patroni: disable full configuration

etcd: reorganize configuration
WIP: forgot a file
2023-06-06 10:30:08 +02:00 · 2023-06-06 10:29:51 +02:00 · 2023-05-12 18:12:43 +02:00 · 2023-05-12 18:12:06 +02:00 · 2023-05-09 09:31:03 +02:00 · 2023-04-23 10:27:05 +02:00
405 changed files with 3072 additions and 8977 deletions
--- a/.gitignore
+++ b/.gitignore
@ -2,4 +2,3 @@
 .kateproject.d
 .vagrant/
 *.swp
-.vscode
--- a/.markdownlint.json
+++ b/.markdownlint.json
@ -1,4 +0,0 @@
-{
-    "MD013": false,
-    "MD024": false
-}
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -3,6 +3,5 @@
        "*.yml": "ansible",
        "*.yaml": "ansible"
    },
-    "yaml.format.enable": false,
-    "ansible.python.interpreterPath": "/bin/python"
+    "yaml.format.enable": false
 }
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,5 +1,4 @@
 # Changelog
-
 All notable changes to this project will be documented in this file.

 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
@ -9,246 +8,16 @@ The **major** part of the version is the year
 The **minor** part changes is the month
 The **patch** part changes is incremented if multiple releases happen the same month

+
 ## [Unreleased]

 ### Added

-### Changed
-
-### Fixed
-
-### Removed
-
-### Security
-
-## [24.03] 2024-03-01
-
-### Added
-
-* autosysadmin-agent: upstream release 24.03
-* autosysadmin-restart_nrpe: add role
-* certbot: Renewal hook for NRPE
-* kvm-host: add minifirewall rules if DRBD interface is configured
-
-### Changed
-
-* apt: add ftp.evolix.org as recognized system source
-* autosysadmin-agent: logs clearing is done weekly
-* autosysadmin-agent: rename /usr/share/scripts/autosysadmin/{auto,restart}
-* certbot: use pkey to test the key
-* evolinux-base: execute autosysadmin-agent and autosysadmin-restart_nrpe roles
-* lxc-php, php: Update sury PGP key
-* openvpn: earlier alert for CA expiration
-* redis: create sysfs config file if missing
-
-### Removed
-
-* autosysadmin: replaced by autosysadmin-agent
-
-## [24.02.1] 2024-02-08
-
-### Fixed
-
-* fail2ban: fix Ansible syntax
-
-## [24.02] 2024-02-08
-
-### Added
-
-* Support for PHP 8.3 with bookworm LXC containers
-* apt: add task file to install ELTS repository (default: False)
-* autosysadmin: Add a role to automatically deploy autosysadmin on evolixisation
-* check_free_space: added role
-* etc-git: add /var/chroot-bind/etc/bind repo
-* fail2ban: add script unban_ip
-* generateldif: new Services for check_pressure_{cpu,io,mem}
-* kvm-host: Automatically add an LVM filter when LVM is present
-* lxc-php: Allow one to install php83 on Bookworm container
-* minifirewall: Fix nagios check for old versions of minifirewall
-* mongodb: add gpg key for 7.0
-* nagios-nrpe: add check_sentinel for monitoring Redis Sentinel
-* nagios-nrpe: new check_pressure_{cpu,io,mem}
-* remount-usr: do not try to remount /usr RW if /usr is not a mounted partition
-* vrrpd: configure minifirewall
-* vrrpd: test if interface exists before deleting it
-* webapps/evoadmin-mail: package installed via public.evolix.org/evolix repo starting with Bookworm
-* webapps/nextcloud: Add condition for archive tasks
-* webapps/nextcloud: Add condition for config tasks
-* webapps/nextcloud: Added var nextcloud_user_uid to enforce uid for nextcloud user
-* webapps/nextcloud: Set ownership and permissions of data directory
-
-### Changed
-
-* add-vm.sh: allow VM name max length > 20
-* amavis: make ldap_suffix mandatory
-* apache : fix goaway pattern for bad bots 
-* apache : rename MaxRequestsPerChild to MaxConnectionsPerChild (new name)
-* apache: use backward compatible Redirect directive
-* apt: Disable archive repository for Debian 8
-* apt: Use the GPG version of the key for Debian 8-9
-* bind: Update role for Buster, Bullseye and Bookworm support
-* dovecot: add variables for LDAP
-* dovecot: Munin plugin conf path is now `/etc/munin/plugin-conf.d/zzz-dovecot` (instead of `z-evolinux-dovecot`)
-* evocheck: upstream release 24.01
-* evolinux-base: dump-server-state upstream release 23.11
-* evolinux-base: use separate default config file for rsyslog
-* kvmstats: use .capacity instead of .physical for disk size
-* ldap: make ldap_suffix mandatory
-* listupgrade : old-kernel-removal.sh upstream release 24.01
-* log2mail: move custom config in separate file
-* lxc: init /etc git repository in lxc container
-* mysql: disable performance schema for Debian 8
-* nagios: add dockerd check in nrpe check template
-* nagios: cleaning nrpe check template
-* nagios: rename var `nagios_nrpe_process_processes` into `nagios_nrpe_processes` and check systemd-timesyncd instead of ntpd in Debian 12
-* nagios: add option --full to check pressure IO and mem to avoid flaps
-* proftpd: in SFTP vhost, enable SSH keys login, enable ed25549 host key for Debian >= 11
-* redis: manage config template inside a block, to allow custom modifications outside
-* spamassassin: Use spamd starting with Bookworm
-* squid: config directory seems to have changed from /etc/squid3 to /etc/squid in Debian 8
-* unbound: Add config file to allow configuration reload on Debian 11 and lower
-* unbound: Add munin configuration & setup plugin
-* unbound: Big cleanup
-* unbound: Move generated config file to `/etc/unbound/unbound.conf.d/evolinux.conf`
-* unbound: Use root hints provided by debian package dns-root-data instead of downloading them
-* vrrpd: replace switch script with custom one (fix MAC issue, use `ip(8)`, shell cleanup…)
-* vrrpd: variable to force update the switch script (default: false)
-* webapps/nextcloud: Add Ceph volume to fstab
-* webapps/nextcloud: Set home directory's mode
-
-### Fixed
-
-* Add php-fpm82 to LDAP when relevant
-* Check stat.exists before stat.isdir
-* apache: fix MaxRequestsPerChild value to be sync with wiki.e.o
-* apt: use archive.debian.org with Stretch
-* certbot: fix hook for dovecot when more than one certificate is used (eg. different certificates for POP3 and IMAP)
-* dovecot: add missing LDAP conf iterate_filter to exclude disabled accounts in users list (caused « User no longer exists » errors in commands listing users like « doveadm user -u '*' » or « doveadm expunge -u "*" mailbox INBOX savedbefore 7d »).
-* dovecot: fix missing default mails
-* dovecot: fix plugin dovecot1
-* evoadmin-web: Fix PHP version for Bookworm
-* evolinux-base: fix hardware.yml (wrong repo, missing update cache)
-* evolinux-base: start to install linux-image-cloud-amd64 with Buster
-* fail2ban: fix template marker
-* minifirewall: ports 25, 53, 443, 993, 995 not opened publicly by default anymore, ports 20, 21, 110, 143 not opened semi-publicly by default anymore.
-* nagios: fix default file to monitor for check_clamav_db
-* nginx: add "when: not ansible_check_mode" in various tasks to prevent fail in check mode
-* nginx: fix mistake between "check_mode: no" and "when: not ansible_check_mode" (fail in check mode)
-* nginx: fix mistake between "check_mode: no" and "when: not ansible_check_mode" (fail in check mode)
-* nginx: keep indentation
-* nginx: take care of « already defined » and « not yet defined » server status suffix in check mode
-* php: Bullseye/Sury > Honor the php_version asked in the pub.evolix.org repository
-* php: drop apt_preferences(5) file for sury
-* postfix: remove dependency on evolinux_fqdn var
-* proftpd: set missing default listen IP for SFTP
-* roundcube: set default SMTP port to 25 instead of 587, which failed because of missing SSL conf (local connexion does not need SSL)
-* ssl: no not execute haproxy tasks and reload if haproxy is disabled
-* unbound: Add a apt cache validity to enforce an apt update if needed
-* webapps/nextcloud: added check that nextcloud uid is over 3000
-* webapps/nextcloud: fix Add Ceph volume to fstab : missing UUID= in src
-* webapps/nextcloud: fix misplaced gid attribute
-* webapps/nextcloud: fix missing gid
-* webapps/roundcube & evoadminmail: make roles more idempotent (were failing when played twice)
-* amavis: Add variables for generate "ldap_suffix"
-* proftpd: fix error when no SSH key is provided
-
-### Removed
-
-* evolinux-base: no need to remove update-evobackup-canary from sbin anymore
-* evolinux-base: no need to symlink backup-server-state to dump-server-state anymore
-
-## [23.10] 2023-10-14
-
-### Added
-
-* apt: disable `NonFreeFirmware` warning for VM on Debian 12+
-* apt: explicit `signed-by` directives for official sources
-* bind: add reload-zone helper
-* certbot: deploy-hook for proftpd
-* docker-host: added var for user namespace setting
-* dovecot: add Munin plugins dovecot1 and dovecot_stats (patched)
-* dovecot: fix old_stats plugin for Dovecot 2.3
-* evocheck: add support for Debian >= 12 split SSH configuration
-* evolinux-base: add split SSH configuration for Debian >= 12
-* evolinux-base: configure `.bashrc` for all users
-* evolinux-base: New variable `evolinux_system_include_ntpd` to chose wether or not to include `ntpd` role
-* evolinux-base: reboot the server if the Cloud kernel has been installed
-* evolinux-users: add split SSH configuration for Debian >= 12
-* evolinux: install HPE Agentless Management Service (amsd)
-* fail2ban: add default variable fail2ban_dbpurgeage_default
-* fail2ban: add `fail2ban_sshd_port` variable to configure sshd port
-* kvm-host: release 23.10 for migrate-vm.sh
-* metricbeat/logstash: fix Ansible syntax
-* mysql: new munin graph to follow binlog_days over time
-* nagios-nrpe: add a NRPE check-local command with completion.
-* nagios-nrpe: add a proper monitoring plugin for GlusterFS (on servers, not for clients)
-* php: add new variable to disable overriding settings of php-fpm default pool (www)
-* policy_pam: New role to manage password policy with `pam_pwquality` & `pam_pwhistory`
-* userlogrotate: add a `userlogpurge` script disabled by default
-* userlogrotate: new version, with separate conf file
-* userlogrotate: rotate also php.log
-* java: allow version 17
-* timesyncd: new role, used instead of ntpd by default starting with Debian 12
-
-### Changed
-
-* all: change syntax "become: [yes,no]" → "become: [true,false]"
-* all: change syntax "force: [yes,no]" → "force: [true,false]"
-* elasticsearch: improve networking configuration
-* evolinux-base: include files under `sshd_config.d`
-* evolinux-users: remove Stretch references in tasks that also apply to next Debian versions
-* evomaintenance: upstream release 23.10.1
-* lxc-php: change LXC container in bookworm for php82
-* minifirewall: update nrpe script to check active configuration
-* minifirewall: upstream release 23.07
-* mysql: improve shell syntax for mysql_skip script
-* nagios-nrpe: set default check_load --per-cpu for BSD
-* pgbouncer: minor fixes
-* postfix (packmail or when postfix_slow_transport_include is True): change `miniprofmal_backoff_time` from 2h to 15m (see HowtoPostfix)
-* postfix (packmail) : optimize Amavis integration
-* postfix: disable sending mails via IPv6
-* postfix: new spam.sh update script that avoids reloading if files did not change.
-* postgresql: fix file `postgresql.pref.j2` for exclude package
-* postgresql: fix task `update apt cache` for PGDG repo
-* redis: standardize plugins path from `/usr/local/share/munin/` to `/usr/local/lib/munin/plugins/`
-* varnish: allow the systemd template to be overridden with a template outside of the role
-* lxc: purge openssh-server from container on install
-
-### Fixed
-
-* elasticsearch: comment the `Xlog:gc` line instead of changing it completely
-* evocheck: fix IS_SSHALLOWUSERS condition
-* evolinux-base, evolinux-users: Fix files mode under `/etc/ssh/sshd_config.d`
-* evolinux-base: fix file extension
-* fail2ban: fix cron `fail2ban_dbpurge` (should be bash instead of sh)
-* lxc-php: fix APT keyring path inside containers
-* nagios-nrpe: `check_ssl_local` now has an output that nrpe can understand when it isn't OK
-* nagios-nrpe: remount `/usr` **after** installing the packages
-* nagios-nrpe: sync Redis check from redis roles
-* nginx: set default server directive in default vhost
-* opendkim: update apt cache before install
-* packweb-apache,nagios-nrpe: add missing task and config for PHP 8.2 container
-* postfix: add missing `localhost.$mydomain` to `mydestination`
-* redis: replace erroneous `ini_file` module for Munin config, fix dedicated Munin config filename (z-XXX).
-* evolinux-base: use lineinfile instead of replace under root task
-* evolinux-base: Corriger autorisation pour evolinux_user
-* docker-host: Retirer directive state en trop
-* rbenv: Installer libyaml-dev
-
-### Removed
-
-* dovecot: remove Munin plugin dovecot (not working)
-
-## [23.04] 2023-04-23
-
-### Added
-
 * graylog: new role
-* lxc-php: add support for PHP 8.2 container
+* Patroni: new role for install Patroni cluster 

 ### Changed

-* Use FQCN (Fully Qualified Collection Name)
 * apt: with Debian 12, backports are installed but disabled by default
 * openvpn: updated the README file
 * pgbouncer: add handler to restart the service
@ -257,6 +26,10 @@ The **patch** part changes is incremented if multiple releases happen the same m

 * generate-ldif: Support for Debian 12

+### Removed
+
+### Security
+
 ## [23.03.1] 2023-03-16

 ### Added
@ -325,6 +98,7 @@ The **patch** part changes is incremented if multiple releases happen the same m

 * evolinux-base: subversion is not installed anymore

+
 ## [22.12] 2022-12-14

 ### Added
@ -379,6 +153,7 @@ The **patch** part changes is incremented if multiple releases happen the same m

 * openvpn: Deleted the task fixing the CRL rights since it has been fixed in upstream

+
 ## [22.09] 2022-09-19

 ### Added
@ -392,6 +167,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * proftpd: Add options to override configs (and add a warning if file was overriden)
 * proftpd: Allow user auth with ssh keys

