH validation after bootstrap-key revocation * Wed Aug 05 2026 William Moreno Reyes - 0.0.1beta21-113 - Bump to beta21: release validation and portable TLS renewal checks * Sat Aug 01 2026 William Moreno Reyes - 0.0.1beta20-36 - Bump to beta20: security hardening fixes (task ownership, resize rollback, rate limiter cleanup, error leakage prevention) * Sat Aug 01 2026 William Moreno Reyes - 0.0.1beta19-36 - Make spoke reconvergence use per-node delivery keys after bootstrap revocation - Make bootstrap-key revocation idempotent and harden private listener checks * Thu Jul 30 2026 William Moreno Reyes - 0.0.1beta19-35 - Install admiral-install man pages (man1 and man8) - Add --no-revoke-ssh-key flag to preserve bootstrap SSH key * Thu Jul 30 2026 William Moreno Reyes - 0.0.1beta18-34 - Skip absent hub WireGuard configuration during peer extraction * Thu Jul 30 2026 William Moreno Reyes - 0.0.1beta18-33 - Refresh installer validation and secure remote command execution * Thu Jul 30 2026 William Moreno Reyes - 0.0.1beta18-32 - Remove cockpit-ws from production profiles while keeping cockpit-bridge * Thu Jul 30 2026 William Moreno Reyes - 0.0.1beta18-31 - Generate per-node SSH identities and revoke bootstrap keys after onboarding * Thu Jul 30 2026 William Moreno Reyes - 0.0.1beta18-30 - Install operational helper scripts in /usr/bin - Include the known-host YAML resolver in admiral-common * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-28 - Converge spoke SSH and disable inherited Cockpit listeners * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-7 - Avoid restarting auditd on EL10 systems that reject manual service restarts. * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-6 - Handle EL10 systems without augenrules or auditctl utilities. * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-5 - Support EL10 auditd installations that provide augenrules without auditctl. * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-4 - Update EL10 hosts before repository and Admiral package setup. * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-3 - Invoke DNF security updates explicitly so EL10 dependency resolution flags are honored. * Wed Jul 29 2026 William Moreno Reyes - 0.0.1beta18-2 - Allow DNF to resolve transient EL10 package dependency conflicts during security updates. * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta18-1 - Bump version to 0.0.1beta18 * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-12 - Configure rootless cgroup policy after installing the container policy - Fail immediately when required SELinux policy cannot be applied - Limit the workload-specific security check to nodes running Fleet * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-11 - Accept a validated public key without requiring its private half locally - Discover the invoking sudo user's authorized key on fresh cloud hosts - Document separate administrator and spoke bootstrap SSH credentials * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-10 - Allocate non-overlapping subordinate IDs from the host-defined ranges - Require the rootless user manager, D-Bus, and Podman storage before Fleet starts - Verify the effective rootless runtime in secure installation modes * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-9 - Restrict spoke VPN routes to the admin hub - Disable inter-node forwarding and verify restricted WireGuard firewall state - Create WireGuard private keys with restrictive permissions from first write * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-8 - Disable keyboard-interactive SSH, empty passwords, X11, and agent forwarding - Verify the effective SSH daemon policy before completing installation * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-7 - Hash Cockpit credentials through standard input instead of process arguments * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-6 - Permit NTP through the production egress policy - Require effective clock synchronization before installation completes * Mon Jul 27 2026 William Moreno Reyes - 0.0.1beta17-5 - Apply