+
 ### Changed

 * evocheck: upstream release 22.09
@ -399,7 +175,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * generate-ldif: Support any MariaDB version
 * minifirewall: use handlers to restart minifirewall
 * openvpn: automate the initialization of the CA and the creation of the server certificate ; use openssl_dhparam module instead of a command
-* generate-ldif: support any version of MariaDB (instead of only 10.0, 10.1 and 10.3)
+* generate-ldif: support any version of MariaDB (instead of only 10.0, 10.1 and 10.3) 
 * openvpn: Run OpenVPN with the \_openvpn user and group instead of nobody which is originally for NFS
 * nagios-nrpe: Upgrade check_mongo

@ -517,16 +293,16 @@ The **patch** part changes is incremented if multiple releases happen the same m

 ### Added

-* docker: Introduce new default settings + allow to change the docker data directory
-* docker: Introduce new variables to tweak daemon settings
+* docker : Introduce new default settings + allow to change the docker data directory 
+* docker : Introduce new variables to tweak daemon settings

 ### Changed

-* evocheck: Upstream release 22.05
+* evocheck: upstream release 22.05

 ### Removed

-* docker: Removed Debian Jessie support
+* docker : Removed Debian Jessie support

 ## [22.05] 2022-05-10

@ -550,7 +326,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * minifirewall: restore "force-restart" and fix "restart-if-needed"
 * minifirewall: tail template follows symlinks
 * minifirewall: upstream release 22.05
-* opendkim : add generate opendkim-genkey in sha256 and key 4096
+* opendkim : add generate opendkim-genkey in sha256 and key 4096 
 * openvpn: use a local copy of files instead of cloning an external git repository
 * openvpn: use a subnet topology instead of the net30 default topology
 * tomcat: Tomcat 9 by default with Debian 11
@ -913,7 +689,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [10.0.0] - 2020-05-13

 ### Added
-
 * apache: the default VHost doesn't redirect to https for ".well-known" paths
 * apt: added buster backports prerferences
 * apt: check if cron is installed before adding a cron job
@ -950,7 +725,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * bind: enable bind9 munin plugin for recursive resolvers

 ### Changed
-
 * replace version_compare() with version()s
 * removed some deprecations for Ansible 2.7
 * apache: improve permissions in save_apache_status script
@ -996,7 +770,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * varnish: remove custom ExecReload= script for Debian 10+

 ### Fixed
-
 * etc-git: fix warnings ansible-lint
 * evoadmin-web: Put the php config at the right place for Buster
 * lxc: Don't stop the container if it already exists
@ -1019,19 +792,16 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * packweb-apache: Don't try to install PHPMyAdmin on Buster as it's not available

 ### Removed
-
 * clamav : do not install the zoo package anymore

 ## [9.10.1] - 2019-06-21

 ### Changed
-
 * evocheck : update (version 19.06) from upstream

 ## [9.10.0] - 2019-06-21

 ### Added
-
 * apache: add server status suffix in VHost (and default site) if missing
 * apache: add a variable to customize the server-status host
 * apt: add a script to manage packages with "hold" mark
@ -1042,7 +812,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * redmine: enable gzip compression in nginx vhost

 ### Changed
-
 * evocheck : update (unreleased) from upstream
 * evomaintenance : use the web API instead of PG Insert
 * fluentd: store gpg key locally
@ -1055,26 +824,23 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * apt: Add Debian Buster repositories

 ### Fixed
-
 * rbenv: add check_mode for check rbenv and ruby versions
 * nagios-nrpe: fix redis_instances check when Redis port equal 0
 * redmine: fix 500 error on logging
 * evolinux-base: Validate sshd config with "-t" instead of "-T"
 * evolinux-base: Ensure rename is present
 * evolinux-users: Validate sshd config with "-t" instead of "-T"
-* nagios-nrpe: Replace the dummy packages nagios-plugins-*with monitoring-plugins-*
+* nagios-nrpe: Replace the dummy packages nagios-plugins-* with monitoring-plugins-*

 ## [9.9.0] - 2019-04-16

 ### Added
-
 * etc-git: ignore evobackup/.keep-* files
 * lxc: /home is mounted in the container by default
 * nginx : add "x-frame-options: sameorigin" for Munin

 ### Changed
-
-* changed remote repository to <https://gitea.evolix.org/evolix/ansible-roles>
+* changed remote repository to https://gitea.evolix.org/evolix/ansible-roles
 * apt: Ensure jessie-backport from archives.debian.org is accepted
 * apt: Remove jessie-update suite as it's no longer exists
 * apt: Replace mirror.evolix.org by archives.debian.org for jessie-backport
@ -1087,8 +853,8 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * tomcat: better tomcat version management
 * webapps/evoadmin-web: add dbadmin.sh to sudoers file

-### Fixed

+### Fixed
 * spamassasin: fix sa-update.sh and ensure service is started and enabled
 * tomcat-instance: deploy correct version of config files
 * tomcat-instance: deploy correct version of server.xml
@ -1096,24 +862,20 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.8.0] - 2019-01-31

 ### Added
-
 * filebeat: disable cloud_metadata processor by default
 * metricbeat: disable cloud_metadata processor by default
 * percona : new role to install Percona repositories and tools
 * redis: add variable for configure unixsocketperm

 ### Changed
-
 * redmine: refactoring of redmine role with use of rbenv

 ### Fixed
-
 * ntpd: Update the restrictions to follow wiki.evolix.org/HowtoNTP client config

 ## [9.7.0] - 2019-01-17

 ### Added
-
 * apache: add Munin configuration for Apache server-status URL
 * evomaintenance: database variables must be set or the task fails
 * fail2ban: add "ips" tag added to fail2ban/tasks/ip_whitelist.yml
@ -1126,7 +888,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * proftpd: add FTPS and SFTP support

 ### Changed
-
 * redis: distinction between main and master password
 * evocheck: update evocheck.sh for source install
 * php: added php-zip in the installed package list for debian 9 (and later)
@ -1134,7 +895,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * java: update Oracle java package to 8u192

 ### Fixed
-
 * fail2ban: fix "ignoreip" update
 * metricbeat: fix username/password replacement
 * nagios-nrpe: check_process now return the error code (making the check more usefull than /bin/true)
@ -1143,17 +903,16 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * redis: In instance mode, ensure to replace the nrpe check_redis with the instance check script
 * redis: Don't set the owner of /var/{lib,log}/redis to a redis instance account

+
 ## [9.6.0] - 2018-12-04

 ### Added
-
 * evolinux-base: deploy custom motd if template are present
 * minifirewall: all variables are configurable (untouched by default)
 * minifirewall: main file is configurable
 * squid: minifirewall main file is configurable

 ### Changed
-
 * minifirewall: compare config before/after (for restart condition)
 * squid: better replacement in minifirewall config
 * evoadmin-mail: complete refactoring, use Debian Package
@ -1161,7 +920,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.5.0] - 2018-11-14

 ### Added
-
 * apache: separate task to update IP whitelist
 * evolinux-base: install man package
 * evolinux-users: add newaliases handler
@ -1175,13 +933,11 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * mysql: logdir can be customized

 ### Changed
-
 * evocheck: update script from upstream
 * evomaintenance: update script from upstream
 * mysql: restart service if systemd unit has been patched

 ### Fixed
-
 * packweb-apache: mod-security config is already included elsewhere
 * redis: for permissions on log and lib directories
 * redis: fix shell for instance users
@ -1190,16 +946,13 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.4.2] - 2018-10-12

 ### Added
-
 * evomaintenance: install dependencies manually when installing vendored version
 * nagios-nrpe: add an option to ignore servers in NOLB status

 ### Changed
-
 * haproxy: move check_haproxy_stats to nagios-nrpe role

 ### Fixed
-
 * evoacme: better error when apache2ctl fails
 * evomaintenance: fix role compatibility with OpenBSD
 * spamassassin: add missing right for amavis
@ -1208,19 +961,16 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.4.1] - 2018-09-28

 ### Added
-
 * redis: set masterauth when redis_password is defined
 * evomaintenance: variable to install a vendored version
 * evomaintenance: tasks/variables to handle minifirewall restarts

 ### Changed
-
 * mysql-oracle: better handle packages and users

 ## [9.4.0] - 2018-09-20

 ### Added
-
 * etc-git: manage a cron job to monitor uncommited changes in /etc/.git (default: `True`)
 * evolinux-base: better shell history
 * evolinux-users: add user to /etc/aliases
@ -1235,11 +985,9 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * nagios-nrpe: add check_redis_instances

 ### Changed
-
 * dovecot: stronger TLS configuration

 ### Fixed
-
 * apache: cleaner way to overwrite the server status suffix
 * packweb-apache: don't regenerate phpMyAdmin suffix each time
 * nginx: cleaner way to overwrite the server status suffix
@ -1248,13 +996,11 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.3.2] - 2018-09-06

 ### Added
-
 * minifirewall: add a variable to disable the restart handler
 * minifirewall: add a variable to force a restart of the firewall (even with no change)
 * minifirewall: improve variables values and documentation

 ### Changed
-
 * dovecot: enable SSL/TLS by default with snakeoil certificate

 ### Fixed
@ -1264,13 +1010,11 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.3.1] - 2018-08-30

 ### Added
-
 * metricbeat: new variables to configure elasticsearch hosts and auth

 ## [9.3.0] - 2018-08-24

 ### Added
-
 * elasticsearch: tmpdir configuration compatible with 5.x also
 * elasticsearch: add http.publish_host variable
 * evoacme: disable old certbot cron also in cron.daily
@ -1291,7 +1035,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * nagios-nrpe: add check_postgrey

 ### Changed
-
 * etc-git: some entries of .gitignore are mandatory
 * evocheck: update upstream script
 * evolinux-base: improve hostname configuration (real vs. internal)
@ -1310,7 +1053,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * kvm-host: install kvm-tools package instead of copying add-vm.sh

 ### Fixed
-
 * apache: logrotate replacement is more subtle/precise. It replaces only the proper directive and not every occurence of the word.
 * bind: chroot-bind.sh must not be executed in check mode
 * evoacme: fix module detection in apache config
@ -1322,14 +1064,12 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.2.0] - 2018-05-16

 ### Changed
-
 * filebeat: install version 6.x by default
 * filebeat: cleanup unused code
 * squid: add some domaine and fix broken restrictions
 * elasticsearch: defaults to version 6.x

 ### Fixed
-
 * evolinux-users: secondary groups are comma-separated
 * ntpd: fix configuration (server and ACL)
 * varnish: don't fork the process on startup with systemd
@ -1339,7 +1079,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ### Added

 ### Changed
-
 * apache: customize logrotate (52 weeks)
 * evolinux: groups for SSH configuration are used with Debian 10 and later
 * evolinux-base: fail2ban is not enabled by default
@ -1351,11 +1090,9 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.1.8] - 2018-04-16

 ### Changed
-
 * packweb-apache: use dependencies instead of include_role for apache and php roles

 ### Fixed
-
 * mysql: use check_mode for apg command (Fix --check)
 * mysql/mysql-oracle: properly reload systemd
 * packweb-apache: use check_mode for apg command (Fix --check)
@ -1363,7 +1100,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.1.7] - 2018-04-06

 ### Added
-
 * added a few become attributes where missing
 * etc-git: add tags for Ansible
 * evolinux-base: install ncurses-term package
@ -1381,7 +1117,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * redmine: added missing tags

 ### Changed
-
 * elasticsearch: RESTART_ON_UPGRADE is configurable (default: `true`)
 * elasticsearch: use ES_TMPDIR variable for custom tmpdir, (from `/etc/default/elasticsearch` instead of changing `/etc/elesticsearch/jvm.options`).
 * evolinux-base: Exec the firewall tasks sooner (to avoid dependency issues)
@ -1397,7 +1132,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * webapps/evoadmin-web: Fail if variable evoadmin_contact_email isn't defined

 ### Fixed
-
 * dovecot: fix support of plus sign
 * mysql/mysql-oracle: mysqltuner cron task is executable
 * nginx: fix basic auth for default vhost
@ -1406,25 +1140,21 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.1.6] - 2018-02-02

 ### Added
-
 * mongodb: install python-pymongo for monitoring
 * nagios-nrpe: allowed_hosts can be updated

 ### Changed
-
 * Changelog: explain the versioning scheme
 * Changelog: add a release date for 9.1.5
 * evoacme: exclude typical certbot directories

 ### Fixed
-
 * fail2ban: fix horrible typo, Python is not Ruby
 * nginx: fix servers status dirname

 ## [9.1.5] - 2018-01-18

 ### Added
-
 * There is a changelog!
 * redis: configuration variable for protected mode (v3.2+)
 * evolinux-users: users are in "adm" group for Debian 9 or later
@ -1436,49 +1166,41 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * redmine: ability to install themes and plugins

 ### Changed
-
 * rbenv: Ruby 2.5 becomes the default version
 * evocheck: update upstream version embedded in role (c993244)
 * bind: keep 52 weeks of logs

 ### Fixed
-
 * squid: different logrotate file for Jessie or Stretch+
 * evoacme: don't invoke evoacme if no vhost is found
 * evomaintenance: explicit quotes in config file
 * redmine: force xpath gem < 3.0.0

 ### Security
-
 * evomaintenance: fix permissions for config file

 ## [9.1.4] - 2017-12-20

 ### Added
-
 * php: install php5-intl (for Jessie) and php-intl (for Debian 9 or later)
 * mysql: add a check_mysql_slave in nrpe configuration
 * ldap: slapd tcp port is configurable
 * elasticsearch: broader patterns for log rotation

 ### Changed
-
 * split IP lists in 2 – default and additional – for easier customization.

 ### Fixed
-
 * minifirewall: allow outgoing SSH connections over IPv6
 * nodejs: rename source.list file

 ### Security
-
 * evoadmin-web: change config.local.php file permissions
 * evolinux-base: change default_www file permissions

 ## [9.1.3] 2017-12-08

 ### Added
-
 * evolinux-base: install traceroute package
 * evolinux-base/ntpd: purge openntpd
 * tomcat: add Tomcat 8 cmpatibility
@ -1490,7 +1212,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * elastic: option for stack main version

 ### Changed
-
 * nginx: rename Let's Encrypt snippet
 * nginx: simpler apt preferences for backports
 * generate-ldif: add clamd service instead of clamav_db
@ -1502,12 +1223,10 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * mongodb: comatible with Stretch

 ### Removed
-
 * mongodb: logfile/pidfile are not configurable on Jessie
 * minifirewall: remove zidane.evolix.net from HTTPSITES

 ### Fixed
-
 * nginx: fix munin CGI graphs
 * ntpd: fix default configuration (localhost only)
 * logstash: fix permissions on pipeline configuration
@ -1518,17 +1237,14 @@ The **patch** part changes is incremented if multiple releases happen the same m
 ## [9.1.2] 2017-12-05

 ### Fixed
-
 * listupgrade: remount /usr as rw

 ## [9.1.1] 2017-11-21

 ### Added
-
 * amazon-ec2: add egress rules

 ### Fixed
-
 * evoacme: fix multiple bugs

 ## [9.1.0] 2017-11-19
@ -1536,7 +1252,6 @@ The **patch** part changes is incremented if multiple releases happen the same m
 _Warning: huge release, many entries are missing below._

 ### Added
-
 * amazon-ec2: new role, for EC2 instances creation
 * Move /usr rw remount into remount-usr role
 * kibana: host and basepath configuration
@ -1547,7 +1262,6 @@ _Warning: huge release, many entries are missing below._
 * nagios-nrpe: add opendkim check

 ### Changed
-
 * Combine evolix and additional trusted IP addresses
 * amazon-ec2: split tasks
 * apt: don't upgrade by default
@ -1558,7 +1272,6 @@ _Warning: huge release, many entries are missing below._
 * ldap: better variables

 ### Fixed
-
 * fail2ban: create config hierarchy beforehand
 * elasticsearch: fix datadir/tmpdir conditions
 * elastic: remove double ".list" suffix
@ -1569,10 +1282,10 @@ _Warning: huge release, many entries are missing below._

 ### Security

+
 ## [9.0.1] 2017-10-02

 ### Added
-
 * haproxy: add a Nagios check
 * php: add "sury" mode for PHP 7.1 on Stretch
 * minifirewall: explicit dependency on iptables
@ -1580,11 +1293,9 @@ _Warning: huge release, many entries are missing below._
 * docker-host: new variable for docker home

 ### Changed
-
 * php: install php5/php package after fpm/libapache2-mod-php

 ### Fixed
-
 * mysql: add "REPLICATION CLIENT" privilege for nrpe
 * evoadmin-web: revert from variables to keywords in the templates
 * evoacme: many fixes
--- a/amavis/defaults/main.yml
+++ b/amavis/defaults/main.yml
@ -1,5 +0,0 @@
---
-
-ldap_hostname: "{{ ansible_hostname }}"
-ldap_domain: "{{ ansible_domain }}"
-ldap_suffix: "dc={{ ldap_hostname }},dc={{ ldap_domain.split('.')[-2] }},dc={{ ldap_domain.split('.')[-1] }}"
--- a/amavis/files/amavis_purge_virusmails
+++ b/amavis/files/amavis_purge_virusmails
@ -1,2 +0,0 @@
-#!/bin/bash
-find /var/lib/amavis/virusmails/ -type f -mtime +30 -delete
--- a/amavis/tasks/main.yml
+++ b/amavis/tasks/main.yml
@ -6,7 +6,7 @@
      - amavisd-new
    state: present
  tags:
-    - amavis
+  - amavis

 - name: configure Amavis
  ansible.builtin.template:
@ -15,13 +15,4 @@
    mode: "0644"
  notify: restart amavis
  tags:
-    - amavis
-
- name: Install purge custom cron
-  ansible.builtin.copy:
-    src: amavis_purge_virusmails
-    dest: /etc/cron.daily/amavis_purge_virusmails
-    mode: "0755"
-  tags:
-    - amavis
-    - amavis_purge_cron
+  - amavis
--- a/amavis/templates/amavis.conf.j2
+++ b/amavis/templates/amavis.conf.j2
@ -44,7 +44,7 @@ $max_servers = 2;
 $enable_ldap = 1;
 $default_ldap = {
   hostname => '127.0.0.1', tls => 0,
-   base => '{{ ldap_suffix | mandatory }}', scope => 'sub',
+   base => '{{ ldap_suffix }}', scope => 'sub',
   query_filter => '(&(mailacceptinggeneralid=%m)(isActive=TRUE))'
 };

--- a/amazon-ec2/amazon-ec2-evolinux.yml
+++ b/amazon-ec2/amazon-ec2-evolinux.yml
@ -18,7 +18,7 @@

 - name: Install Evolinux
  hosts: launched-instances
-  become: true
+  become: yes

  vars_files:
  - 'vars/secrets.yml'
--- a/apache/files/evolinux-defaults.conf
+++ b/apache/files/evolinux-defaults.conf
@ -10,7 +10,7 @@ MaxKeepAliveRequests 10
    StartServers 50
    MinSpareServers 20
    MaxSpareServers 30
-    MaxConnectionsPerChild 100
+    MaxRequestsPerChild 0
 </IfModule>

 <IfModule mpm_worker_module>
@ -20,7 +20,7 @@ MaxKeepAliveRequests 10
    ThreadLimit          64
    ThreadsPerChild      25
    MaxRequestWorkers     150
-    MaxConnectionsPerChild  100 
+    MaxConnectionsPerChild   0
 </IfModule>

 <IfModule mpm_itk_module>
@ -40,25 +40,28 @@ MaxKeepAliveRequests 10
    </IfModule>
 </IfModule>

-# Go away bad bots (define "bad bots" in zzz-evolinux-custom.conf)
-<If "reqenv('GoAway') -eq 1">
-  Require all denied
-</If>
+
+<Directory /home/>
+    AllowOverride None
+    Require all granted
+    # "Require not env XXX" is not supported :(
+    Deny from env=GoAway
+</Directory>

 <DirectoryMatch "/\.git">
    # We don't want to let the client know a file exist on the server,
    # so we return 404 "Not found" instead of 403 "Forbidden".
-    Redirect 404 "-"
+    Redirect 404
 </DirectoryMatch>

 # File names starting with
 <FilesMatch "^\.(git|env)">
-    Redirect 404 "-"
+    Redirect 404
 </FilesMatch>

 # File names ending with
 <FilesMatch "\.(inc|bak)$">
-    Redirect 404 "-"
+    Redirect 404
 </FilesMatch>

 <LocationMatch "^/evolinux_fpm_status-.*">
--- a/apache/tasks/auth.yml
+++ b/apache/tasks/auth.yml
@ -7,7 +7,7 @@
    owner: root
    group: root
    mode: "0640"
-    force: false
+    force: no
  tags:
    - apache

@ -30,7 +30,7 @@
    owner: root
    group: root
    mode: "0640"
-    force: false
+    force: no
  notify: reload apache
  tags:
    - apache
--- a/apache/tasks/ip_whitelist.yml
+++ b/apache/tasks/ip_whitelist.yml
@ -5,7 +5,6 @@
    dest: /etc/apache2/ipaddr_whitelist.conf
    line: "Require ip {{ item }}"
    state: present
-    create: yes
  loop: "{{ apache_ipaddr_whitelist_present }}"
  notify: reload apache
  tags:
--- a/apache/tasks/log2mail.yml
+++ b/apache/tasks/log2mail.yml
@ -14,6 +14,6 @@
    owner: log2mail
    group: adm
    mode: "0644"
-    force: false
+    force: no
  tags:
    - apache
--- a/apache/tasks/main.yml
+++ b/apache/tasks/main.yml
@ -73,7 +73,7 @@
    owner: root
    group: root
    mode: "0640"
-    force: true
+    force: yes
  notify: reload apache
  tags:
  - apache
@ -85,7 +85,7 @@
    owner: root
    group: root
    mode: "0640"
-    force: false
+    force: no
  notify: reload apache
  tags:
  - apache
@ -119,7 +119,7 @@
    src: evolinux-default.conf.j2
    dest: /etc/apache2/sites-available/000-evolinux-default.conf
    mode: "0640"
-    force: false
+    force: no
  notify: reload apache
  tags:
    - apache
@ -129,7 +129,7 @@
    src: /etc/apache2/sites-available/000-evolinux-default.conf
    dest: /etc/apache2/sites-enabled/000-default.conf
    state: link
-    force: true
+    force: yes
  notify: reload apache
  when: apache_evolinux_default_enabled | bool
  tags:
@ -181,7 +181,7 @@
    src: save_apache_status.sh
    dest: /usr/share/scripts/save_apache_status.sh
    mode: "0755"
-    force: false
+    force: no
  tags:
    - apache

--- a/apache/tasks/server_status.yml
+++ b/apache/tasks/server_status.yml
@ -13,7 +13,7 @@
    dest: "{{ apache_serverstatus_suffix_file }}"
    # The last character "\u000A" is a line feed (LF), it's better to keep it
    content: "{{ apache_serverstatus_suffix }}\u000A"
-    force: true
+    force: yes
  when: apache_serverstatus_suffix | length > 0

 - name: generate random string for server-status suffix
--- a/apt/defaults/main.yml
+++ b/apt/defaults/main.yml
@ -14,7 +14,6 @@ apt_install_backports: False
 apt_backports_components: "main"

 apt_install_evolix_public: True
-apt_install_extended_lts: False

 apt_clean_gandi_sourceslist: False

@ -29,4 +28,4 @@ apt_check_hold_cron_weekday: "*"
 apt_check_hold_cron_day: "*"
 apt_check_hold_cron_month: "*"

-apt_keyring_dir: "{{ ansible_distribution_major_version is version('12', '<') | ternary('/etc/apt/trusted.gpg.d', '/etc/apt/keyrings') }}"
+apt_keyring_dir: "{{ ansible_distribution_major_version is version('12', '<') | ternary('/etc/apt/trusted.gpg.d', '/etc/apt/keyrings') }}"
--- a/apt/files/bookworm_backports_preferences
+++ b/apt/files/bookworm_backports_preferences
@ -0,0 +1,3 @@
+Package: *
+Pin: release a=bookworm-backports
+Pin-Priority: 50
--- a/apt/files/bullseye_backports_preferences
+++ b/apt/files/bullseye_backports_preferences
@ -0,0 +1,3 @@
+Package: *
+Pin: release a=bullseye-backports
+Pin-Priority: 50
--- a/apt/files/buster_backports_preferences
+++ b/apt/files/buster_backports_preferences
@ -0,0 +1,3 @@
+Package: *
+Pin: release a=buster-backports
+Pin-Priority: 50
--- a/apt/files/deb822-migration.py
+++ b/apt/files/deb822-migration.py
@ -1,10 +1,4 @@
-#!/usr/bin/env python3
-
-##########
-# This script takes a multi-lines input of "oneliner-style" APT sources definitions.
-# It converts them into "deb822-style" sources.
-# Each generated file will have only one stanza, possibly with multiple Types/Suites/Components
-##########
+#!/bin/env python3

 import re
 import sys
@ -16,16 +10,11 @@ import apt_pkg
 # Order matters !
 destinations = {
    "debian-security": "security.sources",
-
    ".*-backports": "backports.sources",
-
    ".debian.org": "system.sources",
    "mirror.evolix.org": "system.sources",
-    "ftp.evolix.org": "system.sources",
-
-    "pub.evolix.net": "evolix_public_old.sources.bak",
+    "pub.evolix.net": "evolix_public_old.sources",
    "pub.evolix.org": "evolix_public.sources",
-
    "artifacts.elastic.co": "elastic.sources",
    "download.docker.com": "docker.sources",
    "downloads.linux.hpe.com": "hp.sources",
@ -87,11 +76,6 @@ def prepare_sources(lines):
                        key, value = option.split("=")
                        options[key] = value

-            ### WARNING ###
-            # if there are multiple lines with different URIS for a given destination (eg. "system")
-            # each one will overwrite the previous one 
-            # and the last evaluated will be what remains.
-
            if dest in sources:
                sources[dest]["Types"].add(matches["type"])
                sources[dest]["URIs"] = matches["uri"]
@ -165,4 +149,4 @@ def main():
 if __name__ == "__main__":
    main()

-sys.exit(0)
+sys.exit(0)
--- a/apt/files/deb822-migration.sh
+++ b/apt/files/deb822-migration.sh
@ -1,11 +1,5 @@
 #!/bin/sh

-##########
-# This script changes all "one-line" APT sources into "deb822" sources.
-# It is responsible for searching and processing the files.
-# The actual format migration is done by a python script.
-##########
-
 deb822_migrate_script=$(command -v deb822-migration.py)

 if [ -z "${deb822_migrate_script}" ]; then
@ -52,4 +46,4 @@ for file in $(find /etc/apt/sources.list.d -mindepth 1 -maxdepth 1 -type f -name
 done

 echo "${count} file(s) migrated"
-exit ${rc}
+exit ${rc}
--- a/apt/files/freexian-archive-extended-lts.gpg
+++ b/apt/files/freexian-archive-extended-lts.gpg
--- a/apt/files/jessie_backports_preferences
+++ b/apt/files/jessie_backports_preferences
@ -0,0 +1,3 @@
+Package: *
+Pin: release a=jessie-backports
+Pin-Priority: 50
--- a/apt/files/stretch_backports_preferences
+++ b/apt/files/stretch_backports_preferences
@ -0,0 +1,3 @@
+Package: *
+Pin: release a=stretch-backports
+Pin-Priority: 50
--- a/apt/tasks/backports.deb822.yml
+++ b/apt/tasks/backports.deb822.yml
@ -4,15 +4,25 @@
  ansible.builtin.template:
    src: '{{ ansible_distribution_release }}_backports.sources.j2'
    dest: /etc/apt/sources.list.d/backports.sources
-    force: true
+    force: yes
    mode: "0640"
  register: apt_backports_sources
  tags:
    - apt

+- name: Backports configuration
+  ansible.builtin.copy:
+    src: '{{ ansible_distribution_release }}_backports_preferences'
+    dest: /etc/apt/preferences.d/0-backports-defaults
+    force: yes
+    mode: "0640"
+  register: apt_backports_config
+  tags:
+    - apt
+
 - name: Apt update
  ansible.builtin.apt:
    update_cache: yes
-  when: apt_backports_sources is changed
+  when: apt_backports_sources is changed or apt_backports_config is changed
  tags:
    - apt
--- a/apt/tasks/backports.oneline.yml
+++ b/apt/tasks/backports.oneline.yml
@ -11,12 +11,22 @@
  ansible.builtin.template:
    src: '{{ ansible_distribution_release }}_backports.list.j2'
    dest: /etc/apt/sources.list.d/backports.list
-    force: true
+    force: yes
    mode: "0640"
  register: apt_backports_list
  tags:
    - apt