and automate security errata conditionally on Tier 1 EL10 hosts - Use and exercise native nftables enforcement for Fail2ban - Document the Tier 1 EL10 and Tier 2 Fedora Rawhide support matrix * Fri Jul 17 2026 William Moreno Reyes - 0.0.1beta17-3 - Stop installing the obsolete PayPal API endpoint override - Document automatic endpoint selection for live payments * Fri Jul 17 2026 William Moreno Reyes - 0.0.1beta17-2 - Pin the source archive after the final installer and Ansible security fixes - Rebuild with latest submodule refs and release bump * Fri Jul 17 2026 William Moreno Reyes - 0.0.1beta17-1 - Bump to 0.0.1beta17 with latest security and installer fixes - Document repository and notification policy - Permit notification SMTP and document sudo scope - Validate runtime security controls - Document dev mode confirmation - Centralize WireGuard hub address - Require TLS and verify PostgreSQL readiness - Harden dangerous mode and temporary data handling - Preserve Fleet token during convergence - Configure Fleet task verification key * Fri Jul 17 2026 William Moreno Reyes - 0.0.1beta16-5 - Preserve the generated Fleet token when converging an existing installation * Fri Jul 17 2026 William Moreno Reyes - 0.0.1beta16-4 - Configure Fleet task signature verification through Ansible * Fri Jul 17 2026 William Moreno Reyes - 0.0.1beta16-2 - Configure and verify scoped Harbor API authentication during installation * Tue Jul 14 2026 William Moreno Reyes - 0.0.1beta16-1 - chore(release): bump to 0.0.1beta16 * Tue Jul 07 2026 William Moreno Reyes - 0.0.1beta15-3 - Update source commit refs to include security audit fixes * Sun Jul 05 2026 William Moreno Reyes - 0.0.1beta14-3 - Add MemoryDenyWriteExecute and RestrictRealtime to admirald.service * Sun Jul 05 2026 William Moreno Reyes - 0.0.1beta14-2 - Update submodule commit refs and bump release * Sun Jul 05 2026 Antigravity - 0.0.1beta14-1 - Bump version to 0.0.1beta14 to match the other Admiral packages * Sun Jul 05 2026 William Moreno Reyes - 0.0.1beta13-10 - Update source commit ref * Sun Jul 05 2026 William Moreno Reyes - 0.0.1beta13-9 - Update source commit ref * Sun Jul 05 2026 William Moreno Reyes - 0.0.1beta13-8 - Update source commit ref * Sun Jul 05 2026 William Moreno Reyes - 0.0.1beta13-7 - Update source commit ref for super-repo hash * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta13-6 - Concatenate stdout and stderr when parsing Ed25519 keys; admiralctl writes private_key to stderr and public_key to stdout * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta13-5 - Guard Ed25519 key parsing with install mode conditional to prevent failure on portal-node and worker-node installs * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta13-4 - Set sandbox as default PayPal mode; only --dev-node uses mock - Ship harbor.env with HARBOR_PAYPAL_MODE=sandbox so the admin UI is ready for PayPal credential configuration * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta13-3 - Restart Harbor when the systemd bind override changes * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta13-2 - Ensure sysusers macro is available when building in COPR * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta13-1 - Bump to 0.0.1beta13 and reset packaging release to 1 * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta12-8 - Move admiral and admiral-apps account creation into RPM sysusers handling * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta12-7 - Bootstrap admiral and admiral-apps system accounts before package install * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta12-6 - Bootstrap admiral and admiral-apps system accounts before package install * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta12-5 - Disable SSL for portal-node local Harbor database connection * Sat Jun 27 2026 William Moreno Reyes - 0.0.1beta12-4 - Add explicit spoke WireGuard IP support to admiral_install - Auto-detect a non-loopback admin endpoint for later spoke installs - Reconcile WireGuard config on repeated runs - Register portal nodes after Harbor is