+- name: Backports configuration
+  ansible.builtin.copy:
+    src: '{{ ansible_distribution_release }}_backports_preferences'
+    dest: /etc/apt/preferences.d/0-backports-defaults
+    force: yes
+    mode: "0640"
+  register: apt_backports_config
+  tags:
+    - apt
+
 - name: Archived backport are accepted (jessie)
  ansible.builtin.lineinfile:
    dest: '/etc/apt/apt.conf.d/99no-check-valid-until'
@ -32,4 +42,4 @@
    update_cache: yes
  tags:
    - apt
-  when: apt_backports_list is changed
+  when: apt_backports_list is changed or apt_backports_config is changed
--- a/apt/tasks/basics.deb822.yml
+++ b/apt/tasks/basics.deb822.yml
@ -5,7 +5,7 @@
    src: "{{ ansible_distribution_release }}_basics.sources.j2"
    dest: /etc/apt/sources.list.d/system.sources
    mode: "0644"
-    force: true
+    force: yes
  register: apt_basic_sources
  tags:
    - apt
@ -15,7 +15,7 @@
    src: "{{ ansible_distribution_release }}_security.sources.j2"
    dest: /etc/apt/sources.list.d/security.sources
    mode: "0644"
-    force: true
+    force: yes
  register: apt_security_sources
  tags:
    - apt
--- a/apt/tasks/basics.oneline.yml
+++ b/apt/tasks/basics.oneline.yml
@ -5,7 +5,7 @@
    src: "{{ ansible_distribution_release }}_basics.list.j2"
    dest: /etc/apt/sources.list
    mode: "0644"
-    force: true
+    force: yes
  register: apt_basic_list
  tags:
    - apt
--- a/apt/tasks/evolix_public.deb822.yml
+++ b/apt/tasks/evolix_public.deb822.yml
@ -16,25 +16,11 @@
    - apt
  when: _trusted_gpg_keyring.stat.exists

- name: "Ensure {{ apt_keyring_dir }} directory exists"
-  file:
-    path: "{{ apt_keyring_dir }}"
-    state: directory
-    mode: "755"
-    owner: root
-    group: root
-
- name: Set Evolix GPG key format to ASC
-  set_fact:
-    apt_evolix_public_key: "{{ apt_keyring_dir }}/pub_evolix.asc"
-  tags:
-    - apt
-
 - name: Add Evolix GPG key
  ansible.builtin.copy:
    src: pub_evolix.asc
-    dest: "{{ apt_evolix_public_key }}"
-    force: true
+    dest: "{{ apt_keyring_dir }}/pub_evolix.asc"
+    force: yes
    mode: "0644"
    owner: root
    group: root
@ -45,7 +31,7 @@
  ansible.builtin.template:
    src: evolix_public.sources.j2
    dest: /etc/apt/sources.list.d/evolix_public.sources
-    force: true
+    force: yes
    mode: "0640"
  register: apt_evolix_public
  tags:
--- a/apt/tasks/evolix_public.oneline.yml
+++ b/apt/tasks/evolix_public.oneline.yml
@ -16,35 +16,11 @@
    - apt
  when: _trusted_gpg_keyring.stat.exists

- name: "Ensure {{ apt_keyring_dir }} directory exists"
-  file:
-    path: "{{ apt_keyring_dir }}"
-    state: directory
-    mode: "755"
-    owner: root
-    group: root
-
- name: Set Evolix GPG key format to GPG (Debian < 9)
-  set_fact:
-    apt_evolix_public_key: "pub_evolix.gpg"
-  when:
-    - ansible_distribution_major_version is version('9', '<')
-  tags:
-    - apt
-
- name: Set Evolix GPG key format to ASC (Debian >= 9)
-  set_fact:
-    apt_evolix_public_key: "pub_evolix.asc"
-  when:
-    - ansible_distribution_major_version is version('9', '>=')
-  tags:
-    - apt
-
 - name: Add Evolix GPG key
  ansible.builtin.copy:
-    src: "{{ apt_evolix_public_key }}"
-    dest: "{{ apt_keyring_dir }}/{{ apt_evolix_public_key }}"
-    force: true
+    src: pub_evolix.asc
+    dest: "{{ apt_keyring_dir }}/pub_evolix.asc"
+    force: yes
    mode: "0644"
    owner: root
    group: root
@ -55,7 +31,7 @@
  ansible.builtin.template:
    src: evolix_public.list.j2
    dest: /etc/apt/sources.list.d/evolix_public.list
-    force: true
+    force: yes
    mode: "0640"
  register: apt_evolix_public
  tags:
--- a/apt/tasks/extended-lts.oneline.yml
+++ b/apt/tasks/extended-lts.oneline.yml
@ -1,37 +0,0 @@
---
-
- name: "Ensure {{ apt_keyring_dir }} directory exists"
-  file:
-    path: "{{ apt_keyring_dir }}"
-    state: directory
-    mode: "755"
-    owner: root
-    group: root
-
- name: Add Evolix GPG key
-  ansible.builtin.copy:
-    src: "freexian-archive-extended-lts.gpg"
-    dest: "{{ apt_keyring_dir }}/freexian-archive-extended-lts.gpg"
-    force: true
-    mode: "0644"
-    owner: root
-    group: root
-  tags:
-    - apt
-
- name: ELTS list is installed
-  ansible.builtin.template:
-    src: "{{ ansible_distribution_release }}_extended-lts.list.j2"
-    dest: /etc/apt/sources.list.d/extended-lts.list
-    force: true
-    mode: "0640"
-  register: apt_extended_lts
-  tags:
-    - apt
-
- name: Apt update
-  ansible.builtin.apt:
-    update_cache: yes
-  tags:
-    - apt
-  when: apt_extended_lts is changed
--- a/apt/tasks/hold_packages.yml
+++ b/apt/tasks/hold_packages.yml
@ -71,7 +71,7 @@
  ansible.builtin.copy:
    src: check_held_packages.sh
    dest: /usr/share/scripts/check_held_packages.sh
-    force: true
+    force: yes
    mode: "0755"
  tags:
    - apt
--- a/apt/tasks/main.yml
+++ b/apt/tasks/main.yml
@ -80,14 +80,6 @@
    - apt_install_evolix_public | bool
    - ansible_distribution_major_version is version('12', '>=')

- name: Install Extended-LTS repositories (Debian < 10)
-  ansible.builtin.import_tasks: extended-lts.oneline.yml
-  tags:
-    - apt
-  when:
-    - apt_install_extended_lts | bool
-    - ansible_distribution_major_version is version('10', '<')
-
 - name: Clean GANDI sources
  ansible.builtin.file:
    path: '{{ item }}'
@ -104,18 +96,6 @@
  when: apt_clean_gandi_sourceslist | bool


- name: "Disable NonFreeFirmware warning for VM on Debian 12+"
-  ansible.builtin.lineinfile:
-    path: /etc/apt/apt.conf.d/no-bookworm-firmware.conf
-    create: yes
-    line: "APT::Get::Update::SourceListWarnings::NonFreeFirmware \"false\";"
-  tags:
-    - apt
-  when:
-    - ansible_distribution_major_version is version('12', '>=')
-    - ansible_virtualization_role == "guest"
-
-
 - name: Install check for packages marked hold
  ansible.builtin.import_tasks: hold_packages.yml
  when: apt_install_hold_packages | bool
@ -134,4 +114,4 @@
    upgrade: dist
  when: apt_upgrade | bool
  tags:
-    - apt
+    - apt
--- a/apt/tasks/migrate-to-deb822.yml
+++ b/apt/tasks/migrate-to-deb822.yml
@ -14,9 +14,9 @@

 - name: Migration scripts are installed
  ansible.builtin.copy:
-    src: "{{ item }}"
-    dest: "/usr/share/scripts/{{ item }}"
-    force: true
+    src: "{{ item  }}"
+    dest: "/usr/share/scripts/{{ item  }}"
+    force: yes
    mode: "0755"
  loop:
    - deb822-migration.py
@ -29,34 +29,4 @@
    cmd: /usr/share/scripts/deb822-migration.sh
  ignore_errors: yes
  tags:
-    - apt
-
- name: Is system.sources present?
-  ansible.builtin.stat:
-    path: /etc/apt/sources.list.d/system.sources
-  register: _system_sources
-
- name: Add signed-by when relevant for bookworm
-  ansible.builtin.lineinfile:
-    dest: /etc/apt/sources.list.d/system.sources
-    line: "Signed-by: /usr/share/keyrings/debian-archive-keyring.gpg"
-    insertafter: "Suites: bookworm bookworm-updates"
-    state: present
-  tags:
-    - apt
-  when: _system_sources.stat.exists or not ansible_check_mode
-
- name: Is security.sources present?
-  ansible.builtin.stat:
-    path: /etc/apt/sources.list.d/security.sources
-  register: _security_sources
-
- name: Add signed-by when relevant for bookworm-security
-  ansible.builtin.lineinfile:
-    dest: /etc/apt/sources.list.d/security.sources
-    line: "Signed-by: /usr/share/keyrings/debian-archive-keyring.gpg"
-    insertafter: "Suites: bookworm-security"
-    state: present
-  tags:
-    - apt
-  when: _security_sources.stat.exists or not ansible_check_mode
+    - apt
--- a/apt/templates/bookworm_basics.sources.j2
+++ b/apt/templates/bookworm_basics.sources.j2
@ -3,6 +3,5 @@
 Types: deb
 URIs: http://mirror.evolix.org/debian
 Suites: bookworm bookworm-updates
-Components: {{ apt_basics_components | mandatory }}
+Components: {{ apt_basics_components | mandatory }} 
 Enabled: yes
-Signed-By: /usr/share/keyrings/debian-archive-bookworm-automatic.gpg
--- a/apt/templates/bookworm_security.sources.j2
+++ b/apt/templates/bookworm_security.sources.j2
@ -3,6 +3,5 @@
 Types: deb
 URIs: https://security.debian.org/debian-security
 Suites: bookworm-security
-Components: {{ apt_basics_components | mandatory }}
+Components: {{ apt_basics_components | mandatory }} 
 Enabled: yes
-Signed-By: /usr/share/keyrings/debian-archive-bookworm-security-automatic.gpg
--- a/apt/templates/bullseye_basics.list.j2
+++ b/apt/templates/bullseye_basics.list.j2
@ -1,5 +1,5 @@
 # {{ ansible_managed }}

 deb http://mirror.evolix.org/debian bullseye {{ apt_basics_components | mandatory }}
-deb http://mirror.evolix.org/debian bullseye-updates {{ apt_basics_components | mandatory }}
+deb http://mirror.evolix.org/debian/ bullseye-updates {{ apt_basics_components | mandatory }} 
 deb http://security.debian.org/debian-security bullseye-security {{ apt_basics_components | mandatory }}
--- a/apt/templates/buster_basics.list.j2
+++ b/apt/templates/buster_basics.list.j2
@ -1,5 +1,5 @@
 # {{ ansible_managed }}

 deb http://mirror.evolix.org/debian buster {{ apt_basics_components | mandatory }}
-deb http://mirror.evolix.org/debian buster-updates {{ apt_basics_components | mandatory }}
+deb http://mirror.evolix.org/debian/ buster-updates {{ apt_basics_components | mandatory }}
 deb http://security.debian.org/debian-security buster/updates {{ apt_basics_components | mandatory }}
--- a/apt/templates/evolix_public.list.j2
+++ b/apt/templates/evolix_public.list.j2
@ -1,3 +1,3 @@
 # {{ ansible_managed }}

-deb [signed-by={{ apt_keyring_dir }}/{{ apt_evolix_public_key }}] http://pub.evolix.org/evolix {{ ansible_distribution_release }} main
+deb [signed-by={{ apt_keyring_dir }}/pub_evolix.asc] http://pub.evolix.org/evolix {{ ansible_distribution_release }} main
--- a/apt/templates/evolix_public.sources.j2
+++ b/apt/templates/evolix_public.sources.j2
@ -1,6 +1,6 @@
 # {{ ansible_managed }}

-Types: deb
+Types:deb
 URIs: http://pub.evolix.org/evolix
 Suites: {{ ansible_distribution_release }}
 Components: main
--- a/apt/templates/jessie_basics.list.j2
+++ b/apt/templates/jessie_basics.list.j2
@ -1,5 +1,4 @@
 # {{ ansible_managed }}

-### Those repositories are unusable. Move to ELTS (manually).
-# deb http://archive.debian.org/debian jessie {{ apt_basics_components | mandatory }}
-# deb http://archive.debian.org/debian-security jessie/updates {{ apt_basics_components | mandatory }}
+deb http://mirror.evolix.org/debian/ jessie {{ apt_basics_components | mandatory }}
+deb http://security.debian.org/ jessie/updates {{ apt_basics_components | mandatory }}
--- a/apt/templates/jessie_extended-lts.list.j2
+++ b/apt/templates/jessie_extended-lts.list.j2
@ -1,4 +0,0 @@
-# {{ ansible_managed }}
-
-deb [signed-by="{{ apt_keyring_dir }}/freexian-archive-extended-lts.gpg"] http://elts.evolix.org/extended-lts jessie main
-deb [signed-by="{{ apt_keyring_dir }}/freexian-archive-extended-lts.gpg"] http://elts.evolix.org/extended-lts jessie-lts main
--- a/apt/templates/stretch_basics.list.j2
+++ b/apt/templates/stretch_basics.list.j2
@ -1,4 +1,5 @@
 # {{ ansible_managed }}

-deb http://archive.debian.org/debian stretch {{ apt_basics_components | mandatory }}
-deb http://archive.debian.org/debian-security stretch/updates {{ apt_basics_components | mandatory }}
+deb http://mirror.evolix.org/debian stretch {{ apt_basics_components | mandatory }}
+deb http://mirror.evolix.org/debian/ stretch-updates {{ apt_basics_components | mandatory }}
+deb http://security.debian.org/debian-security stretch/updates {{ apt_basics_components | mandatory }}
--- a/apt/templates/stretch_extended-lts.list.j2
+++ b/apt/templates/stretch_extended-lts.list.j2
@ -1,4 +0,0 @@
-# {{ ansible_managed }}
-
-deb [signed-by="{{ apt_keyring_dir }}/freexian-archive-extended-lts.gpg"] http://elts.evolix.org/extended-lts stretch main
-deb [signed-by="{{ apt_keyring_dir }}/freexian-archive-extended-lts.gpg"] http://elts.evolix.org/extended-lts stretch-lts main
--- a/autosysadmin-agent/defaults/main.yml
+++ b/autosysadmin-agent/defaults/main.yml
@ -1,17 +0,0 @@
---
-
-general_scripts_dir: "/usr/share/scripts"
-
-autosysadmin_agent_bin_dir: "/usr/local/bin/autosysadmin"
-autosysadmin_agent_lib_dir: "/usr/local/lib/autosysadmin"
-autosysadmin_agent_auto_dir: "{{ general_scripts_dir }}/autosysadmin/restart"
-
-autosysadmin_agent_crontab_enabled: true
-autosysadmin_agent_log_retention_days: 365
-
-autosysadmin_config: []
-  ### All repair are disabled if set to 'off'
-  ### even if a specific repair value is 'on'
-  # repair_all: 'on'
-  ### Default values for checks
-  # repair_foo: 'off'
--- a/autosysadmin-agent/files/autosysadmin.logrotate.conf
+++ b/autosysadmin-agent/files/autosysadmin.logrotate.conf
@ -1,13 +0,0 @@
-/var/log/autosysadmin.log {
-    daily
-    missingok
-    rotate 365
-    compress
-    nodelaycompress
-    notifempty
-    dateext
-    dateformat .%Y-%m-%d
-    dateyesterday
-    copytruncate
-    create 0640 root adm
-}
--- a/autosysadmin-agent/files/autosysadmin.rsyslog.conf
+++ b/autosysadmin-agent/files/autosysadmin.rsyslog.conf
@ -1,3 +0,0 @@
-$template autosysadmin, "/var/log/autosysadmin.log"
-if $programname contains 'autosysadmin' then ?autosysadmin
-& stop
--- a/autosysadmin-agent/files/upstream/bin/delete_old_logs.sh
+++ b/autosysadmin-agent/files/upstream/bin/delete_old_logs.sh
@ -1,25 +0,0 @@
-#!/bin/bash
-
-days=${1:-365}
-log_dir="/var/log/autosysadmin/"
-
-if [ -d "${log_dir}" ]; then
-    find_run_dirs() {
-        find "${log_dir}" \
-            -mindepth 1 \
-            -maxdepth 1 \
-            -type d \
-            -ctime "+${days}" \
-            -print0
-    }
-    log() {
-        /usr/bin/logger -p local0.notice -t autosysadmin "${1}"
-    }
-
-    while IFS= read -r -d '' run_dir; do
-        rm --recursive --force "${run_dir}"
-        log "Delete ${run_dir} (older than ${days} days)"
-    done < <(find_run_dirs)
-fi
-
-exit 0
--- a/autosysadmin-agent/files/upstream/lib/common.sh
+++ b/autosysadmin-agent/files/upstream/lib/common.sh
@ -1,907 +0,0 @@
-#!/bin/bash
-
-VERSION="24.03"
-
-# Common functions for "repair" and "restart" scripts
-
-set -u
-
-# Initializes the program, context, configuration…
-initialize() {
-    PATH="${PATH}":/usr/sbin:/sbin
-
-    # Used in many places to refer to the program name.
-    # Examples: repair_mysql, restart_nrpe…
-    PROGNAME=$(basename "${0}")
-
-    # find out if running in interactive mode, or not
-    if [ -t 0 ]; then
-        INTERACTIVE=1
-    else
-        INTERACTIVE=0
-    fi
-    readonly INTERACTIVE
-
-    # Default empty value for Debug mode
-    DEBUG="${DEBUG:-""}"
-
-    # Repair scripts obey to the value of a variable named after the script
-    # You can set the value ("on" or "off") in /etc/evolinux/autosysadmin
-    # Here we set the default value to "on".
-    declare -g "${PROGNAME}"=on  # dynamic variable assignment ($PROGNAME == repair_*)
-
-    PID=$$
-    readonly PID
-
-    # Each execution (run) gets a unique ID
-    RUN_ID="$(date +"%Y-%m-%d_%H-%M")_${PROGNAME}_${PID}"
-    readonly RUN_ID
-
-    # Main log directory
-    MAIN_LOG_DIR="/var/log/autosysadmin"
-    readonly MAIN_LOG_DIR
-    # shellcheck disable=SC2174
-    mkdir --mode=750 --parents "${MAIN_LOG_DIR}"
-    chgrp adm "${MAIN_LOG_DIR}"
-
-    # Each execution store some information
-    # in a unique directory based on the RUN_ID
-    RUN_LOG_DIR="${MAIN_LOG_DIR}/${RUN_ID}"
-    readonly RUN_LOG_DIR
-    # shellcheck disable=SC2174
-    mkdir --mode=750 --parents "${RUN_LOG_DIR}"
-    chgrp adm "${RUN_LOG_DIR}"
-
-    # This log file contains all events
-    RUN_LOG_FILE="${RUN_LOG_DIR}/autosysadmin.log"
-    readonly RUN_LOG_FILE
-
-    # This log file contains notable actions
-    ACTIONS_FILE="${RUN_LOG_DIR}/actions.log"
-    readonly ACTIONS_FILE
-    touch "${ACTIONS_FILE}"
-    # This log file contains abort reasons (if any)
-    ABORT_FILE="${RUN_LOG_DIR}/abort.log"
-    readonly ABORT_FILE
-    # touch "${ABORT_FILE}"
-
-    # Date format for log messages
-    DATE_FORMAT="%Y-%m-%d %H:%M:%S"
-
-    # This will contain lock, last-run markers…
-    # It's ok to lose the content after a reboot
-    RUN_DIR="/run/autosysadmin"
-    readonly RUN_DIR
-    mkdir -p "${RUN_DIR}"
-
-    # Only a singe instace of each script can run simultaneously
-    # We use a customizable lock name for this.
-    # By default it's the script's name
-    LOCK_NAME=${LOCK_NAME:-${PROGNAME}}
-    # If a lock is found, we can wait for it to disappear.
-    # The value must be understood by sleep(1)
-    LOCK_WAIT="0"
-
-    # Default values for email headers
-    EMAIL_FROM="equipe+autosysadmin@evolix.fr"
-    EMAIL_INTERNAL="autosysadmin@evolix.fr"
-
-    LOCK_FILE="${RUN_DIR}/${LOCK_NAME}.lock"
-    readonly LOCK_FILE
-    # Remove lock file at exit
-    cleanup() {
-        # shellcheck disable=SC2317
-        rm -f "${LOCK_FILE}"
-    }
-    trap 'cleanup' 0
-
-    # Load configuration
-    # shellcheck disable=SC1091
-    test -f /etc/evolinux/autosysadmin && source /etc/evolinux/autosysadmin
-
-    log_all "Begin ${PROGNAME} RUN_ID: ${RUN_ID}"
-    log_all "Log directory is ${RUN_LOG_DIR}"
-}
-
-# Executes a list of tasks before exiting:
-# * prepare a summary of actions and possible abort reasons
-# * send emails
-# * do some cleanup
-quit() {
-    log_all "End ${PROGNAME} RUN_ID: ${RUN_ID}"
-
-    summary="RUN_ID: ${RUN_ID}"
-    if [ -s "${ABORT_FILE}" ]; then
-        # Add abort reasons to summary
-        summary="${summary}\n$(print_abort_reasons)"
-        hook_mail "abort"
-
-        return_code=1
-    else
-        if [ -s "${ACTIONS_FILE}" ]; then
-            # Add notable actions to summary
-            summary="${summary}\n$(print_actions "Aucune action")"
-            hook_mail "success"
-        fi
-
-        return_code=0
-    fi
-
-    hook_mail "internal"
-
-    if is_interactive; then
-        # shellcheck disable=SC2001
-        echo "${summary}" | sed -e 's/\\n/\n/g'
-    else
-        /usr/share/scripts/evomaintenance.sh --auto --user autosysadmin --message "${summary}" --no-commit --no-mail
-    fi
-
-    teardown
-
-    # shellcheck disable=SC2086
-    exit ${return_code}
-}
-
-teardown() {
-    :
-}
-
-# Return true/false
-is_interactive() {
-    test "${INTERACTIVE}" -eq "1"
-}
-
-save_server_state() {
-    DUMP_SERVER_STATE_BIN="$(command -v dump-server-state || command -v backup-server-state)"
-
-    if [ -z "${DUMP_SERVER_STATE_BIN}" ]; then
-        log_all "Warning: dump-server-state is not present. No server state recorded."
-    fi
-
-    if [ -x "${DUMP_SERVER_STATE_BIN}" ]; then
-        DUMP_DIR=$(file_path_in_log_dir "server-state")
-        # We don't want the logging to take too much time,
-        # so we kill it if it takes more than 20 seconds.
-        timeout --signal 9 20          \
-            "${DUMP_SERVER_STATE_BIN}" \
-            --dump-dir="${DUMP_DIR}"   \
-            --df                       \
-            --dmesg                    \
-            --iptables                 \
-            --lxc                      \
-            --netcfg                   \
-            --netstat                  \
-            --uname                    \
-            --processes                \
-            --systemctl                \
-            --uptime                   \
-            --virsh                    \
-            --disks                    \
-            --mysql-processes          \
-            --no-apt-states            \
-            --no-apt-config            \
-            --no-dpkg-full             \
-            --no-dpkg-status           \
-            --no-mount                 \
-            --no-packages              \
-            --no-sysctl                \
-            --no-etc
-
-        log_run "Server state saved in \`server-state' directory."
-    fi
-}
-
-is_debug() {
-    # first time: do the check…
-    # other times: pass
-    if [ -z "${DEBUG:-""}" ]; then
-        debug_file="/etc/evolinux/autosysadmin.debug"
-
-        if [ -e "${debug_file}" ]; then
-            last_change=$(stat -c %Z "${debug_file}")
-            limit_date=$(date --date "14400 seconds ago" +"%s")
-
-            if [ $(( last_change - limit_date )) -le "0" ]; then
-                log_run "Debug mode disabled; file is too old (%{last_change} seconds)."
-                rm "${debug_file}"
-                # Debug mode disabled
-                DEBUG="0"
-            else
-                log_run "Debug mode enabled."
-                # Debug mode enabled
-                DEBUG="1"
-            fi
-        else
-            # log_run "Debug mode disabled; file is absent."
-            # Debug mode disabled
-            DEBUG="0"
-        fi
-    fi
-    # return the value
-    test "${DEBUG}" -eq "1"
-}
-
-# Uses the who(1) definition of "active"
-currently_active_users() {
-    LC_ALL=C who --users | grep --extended-regexp "\s+\.\s+" | awk '{print $1}' | sort --human-numeric-sort | uniq
-}
-# Users active in the last 29 minutes
-recently_active_users() {
-    LC_ALL=C who --users | grep --extended-regexp "\s+00:(0|1|2)[0-9]\s+" | awk --field-separator ' ' '{print $1,$6}'
-}
-# Save the list of users to a file in the log directory
-save_active_users() {
-    LC_ALL=C who --users | save_in_log_dir "who-users"
-}
-
-# An autosysadmin must not perform actions if a user is active or was active recently.
-#
-# This can by bypassed in interactive mode.
-# It's OK to lose this data after a reboot.
-ensure_no_active_users_or_exit() {
-    # Save all active users
-    save_active_users
-
-    if is_debug; then
-        log_run "Debug mode enabled: continue without checking active users."
-        return 0;
-    fi
-
-    # Is there any currently active user?
-    currently_active_users=$(currently_active_users)
-    if [ -n "${currently_active_users}" ]; then
-        # shellcheck disable=SC2001
-        users_oneliner=$(echo "${currently_active_users}" | sed -e 's/\n/ /')
-        log_run "Currently active users: ${users_oneliner}"
-        if is_interactive; then
-            echo "Some users are currently active:"
-            # shellcheck disable=SC2001
-            echo "${currently_active_users}" | sed -e 's/\(.\+\)/* \1/'
-            answer=""
-            while :; do
-                printf "> Continue? [Y,n,?] "
-                read -r answer
-                case ${answer} in
-                    [Yy]|"" )
-                        log_run "Active users check bypassed manually in interactive mode."
-                        return
-                        ;;
-                    [Nn] )
-                        log_run "Active users check confirmed manually in interactive mode."
-                        log_abort_and_quit "Active users detected: ${users_oneliner}"
-                        ;;
-                    * )
-                        printf "y - yes, continue\n"
-                        printf "n - no, exit\n"
-                        printf "? - print this help\n"
-                        ;;
-                esac
-            done
-        else
-            log_abort_and_quit "Currently active users detected: ${users_oneliner}."
-        fi
-    else
-        # or recently (the last 30 minutes) active user?
-        recently_active_users=$(recently_active_users)
-        if [ -n "${recently_active_users}" ]; then
-            # shellcheck disable=SC2001
-            users_oneliner=$(echo "${recently_active_users}" | sed -e 's/\n/ /')
-            log_run "Recently active users: ${users_oneliner}"
-            if is_interactive; then
-                echo "Some users were recently active:"
-                # shellcheck disable=SC2001
-                echo "${recently_active_users}" | sed -e 's/\(.\+\)/* \1/'
-                answer=""
-                while :; do
-                    printf "> Continue? [Y,n,?] "
-                    read -r answer
-                    case ${answer} in
-                        [Yy]|"" )
-                            log_run "Active users check bypassed manually in interactive mode."
-                            return
-                            ;;
-                        [Nn] )
-                            log_run "Active users check confirmed manually in interactive mode."
-                            log_abort_and_quit "Recently active users detected: ${users_oneliner}."
-                            ;;
-                        * )
-                            printf "y - yes, continue\n"
-                            printf "n - no, exit\n"
-                            printf "? - print this help\n"
-                            ;;
-                    esac
-                done
-            else
-                log_abort_and_quit "Recently active users detected: ${users_oneliner}."
-            fi
-        fi
-    fi
-}
-
-# Takes an NRPE command name as 1st parameter,
-# and executes the full command if found in the configuration.
-# Return the result and the return code of the command.
-check_nrpe() {
-    check="$1"
-
-    nrpe_files=""
-
-    # Check if NRPE config is found
-    if [ -f "/etc/nagios/nrpe.cfg" ]; then
-        nrpe_files="${nrpe_files} /etc/nagios/nrpe.cfg"
-    else