active - Verify Harbor timers during portal-node install * Fri Jun 26 2026 William Moreno Reyes - 0.0.1beta12-3 - Restore TLS certs in harbor dev-mode ExecStart override * Fri Jun 26 2026 William Moreno Reyes - 0.0.1beta12-2 - Restore TLS certs in flagship dev-mode ExecStart override - Make HARBOR_PAYPAL_MODE conditional: sandbox for production, mock for dev * Fri Jun 26 2026 William Moreno Reyes - 0.0.1beta12-1 - Bump to 0.0.1beta12 and update source commit ref * Thu Jun 25 2026 William Moreno Reyes - 0.0.1beta11-1 - Bump to 0.0.1beta11 and reset packaging release to 1 * Thu Jun 25 2026 William Moreno Reyes - 0.0.1beta10-4 - Add /run/user to ReadWritePaths in admiral-fleet.service for rootless Podman secret creation * Thu Jun 25 2026 William Moreno Reyes - 0.0.1beta10-3 - Create /run/user//libpod with mode 01700 (sticky bit) for Podman * Thu Jun 25 2026 William Moreno Reyes - 0.0.1beta10-2 - Bump release to 2 for coordinated packaging update * Wed Jun 24 2026 William Moreno Reyes - 0.0.1beta10-1 - Prepare beta10 coordinated release for setup_command validation cycle * Tue Jun 23 2026 William Moreno Reyes - 0.0.1beta9-1 - Bump to 0.0.1beta9, update source commit ref - Multi-node beta: 4 OS distribution validation - Ansible: restrict Caddy setup to admin/single-node only - Ansible: add WireGuard wg-admiral to firewalld trusted zone - Ansible: add flagship role for --admin-node mode - Ansible: remove mdns from public zone firewall policy - Align DATABASE_URL sslmode to require across templates * Mon Jun 22 2026 William Moreno Reyes - 0.0.1beta8-2 - Bump to 0.0.1beta8, update source commit ref * Fri Jun 19 2026 William Moreno Reyes - 0.0.1beta5-2 - Rebuild against current superproject HEAD * Fri Jun 19 2026 William Moreno Reyes - 0.0.1beta4-2 - Rebuild against current superproject HEAD - Pass admiral_wireguard_ip for admin/single node installs - Remove hardcoded ADMIRAL_LISTEN_ADDRESS from admirald systemd unit * Fri Jun 19 2026 William Moreno Reyes - 0.0.1beta4-1 - Bump to 0.0.1beta4, update spec commit ref - Use sudo -u postgres for all psql tasks - Add multi-node Ansible fixes (WireGuard, TLS, CA key cleanup) - Add nodes remove API, CLI, and UI - Make --worker-node/--portal-node mutually exclusive * Thu Jun 18 2026 William Moreno Reyes - 0.0.1beta3-1 - Bump to 0.0.1beta3, update spec commit ref - Own /etc/admiral/tls directory - Apply restorecon recursively on /var/lib/admiral * Thu Jun 18 2026 William Moreno Reyes - 0.0.1beta2-2 - Require systemd >= 250 for systemd-creds encrypted secrets * Wed Jun 17 2026 William Moreno Reyes - 0.0.1beta2-1 - Bump to 0.0.1beta2, update spec commit ref * Tue Jun 16 2026 William Moreno Reyes - 0.0.1alpha7-1 - Bump to alpha7, update spec commit ref * Mon Jun 15 2026 William Moreno Reyes - 0.0.1alpha6-3 - Update source commit to current repo HEAD * Mon Jun 15 2026 William Moreno Reyes - 0.0.1alpha6-2 - Update installer packaging for single-node loopback default * Mon Jun 15 2026 William Moreno Reyes - 0.0.1alpha6-1 - Bump to alpha6 * Mon Jun 15 2026 William Moreno Reyes - 0.0.1alpha5-3 - Install admiral_install command from admiral-common * Sun Jun 14 2026 William Moreno Reyes - 0.0.1alpha5-2 - Update source commit to latest alpha5 * Sun Jun 14 2026 William Moreno Reyes - 0.0.1alpha5-1 - Bump to alpha5 * Sun Jun 14 2026 William Moreno Reyes - 0.0.1alpha4-4 - Set /var/lib/admiral to 0751 root:admiral for rootless traversal - Add chmod 0751 in %%post scriptlet * Sat Jun 13 2026 William Moreno Reyes - 0.0.1alpha4-3 - Add HARBOR_DATABASE_URL to ansible playbook - Add python3-psycopg2 dependency * Sat Jun 13 2026 William Moreno Reyes - 0.0.1alpha4-2 - Fix ansible common role permissions * Sat Jun 13 2026 William Moreno Reyes - 0.0.1alpha4-1 - Register local node via admiralctl in single-node mode * Sat Jun 13 2026 William Moreno Reyes - 0.0.1alpha3-2 - Add cockpit.conf with ProtocolHeader and Origins for reverse proxy support * Sat Jun 13 2026 William Moreno Reyes - 0.0.1alpha3-1 - Bump Admiral common packaging to alpha3 * Wed Jun 03 2026 Admiral Project - 0.1.0-1 - Initial Admiral packaging