-        msg="NRPE configuration not found: /etc/nagios/nrpe.cfg"
-        log_run "${msg}"
-        echo "${msg}"
-        return 3
-    fi
-
-    # Search for included files
-    # shellcheck disable=SC2086
-    while IFS= read -r include_file; do
-        nrpe_files="${nrpe_files} ${include_file}"
-    done < <(grep --extended-regexp '^\s*include=.+' ${nrpe_files} | cut -d = -f 2)
-
-    # Search for files in included directories
-    # shellcheck disable=SC2086
-    while IFS= read -r include_dir; do
-        nrpe_files="${nrpe_files} ${include_dir}/*.cfg"
-    done < <(grep --extended-regexp '^\s*include_dir=.+' ${nrpe_files} | cut -d = -f 2)
-
-    # Fetch uncommented commands in (sorted) config files
-    # shellcheck disable=SC2086
-    nrpe_commands=$(grep --no-filename --exclude=*~ --fixed-strings "[${check}]" ${nrpe_files} | grep --invert-match --extended-regexp '^\s*#\s*command' | cut -d = -f 2)
-    nrpe_commands_count=$(echo "${nrpe_commands}" | wc -l)
-
-    if is_debian_version "9" "<=" && [ "${nrpe_commands_count}" -gt "1" ]; then
-        # On Debian <= 9, NRPE loading was not sorted
-        # we need to raise an error if we have multiple defined commands
-        msg="Unable to determine which NRPE command to run"
-        log_run "${msg}"
-        echo "${msg}"
-        return 3
-    else
-        # On Debian > 9, use the last command
-        nrpe_command=$(echo "${nrpe_commands}" | tail -n 1)
-
-        nrpe_result=$(${nrpe_command})
-        nrpe_rc=$?
-
-        log_run "NRPE command (exited with ${nrpe_rc}): ${nrpe_command}"
-        log_run "${nrpe_result}"
-
-        echo "${nrpe_result}"
-        return "${nrpe_rc}"
-    fi
-}
-
-# An autosysadmin script must not run twice (or more) simultaneously.
-# We use a customizable (with LOCK_NAME) lock file to keep track of this.
-# A wait time can be configured.
-#
-# This can by bypassed in interactive mode.
-# It's OK to lose this data after a reboot.
-acquire_lock_or_exit() {
-    lock_file="${1:-${LOCK_FILE}}"
-    lock_wait="${2:-${LOCK_WAIT}}"
-
-    # lock_wait must be compatible with sleep(1), otherwise fallback to 0
-    if ! echo "${lock_wait}" | grep -Eq '^[0-9]+[smhd]?$'; then
-        log_run "Lock wait: incorrect value '${lock_wait}', fallback to 0."
-        lock_wait=0
-    fi
-
-    if [ "${lock_wait}" != "0" ] && [ -f "${lock_file}" ]; then
-        log_run "Lock file present. Let's wait ${lock_wait} and check again."
-        sleep "${lock_wait}"
-    fi
-
-    if [ -f "${lock_file}" ]; then
-        log_abort_and_quit "Lock file still present."
-    else
-        log_run "Lock file absent. Let's put one."
-        touch "${lock_file}"
-    fi
-}
-
-# If a script has been run in the ast 30 minutes, running it again won't fix the issue.
-# We use a /run/ausosysadmin/${PROGNAME}_lastrun file to keep track of this.
-# 
-# This can by bypassed in interactive mode.
-# This is bypassed in debug mode.
-# It's OK to lose this data after a reboot.
-ensure_not_too_soon_or_exit() {
-    if is_debug; then
-        log_run "Debug mode enabled: continue without checking when was the last run."
-        return 0;
-    fi
-
-    lastrun_file="${RUN_DIR}/${PROGNAME}_lastrun"
-    if [ -f "${lastrun_file}" ]; then
-        lastrun_age="$(($(date +%s)-$(stat -c "%Y" "${lastrun_file}")))"
-        log_run "Last run was ${lastrun_age} seconds ago."
-        if [ "${lastrun_age}" -lt 1800 ]; then
-            if is_interactive; then
-                echo "${PROGNAME} was run ${lastrun_age} seconds ago."
-                answer=""
-                while :; do
-                    printf "> Continue? [Y,n,?] "
-                    read -r answer
-                    case ${answer} in
-                        [Yy]|"" )
-                            log_run "Last run check bypassed manually in interactive mode."
-                            break
-                            ;;
-                        [Nn] )
-                            log_run "Last run check confirmed manually in interactive mode."
-                            log_abort_and_quit 'Last run too recent.'
-                            ;;
-                        * )
-                            printf "y - yes, continue\n"
-                            printf "n - no, exit\n"
-                            printf "? - print this help\n"
-                            ;;
-                    esac
-                done
-            else
-                log_abort_and_quit "Last run too recent."
-            fi
-        fi
-    fi
-    touch "${lastrun_file}"
-}
-
-# Populate DEBIAN_VERSION and DEBIAN_RELEASE variables
-# based on gathered information about the operating system
-detect_os() {
-    DEBIAN_RELEASE="unknown"
-    DEBIAN_VERSION="unknown"
-    LSB_RELEASE_BIN="$(command -v lsb_release)"
-
-    if [ -e /etc/debian_version ]; then
-        DEBIAN_VERSION="$(cut -d "." -f 1 < /etc/debian_version)"
-        if [ -x "${LSB_RELEASE_BIN}" ]; then
-            DEBIAN_RELEASE="$("${LSB_RELEASE_BIN}" --codename --short)"
-        else
-            case "${DEBIAN_VERSION}" in
-                 7) DEBIAN_RELEASE="wheezy"   ;;
-                 8) DEBIAN_RELEASE="jessie"   ;;
-                 9) DEBIAN_RELEASE="stretch"  ;;
-                10) DEBIAN_RELEASE="buster"   ;;
-                11) DEBIAN_RELEASE="bullseye" ;;
-                12) DEBIAN_RELEASE="bookworm" ;;
-                13) DEBIAN_RELEASE="trixie"   ;;
-            esac
-        fi
-    #    log_run "Detected OS: Debian version=${DEBIAN_VERSION} release=${DEBIAN_RELEASE}"
-    # else
-    #    log_run "Detected OS: unknown (missing /etc/debian_version)"
-    fi
-}
-
-is_debian_wheezy() {
-    test "${DEBIAN_RELEASE}" = "wheezy"
-}
-is_debian_jessie() {
-    test "${DEBIAN_RELEASE}" = "jessie"
-}
-is_debian_stretch() {
-    test "${DEBIAN_RELEASE}" = "stretch"
-}
-is_debian_buster() {
-    test "${DEBIAN_RELEASE}" = "buster"
-}
-is_debian_bullseye() {
-    test "${DEBIAN_RELEASE}" = "bullseye"
-}
-is_debian_bookworm() {
-    test "${DEBIAN_RELEASE}" = "bookworm"
-}
-is_debian_trixie() {
-    test "${DEBIAN_RELEASE}" = "trixie"
-}
-is_debian_version() {
-    local version=$1
-    local relation=${2:-"eq"}
-
-    if [ -z "${DEBIAN_VERSION:-""}" ]; then
-        detect_os
-    fi
-
-    dpkg --compare-versions "${DEBIAN_VERSION}" "${relation}" "${version}"
-}
-
-# List systemd services (only names), even if stopped
-systemd_list_services() {
-    pattern=$1
-
-    systemctl list-units --all --no-legend --type=service "${pattern}" | grep --only-matching --extended-regexp '\S+\.service'
-}
-
-is_systemd_enabled() {
-    systemctl --quiet is-enabled "$1" 2> /dev/null
-}
-
-is_systemd_active() {
-    systemctl --quiet is-active "$1" 2> /dev/null
-}
-
-is_sysvinit_enabled() {
-    find /etc/rc2.d/ -name "$1" > /dev/null
-}
-
-get_fqdn() {
-    # shellcheck disable=SC2155
-    local system=$(uname -s)
-
-    if [ "${system}" = "Linux" ]; then
-        hostname --fqdn
-    elif [ "${system}" = "OpenBSD" ]; then
-        hostname
-    else
-        log_abort_and_quit "System '${system}' not recognized."
-    fi
-}
-
-get_complete_hostname() {
-    REAL_HOSTNAME="$(get_fqdn)"
-    if [ "${HOSTNAME}" = "${REAL_HOSTNAME}" ]; then
-        echo "${HOSTNAME}"
-    else
-        echo "${HOSTNAME} (${REAL_HOSTNAME})"
-    fi
-}
-# Fetch values from evomaintenance configuration
-get_evomaintenance_mail() {
-    grep "EVOMAINTMAIL=" /etc/evomaintenance.cf | cut -d '=' -f2
-}
-get_evomaintenance_emergency_mail() {
-    grep "URGENCYFROM=" /etc/evomaintenance.cf | cut -d '=' -f2
-}
-get_evomaintenance_emergency_tel() {
-    grep "URGENCYTEL=" /etc/evomaintenance.cf | cut -d '=' -f2
-}
-
-# Log a message to the log file in the log directory
-log_run() {
-    local msg="${1:-$(cat /dev/stdin)}"
-    # shellcheck disable=SC2155
-    local date=$(/bin/date +"${DATE_FORMAT}")
-
-    printf "[%s] %s[%s]: %s\\n" \
-        "${date}" "${PROGNAME}" "${PID}" "${msg}" \
-        >> "${RUN_LOG_FILE}"
-}
-# Log a message in the system log file (syslog or journald)
-log_global() {
-    local msg="${1:-$(cat /dev/stdin)}"
-
-    echo "${msg}" \
-        | /usr/bin/logger -p local0.notice -t autosysadmin
-}
-# Log a message in both places
-log_all() {
-    local msg="${1:-$(cat /dev/stdin)}"
-
-    log_global "${msg}"
-    log_run "${msg}"
-}
-# Log a notable action in regular places
-# and append it to the dedicated list
-log_action() {
-    log_all "$*"
-    append_action "$*"
-}
-# Append a line in the actions.log file in the log directory
-append_action() {
-    echo "$*" >> "${ACTIONS_FILE}"
-}
-# Print the content of the actions.log file
-# or a fallback content (1st parameter) if empty
-# shellcheck disable=SC2120
-print_actions() {
-    local fallback=${1:-""}
-    if [ -s "${ACTIONS_FILE}" ]; then
-        cat "${ACTIONS_FILE}"
-    elif [ -n "${fallback}" ]; then
-        echo "${fallback}"
-    fi
-}
-
-# Log a an abort reason in regular places
-# and append it to the dedicated list
-log_abort() {
-    log_all "$*"
-    append_abort_reason "$*"
-}
-# Append a line in the abort.log file in the log directory
-append_abort_reason() {
-    echo "$*" >> "${ABORT_FILE}"
-}
-# Print the content of the abort.log file
-# or a fallback content (1st parameter) if empty
-# shellcheck disable=SC2120
-print_abort_reasons() {
-    local fallback=${1:-""}
-    if [ -s "${ABORT_FILE}" ]; then
-        cat "${ABORT_FILE}"
-    elif [ -n "${fallback}" ]; then
-        echo "${fallback}"
-    fi
-}
-# Print the content of the main log from the log directory
-print_main_log() {
-    cat "${RUN_LOG_FILE}"
-}
-# Log an abort reason and quit the script
-log_abort_and_quit() {
-    log_abort "$*"
-    quit
-}
-
-# Store the content from standard inpu
-# into a file in the log directory named after the 1st parameter
-save_in_log_dir() {
-    local file_name=$1
-    local file_path="${RUN_LOG_DIR}/${file_name}"
-
-    cat /dev/stdin > "${file_path}"
-
-    log_run "Saved \`${file_name}' file."
-}
-# Return the full path of the file in log directory
-# based on the name in the 1st parameter
-file_path_in_log_dir() {
-    echo "${RUN_LOG_DIR}/${1}"
-}
-
-format_mail_success() {
-    cat <<EOTEMPLATE
-From: AutoSysadmin Evolix <${EMAIL_FROM}>
-Content-Type: text/plain; charset=UTF-8
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-X-Script: ${PROGNAME}
-X-RunId: ${RUN_ID}
-To: ${EMAIL_CLIENT:-alert5@evolix.fr}
-Cc: ${EMAIL_INTERNAL}
-Subject: [autosysadmin] Intervention automatisée sur ${HOSTNAME_TEXT}
-
-Bonjour,
-
-Une intervention automatisée vient de se terminer.
-
-Nom du serveur : ${HOSTNAME_TEXT}
-Heure d'intervention : $(LC_ALL=fr_FR.utf8 date)
-Script déclenché : ${PROGNAME}
-
-### Actions réalisées
-
-$(print_actions "Aucune")
-
-### Réagir à cette intervention
-
-Vous pouvez répondre à ce message (${EMAIL_FROM}).
-
-En cas d'urgence, utilisez l'adresse ${EMERGENCY_MAIL}
-ou notre ligne d'astreinte (${EMERGENCY_TEL})
-
--
-Votre AutoSysadmin
-EOTEMPLATE
-}
-
-format_mail_abort() {
-    cat <<EOTEMPLATE
-From: AutoSysadmin Evolix <${EMAIL_FROM}>
-Content-Type: text/plain; charset=UTF-8
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-X-Script: ${PROGNAME}
-X-RunId: ${RUN_ID}
-To: ${EMAIL_CLIENT:-alert5@evolix.fr}
-Cc: ${EMAIL_INTERNAL}
-Subject: [autosysadmin] Intervention automatisée interrompue sur ${HOSTNAME_TEXT}
-
-Bonjour,
-
-Une intervention automatisée a été déclenchée mais s'est interrompue.
-
-Nom du serveur : ${HOSTNAME_TEXT}
-Heure d'intervention : $(LC_ALL=fr_FR.utf8 date)
-Script déclenché : ${PROGNAME}
-
-### Actions réalisées
-
-$(print_actions "Aucune")
-
-### Raison(s) de l'interruption
-
-$(print_abort_reasons "Inconnue")
-
-### Réagir à cette intervention
-
-Vous pouvez répondre à ce message (${EMAIL_FROM}).
-
-En cas d'urgence, utilisez l'adresse ${EMERGENCY_MAIL}
-ou notre ligne d'astreinte (${EMERGENCY_TEL})
-
--
-Votre AutoSysadmin
-EOTEMPLATE
-}
-
-# shellcheck disable=SC2028
-print_report_information() {
-    echo "**Uptime**"
-    echo ""
-    uptime
-    
-    echo ""
-    echo "**Utilisateurs récents**"
-    echo ""
-    who_file=$(file_path_in_log_dir "who-users")
-    if [ -s "${who_file}" ]; then
-        cat "${who_file}"
-    else
-        who --users
-    fi
-    
-    echo ""
-    echo "**Espace disque**"
-    echo ""
-    df_file=$(file_path_in_log_dir "server-state/df.txt")
-    if [ -s "${df_file}" ]; then
-        cat "${df_file}"
-    else
-        df -h
-    fi
-    
-    echo ""
-    echo "**Dmesg**"
-    echo ""
-    dmesg_file=$(file_path_in_log_dir "server-state/dmesg.txt")
-    if [ -s "${dmesg_file}" ]; then
-        tail -n 5 "${dmesg_file}"
-    else
-        dmesg | tail -n 5
-    fi
-    
-    echo ""
-    echo "**systemd failed services**"
-    echo ""
-    failed_services_file=$(file_path_in_log_dir "server-state/systemctl-failed-services.txt")
-    if [ -s "${failed_services_file}" ]; then
-        cat "${failed_services_file}"
-    else
-        systemctl --no-legend --state=failed --type=service
-    fi
-
-    if command -v lxc-ls > /dev/null 2>&1; then
-        echo ""
-        echo "**LXC containers**"
-        echo ""
-        lxc_ls_file=$(file_path_in_log_dir "server-state/lxc-list.txt")
-        if [ -s "${lxc_ls_file}" ]; then
-            cat "${lxc_ls_file}"
-        else
-            lxc-ls --fancy
-        fi
-    fi
-
-    apache_errors_file=$(file_path_in_log_dir "apache-errors.log")
-    if [ -f "${apache_errors_file}" ]; then
-        echo ""
-        echo "**Apache errors**"
-        echo ""
-        cat "${apache_errors_file}"
-    fi
-
-    nginx_errors_file=$(file_path_in_log_dir "nginx-errors.log")
-    if [ -f "${nginx_errors_file}" ]; then
-        echo ""
-        echo "**Nginx errors**"
-        echo ""
-        cat "${nginx_errors_file}"
-    fi
-}
-
-format_mail_internal() {
-    cat <<EOTEMPLATE
-From: AutoSysadmin Evolix <${EMAIL_FROM}>
-Content-Type: text/plain; charset=UTF-8
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-X-Script: ${PROGNAME}
-X-RunId: ${RUN_ID}
-To: ${EMAIL_INTERNAL}
-Subject: [autosysadmin] Rapport interne d'intervention sur ${HOSTNAME_TEXT}
-
-Bonjour,
-
-Une intervention automatique vient de se terminer.
-
-Nom du serveur : ${HOSTNAME_TEXT}
-Heure d'intervention : $(LC_ALL=fr_FR.utf8 date)
-Script déclenché : ${PROGNAME}
-
-### Actions réalisées
-
-$(print_actions "Aucune")
-
-### Raison(s) de l'interruption
-
-$(print_abort_reasons "Aucune")
-
-### Log autosysadmin
-
-$(print_main_log)
-
-### Informations additionnelles
-
-$(print_report_information)
-
--
-Votre AutoSysadmin
-EOTEMPLATE
-}
-
-# Generic function to send emails at the end of the script.
-# Takes a template as 1st parameter
-hook_mail() {
-    if is_debug; then
-        log_run "Debug mode enabled: continue without sending mail."
-        return 0;
-    fi
-
-    HOSTNAME="${HOSTNAME:-"$(get_fqdn)"}"
-    HOSTNAME_TEXT="$(get_complete_hostname)"
-    EMAIL_CLIENT="$(get_evomaintenance_mail)"
-    EMERGENCY_MAIL="$(get_evomaintenance_emergency_mail)"
-    EMERGENCY_TEL="$(get_evomaintenance_emergency_tel)"
-
-    MAIL_CONTENT="$(format_mail_"$1")"
-
-    SENDMAIL_BIN="$(command -v sendmail)"
-
-    if [ -z "${SENDMAIL_BIN}" ]; then
-        log_global "ERROR: No \`sendmail' command has been found, can't send mail."
-    fi
-    if [ -x "${SENDMAIL_BIN}" ]; then
-        echo "${MAIL_CONTENT}" | "${SENDMAIL_BIN}" -oi -t -f "equipe@evolix.fr"
-        log_global "Sent '$1' mail for RUN_ID: ${RUN_ID}"
-    fi
-}
-
-is_holiday() {
-    # gcal mark today as a holiday by surrounding with < and > the day
-    # of the month of that holiday line.  For example if today is 2022-05-01 we'll
-    # get among other lines:
-    # Fête du Travail (FR)                    + Di, < 1>Mai 2022
-    # Jour de la Victoire (FR)                + Di, : 8:Mai 2022 =   +7 jours
-    LANGUAGE=fr_FR.UTF-8 TZ=Europe/Paris gcal --cc-holidays=fr --holiday-list=short | grep -E '<[0-9 ]{2}>' --quiet
-}
-
-is_weekend() {
-    day_of_week=$(date +%u)
-    if [ "${day_of_week}" != 6 ] && [ "${day_of_week}" != 7 ]; then
-        return 1
-    fi
-}
-
-is_workday() {
-    if is_holiday || is_weekend; then
-        return 1
-    fi
-}
-
-is_worktime() {
-    if ! is_workday; then
-        return 1
-    fi
-
-    hour=$(date +%H)
-    if [ "${hour}" -lt 9 ] || { [ "${hour}" -ge 12 ] && [ "${hour}" -lt 14 ] ; } || [ "${hour}" -ge 18 ]; then
-        return 1
-    fi
-}
--- a/autosysadmin-agent/files/upstream/lib/repair.sh
+++ b/autosysadmin-agent/files/upstream/lib/repair.sh
@ -1,112 +0,0 @@
-#!/bin/bash
-
-# Specific functions for "repair" scripts
-
-is_all_repair_disabled() {
-    # Fetch values from the config
-    # and if it is not defined or has no value, then assign "on"
-
-    local status=${repair_all:=on}
-
-
-    test "${status}" = "off" || test "${status}" = "0"
-}
-
-is_current_repair_disabled() {
-    # Fetch values from the config
-    # and if it is not defined or has no value, then assign "on"
-
-    local status=${!PROGNAME:=on}
-
-    test "${status}" = "off" || test "${status}" = "0"
-}
-
-ensure_not_disabled_or_exit() {
-    if is_all_repair_disabled; then
-        log_global 'All repair scripts are disabled.'
-        exit 0
-    fi
-    if is_current_repair_disabled; then
-        log_global "Current repair script (${PROGNAME}) is disabled."
-        exit 0
-    fi
-}
-
-# Set of actions to do at the begining of a "repair" script
-pre_repair() {
-    initialize
-
-    # Are we supposed to run?
-    ensure_not_disabled_or_exit
-
-    # Has it recently been run?
-    ensure_not_too_soon_or_exit
-
-    # Can we acquire a lock?
-    acquire_lock_or_exit
-
-    # Is there any active user?
-    ensure_no_active_users_or_exit
-
-    # Save important information
-    save_server_state
-}
-
-# Set of actions to do at the end of a "repair" script
-post_repair() {
-    quit
-}
-
-repair_lxc_php() {
-    container_name=$1
-
-    if is_systemd_enabled 'lxc.service'; then
-        lxc_path=$(lxc-config lxc.lxcpath)
-        if lxc-info --name "${container_name}" > /dev/null; then
-            rootfs="${lxc_path}/${container_name}/rootfs"
-            case "${container_name}" in
-                php56) fpm_log_file="${rootfs}/var/log/php5-fpm.log"   ;;
-                php70) fpm_log_file="${rootfs}/var/log/php7.0-fpm.log" ;;
-                php73) fpm_log_file="${rootfs}/var/log/php7.3-fpm.log" ;;
-                php74) fpm_log_file="${rootfs}/var/log/php7.4-fpm.log" ;;
-                php80) fpm_log_file="${rootfs}/var/log/php8.0-fpm.log" ;;
-                php81) fpm_log_file="${rootfs}/var/log/php8.1-fpm.log" ;;
-                php82) fpm_log_file="${rootfs}/var/log/php8.2-fpm.log" ;;
-                php83) fpm_log_file="${rootfs}/var/log/php8.3-fpm.log" ;;
-                *)
-                    log_abort_and_quit "Unknown container '${container_name}'" 
-                ;;
-            esac
-
-            # Determine FPM Pool path
-            php_path_pool=$(find "${lxc_path}/${container_name}/" -type d -name "pool.d")
-
-            # Save LXC info (before restart)
-            lxc-info --name "${container_name}" | save_in_log_dir "lxc-${container_name}.before.status"
-            # Save last lines of FPM log (before restart)
-            tail "${fpm_log_file}" | save_in_log_dir "$(basename "${fpm_log_file}" | sed -e 's/.log/.before.log/')"
-            # Save NRPE check (before restart)
-            /usr/local/lib/nagios/plugins/check_phpfpm_multi "${php_path_pool}" | save_in_log_dir "check_fpm_${container_name}.before.out"
-
-            lxc-stop --timeout 20 --name "${container_name}"
-            lxc-start --daemon --name "${container_name}"
-            rc=$?
-            if [ "${rc}" -eq "0" ]; then
-                log_all "Restart LXC container '${container_name}: OK"
-            else
-                log_all "Restart LXC container '${container_name}: failed"
-            fi
-
-            # Save LXC info (after restart)
-            lxc-info --name "${container_name}" | save_in_log_dir "lxc-${container_name}.after.status"
-            # Save last lines of FPM log (after restart)
-            tail "${fpm_log_file}" | save_in_log_dir "$(basename "${fpm_log_file}" | sed -e 's/.log/.after.log/')"
-            # Save NRPE check (after restart)
-            /usr/local/lib/nagios/plugins/check_phpfpm_multi "${php_path_pool}" | save_in_log_dir "check_fpm_${container_name}.after.out"
-        else
-            log_abort_and_quit "LXC container '${container_name}' doesn't exist."
-        fi
-    else
-        log_abort_and_quit 'LXC not found.'
-    fi
-}
--- a/autosysadmin-agent/files/upstream/lib/restart.sh
+++ b/autosysadmin-agent/files/upstream/lib/restart.sh
@ -1,76 +0,0 @@
-#!/bin/bash
-
-# Specific functions for "restart" scripts
-
-running_custom() {
-    # Placeholder that returns 1, to prevent running if not redefined
-    log_global "running_custom() function has not been redefined! Let's quit." 
-    return 1
-}
-
-# Examine RUNNING variable and decide if the script should run or not
-is_supposed_to_run() {
-    if is_debug; then return 0; fi
-
-    case ${RUNNING} in
-    never)
-        # log_global "is_supposed_to_run: no (never)"
-        return 1
-        ;;
-    always)
-        # log_global "is_supposed_to_run: yes (always)"
-        return 0
-        ;;
-    nwh-fr)
-        ! is_worktime
-        rc=$?
-        # if [ ${rc} -eq 0 ]; then
-        #     log_global "is_supposed_to_run: yes (nwh-fr returned ${rc})"
-        # else
-        #     log_global "is_supposed_to_run: no (nwh-fr returned ${rc})"
-        # fi
-        return ${rc} 
-        ;;
-    nwh-ca)
-        # Not implemented yet
-        return 0
-        ;;
-    custom)
-        running_custom
-        rc=$?
-        # if [ ${rc} -eq 0 ]; then
-        #     log_global "is_supposed_to_run: yes (custom returned ${rc})"
-        # else
-        #     log_global "is_supposed_to_run: no (custom returned ${rc})"
-        # fi
-        return ${rc} 
-        ;;
-    esac
-}
-
-ensure_supposed_to_run_or_exit() {
-    if ! is_supposed_to_run; then
-        # simply quit (no logging, no notifications…)
-        # log_global "${PROGNAME} is not supposed to run (RUNNING=${RUNNING})."
-        exit 0
-    fi
-}
-
-# Set of actions to do at the begining of a "restart" script
-pre_restart() {
-    initialize
-
-    # Has it recently been run?
-    ensure_not_too_soon_or_exit
-
-    # Can we acquire a lock?
-    acquire_lock_or_exit
-
-    # Save important information
-    save_server_state
-}
-
-# Set of actions to do at the end of a "restart" script
-post_restart() {
-    quit
-}
--- a/autosysadmin-agent/files/upstream/repair/repair_disk
+++ b/autosysadmin-agent/files/upstream/repair/repair_disk
@ -1,157 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-
-# We always keep some reserved blocks to avoid missing some logs
-# https://gitea.evolix.org/evolix/autosysadmin/issues/22
-RESERVED_BLOCKS_MIN=1
-
-get_mountpoints() {
-    # the $(...) get the check_disk1 command
-    # the cut command selects the critical part of the check_disk1 output
-    # the grep command extracts the mountpoints and available disk space
-    # the last cut command selects the mountpoints
-    check_disk1_command=$(grep check_disk1 /etc/nagios/nrpe.d/evolix.cfg | cut -d'=' -f2-)
-    
-    ${check_disk1_command} -e | cut -d'|' -f1 | grep --extended-regexp --only-matching '/[[:graph:]]* [0-9]+ [A-Z][A-Z]' | cut -d' ' -f1
-}
-
-is_reserved_blocks_nominal() {
-    partition=${1}
-
-    fs_type="$(findmnt -n --output=fstype "${partition}")"
-    if [ "${fs_type}" = "ext4" ]; then
-        device="$(findmnt -n --output=source "${partition}")"
-        reserved_block_count="$(tune2fs -l "${device}" | grep 'Reserved block count' | awk -F':' '{ gsub (" ", "", $0); print $2}')"
-        block_count="$(tune2fs -l "${device}" | grep 'Block count' | awk -F':' '{ gsub (" ", "", $0); print $2}')"
-        percentage=$(awk "BEGIN { pc=100*${reserved_block_count}/${block_count}; i=int(pc); print (pc-i<0.5)?i:i+1 }")
-
-        log_run "Reserved blocks for ${partition} is currently at ${percentage}%"
-        if [ "${percentage}" -gt "${RESERVED_BLOCKS_MIN}" ]; then
-            log_run "Allowing tune2fs action to reduce the number of reserved blocks"
-            return 0
-        else
-            log_run "Reserved blocks already at or bellow ${RESERVED_BLOCKS_MIN}%, no automatic action possible"
-            return 1
-        fi
-    else
-        log_run "Filesystem for ${partition} (${fs_type}) is incompatible with reserved block reduction."
-        return 1
-    fi
-}
-
-reduce_reserved_blocks() {
-    partition=${1}
-
-    device=$(findmnt -n --output=source "${partition}")
-    tune2fs -m "${RESERVED_BLOCKS_MIN}" "${device}"
-    log_action "Reserved blocks for ${partition} changed to ${RESERVED_BLOCKS_MIN} percent"
-}
-
-is_tmp_to_delete() {
-    size="$(find /var/log/ -type f -ctime +1 -exec du {} \+ | awk '{s+=$1}END{print s / 1024}')"
-    if [ -n "${size}" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-is_log_to_delete() {
-    size="$(find /var/log/ -type f -mtime +365 -exec du {} \+ | awk '{s+=$1}END{print s / 1024}')"
-    if [ -n "${size}" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-clean_apt_cache() {
-    for container in $(lxc-ls -1); do
-        if [ -e "$(lxc-config lxc.lxcpath)/${container}/rootfs/var/cache" ]; then
-            lxc-attach --name "${container}" -- apt-get clean
-            log_action "Clean apt cache in LXC container ${container}";
-        fi
-    done
-
-    # NOTE: "head -n 1" might be superfluous, but let's be sure to have only the first returned value
-    biggest_subdir=$(du --summarize --one-file-system "/var/*" | sort --numeric-sort --reverse | sed 's/^[0-9]\+[[:space:]]\+//;q' | head -n 1)
-    case "${biggest_subdir}" in
-        '/var/cache')
-            apt-get clean
-            log_action 'Clean apt cache'
-        ;;
-    esac
-}
-
-clean_amavis_virusmails() {
-    if du --inodes /var/lib/* | sort --numeric-sort | tail -n 3 | grep --quiet 'virusmails$'; then
-        find /var/lib/amavis/virusmails/ -type f -atime +30 -delete
-        log_action 'Clean amavis infected mails'
-    fi
-}
-
-critical_mountpoints=$(get_mountpoints)
-
-if [ -z "${critical_mountpoints}" ]; then
-    log_abort_and_quit "No partition is in critical state, nothing left to do."
-else
-    for mountpoint in ${critical_mountpoints}; do
-        case "${mountpoint}" in
-        /var)
-            #if is_log_to_delete
-            #then
-            #    find /var/log/ -type f -mtime +365 -delete
-            #    log_action "$size Mo of disk space freed in /var"
-            #fi
-            if is_reserved_blocks_nominal /var; then
-                reduce_reserved_blocks /var
-                clean_apt_cache
-                clean_amavis_virusmails
-            fi
-            ;;
-        /tmp)
-            #if is_tmp_to_delete
-            #then
-            #    find /tmp/ -type f -ctime +1 -delete
-            #    log_action "$size Mo of disk space freed in /tmp"
-            #fi
-            if is_reserved_blocks_nominal /tmp; then
-                reduce_reserved_blocks /tmp
-            fi
-            ;;
-        /home)
-            if is_reserved_blocks_nominal /home; then
-                reduce_reserved_blocks /home
-            fi
-            ;;
-        /srv)
-            if is_reserved_blocks_nominal /srv; then
-                reduce_reserved_blocks /srv
-            fi
-            ;;
-        /filer)
-            if is_reserved_blocks_nominal /filer; then
-                reduce_reserved_blocks /filer
-            fi
-            ;;
-        /)
-            if is_reserved_blocks_nominal /; then
-                reduce_reserved_blocks /
-                # Suggest remove old kernel ?
-            fi
-            ;;
-        *)
-            # unknown
-            log_run 'Unknown partition (or weird case) or nothing to do'
-            ;;
-        esac
-    done
-fi
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_elasticsearch
+++ b/autosysadmin-agent/files/upstream/repair/repair_elasticsearch
@ -1,35 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-service="elasticsearch.service"
-service_name="elasticsearch"
-
-if is_systemd_enabled "${service}"; then
-    if is_systemd_active "${service}"; then
-        log_abort_and_quit "${service} is active, nothing left to do."
-    else
-        # Save service status before restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-        # Try to restart
-        timeout 20 systemctl restart "${service}" > /dev/null
-        rc=$?
-        if [ "${rc}" -eq "0" ]; then
-            log_action "Restart ${service_name}: OK"
-        else
-            log_action "Restart ${service_name}: failed"
-        fi
-
-        # Save service status after restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-    fi
-else
-    log_abort_and_quit "${service} is disabled (or missing), nothing left to do."
-fi
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_http
+++ b/autosysadmin-agent/files/upstream/repair/repair_http
@ -1,131 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-## Apache
-
-service="apache2.service"
-service_name="apache2"
-
-if is_systemd_enabled "${service}"; then
-    if is_systemd_active "${service}"; then
-        log_all "${service} is active. Skip."
-    else
-        # Save service status before restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-        # check syntax
-        if apache2ctl -t > /dev/null 2>&1; then
-            # Try to restart
-            timeout 20 systemctl restart "${service}" > /dev/null
-            rc=$?
-            if [ "${rc}" -eq "0" ]; then
-                log_action "Restart ${service_name}: OK"
-            else
-                log_action "Restart ${service_name}: failed"
-            fi
-
-            # Save service status after restart
-            systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-
-            # Save error logs
-            date=$(LANG=en_US.UTF-8 date '+%b %d')
-            grep "${date}" /home/*/log/error.log /var/log/apache2/*error.log \
-                | grep -v \
-                -e "Got error 'PHP message:" \
-                -e "No matching DirectoryIndex" \
-                -e "client denied by server configuration" \
-                -e "server certificate does NOT include an ID which matches the server name" \
-                    | save_in_log_dir "apache-errors.log"
-        else
-            log_action "Restart ${service_name}: skip (invalid configuration)"
-        fi
-    fi
-else
-    log_all "${service} is disabled (or missing). Skip."
-fi
-
-## Nginx
-
-service="nginx.service"
-service_name="nginx"
-
-if is_systemd_enabled "${service}"; then
-    if is_systemd_active "${service}"; then
-        log_all "${service} is active. Skip."
-    else
-        # Save service status before restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-        # check syntax
-        if nginx -t > /dev/null 2>&1; then
-            # Try to restart
-            timeout 20 systemctl restart "${service}" > /dev/null
-            rc=$?
-            if [ "${rc}" -eq "0" ]; then
-                log_action "Restart ${service_name}: OK"
-            else
-                log_action "Restart ${service_name}: failed"
-            fi
-
-            # Save service status after restart
-            systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-
-            # Save error logs
-            ### Consider doing for Nginx the same as Apache
-        else
-            log_action "Restart ${service_name}: skip (invalid configuration)"
-        fi
-    fi
-else
-    log_all "${service} is disabled (or missing). Skip."
-fi
-
-## LXC
-
-if is_systemd_enabled 'lxc.service'; then
-    for container in $(lxc-ls -1 | grep --fixed-strings 'php' | grep --extended-regexp --invert-match --regexp '\bold\b' --regexp '\bdisabled\b'); do
-        repair_lxc_php "${container}"
-    done
-else
-    log_all "LXC is disabled (or missing). Skip."
-fi
-
-## FPM
-
-fpm_services=$(systemd_list_services 'php*-fpm*')
-if [ -n "${fpm_services}" ]; then
-    for service in ${fpm_services}; do
-        service_name="${service//.service/}"
-        if is_systemd_enabled "${service}"; then
-            if is_systemd_active "${service}"; then
-                log_all "${service} is active. Skip."
-            else
-                # Save service status before restart
-                systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-                # Try to restart
-                timeout 20 systemctl restart "${service}" > /dev/null
-                rc=$?
-                if [ "${rc}" -eq "0" ]; then
-                    log_action "Restart ${service_name}: OK"
-                else
-                    log_action "Restart ${service_name}: failed"
-                fi
-
-                # Save service status after restart
-                systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-            fi
-        else
-            log_all "${service} is disabled (or missing). Skip."
-        fi
-    done
-else
-    log_all "PHP FPM not found. Skip."
-fi
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_mysql
+++ b/autosysadmin-agent/files/upstream/repair/repair_mysql
@ -1,69 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-if is_debian_version "8" "<="; then
-
-    if is_sysvinit_enabled '*mysql*'; then
-        if ! pgrep -u mysql mysqld > /dev/null; then
-
-            # Save service status before restart
-            timeout 2 mysqladmin status 2>&1 | save_in_log_dir "mysql.before.status"
-
-            timeout 20 /etc/init.d/mysql restart > /dev/null
-            rc=$?
-            if [ "${rc}" -eq "0" ]; then
-                log_action "Restart mysql: OK"
-            else
-                log_action "Restart mysql: failed"
-            fi
-
-            # Save service status after restart
-            timeout 2 mysqladmin status 2>&1 | save_in_log_dir "mysql.after.status"
-        else
-            log_abort_and_quit "mysqld process alive. Aborting"
-        fi
-    else
-        log_abort_and_quit "MySQL not enabled. Aborting"
-    fi
-
-else
-
-    if is_debian_version "12" ">="; then
-        service="mariadb.service"
-        service_name="mariadb"
-    else
-        service="mysql.service"
-        service_name="mysql"
-    fi
-
-    if is_systemd_enabled "${service}"; then
-        if is_systemd_active "${service}"; then
-            log_abort_and_quit "${service} is active, nothing left to do."
-        else
-            # Save service status before restart
-            systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-            # Try to restart
-            timeout 20 systemctl restart "${service}" > /dev/null
-            rc=$?
-            if [ "${rc}" -eq "0" ]; then
-                log_action "Restart ${service_name}: OK"
-            else
-                log_action "Restart ${service_name}: failed"
-            fi
-
-            # Save service status after restart
-            systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-        fi
-    else
-        log_abort_and_quit "${service} is disabled (or missing), nothing left to do."
-    fi
-
-fi
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_opendkim
+++ b/autosysadmin-agent/files/upstream/repair/repair_opendkim
@ -1,35 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-service="opendkim.service"
-service_name="opendkim"
-
-if is_systemd_enabled "${service}"; then
-    if is_systemd_active "${service}"; then
-        log_abort_and_quit "${service} is active, nothing left to do."
-    else
-        # Save service status before restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-        # Try to restart
-        timeout 20 systemctl restart "${service}" > /dev/null
-        rc=$?
-        if [ "${rc}" -eq "0" ]; then
-            log_action "Restart ${service_name}: OK"
-        else
-            log_action "Restart ${service_name}: failed"
-        fi
-
-        # Save service status after restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-    fi
-else
-    log_abort_and_quit "${service} is disabled (or missing). Abort."
-fi
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm56
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm56
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php56
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm70
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm70
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php70
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm73
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm73
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php73
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm74
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm74
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php74
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm80
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm80
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php80
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm81
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm81
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php81
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm82
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm82
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php82
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_php_fpm83
+++ b/autosysadmin-agent/files/upstream/repair/repair_php_fpm83
@ -1,14 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-LOCK_WAIT="15s"
-LOCK_NAME="repair_http"
-
-pre_repair
-
-repair_lxc_php php83
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_redis
+++ b/autosysadmin-agent/files/upstream/repair/repair_redis
@ -1,32 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-for service in $(systemd_list_services 'redis-server*'); do
-    service_name="${service//.service/}"
-
-    if is_systemd_active "${service}"; then
-        log_all "${service} is active. Skip."
-    else
-        # Save service status before restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.before.status"
-
-        # Try to restart
-        timeout 20 systemctl restart "${service}" > /dev/null
-        rc=$?
-        if [ "${rc}" -eq "0" ]; then
-            log_action "Restart ${service_name}: OK."
-        else
-            log_action "Restart ${service_name}: failed."
-        fi
-
-        # Save service status after restart
-        systemctl status "${service}" | save_in_log_dir "${service_name}.after.status"
-    fi
-done
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/repair_tomcat_instance
+++ b/autosysadmin-agent/files/upstream/repair/repair_tomcat_instance
@ -1,34 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-pre_repair
-
-repair_tomcat_instance_handle_tomcat() {
-
-    if /bin/su - "${1}" -c "/bin/systemctl --quiet --user is-active tomcat.service" ; then
-        if ! /bin/su - "${1}" -c "/usr/bin/timeout 20 /bin/systemctl --quiet --user restart tomcat.service"
-        then
-            log_abort_and_quit "Echec de redémarrage instance tomcat utilisateur ${1}"
-        else
-            log_action "Redémarrage instance tomcat utilisateur ${1}"
-        fi
-    elif /bin/systemctl --quiet is-active "${1}".service ; then
-        if ! /usr/bin/timeout 20 systemctl --quiet restart "${1}".service
-        then
-            log_abort_and_quit "Echec de redémarrage instance tomcat ${1}"
-        else
-            log_action "Redémarrage instance tomcat ${1}"
-        fi
-    fi
-
-}
-
-for instance in $( /usr/local/lib/nagios/plugins/check_tomcat_instance.sh |grep CRITICAL |awk '{print $3}' |sed '1d') ;
-do
-    repair_tomcat_instance_handle_tomcat "${instance}"
-done
-
-post_repair
--- a/autosysadmin-agent/files/upstream/repair/zzz-repair_example.template
+++ b/autosysadmin-agent/files/upstream/repair/zzz-repair_example.template
@ -1,41 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh" || exit 1
-source "${AUTOSYSADMIN_LIB}/repair.sh" || exit 1
-
-## Custom lock wait and/or lock name
-# LOCK_WAIT="15s"
-# LOCK_NAME="repair_http"
-
-pre_repair
-
-## The name of the service, mainly for logging
-service_name="example"
-## The systemd service name
-systemd_service="${service_name}.service"
-
-if is_systemd_enabled "${systemd_service}"; then
-    if is_systemd_active "${systemd_service}"; then
-        log_abort_and_quit "${systemd_service} is active, nothing left to do."
-    else
-        # Save service status before restart
-        systemctl status "${systemd_service}" | save_in_log_dir "${service_name}.before.status"
-
-        # Try to restart
-        timeout 20 systemctl restart "${systemd_service}" > /dev/null
-        rc=$?
-        if [ "${rc}" -eq "0" ]; then
-            log_action "Restart ${service_name}: OK"
-        else
-            log_action "Restart ${service_name}: failed"
-        fi
-
-        # Save service status after restart
-        systemctl status "${systemd_service}" | save_in_log_dir "${service_name}.after.status"
-    fi
-else
-    log_abort_and_quit "${service_name} is disabled (or missing), nothing left to do."
-fi
-
-post_repair
--- a/autosysadmin-agent/files/upstream/restart/README
+++ b/autosysadmin-agent/files/upstream/restart/README
@ -1,19 +0,0 @@
-Autosysadmin "restart auto" scripts
-===================================
-
-In this directory you can place scripts that will be executed automatically by a cron job (stored in `/etc/cron.d/autosysadmin`).
-
-They must satisfy the default `run-parts(8)` constraints :
-
-* be "executable"
-* belong to the Debian cron script namespace (`^[a-zA-Z0-9_-]+$`), example: `restart_amavis`
-
-Warning: scripts that do not satisfy those criteria will NOT be run (silently)!
-
-You can print the names of the scripts which would be run, without actually running them, with this command :
-
-```
-$ run-parts --test /usr/share/scripts/autosysadmin/restart
-```
-
-You can use `zzz-restart_example.template` as boilerplate code to make your own "restart" script.
--- a/autosysadmin-agent/files/upstream/restart/zzz-restart_example.template
+++ b/autosysadmin-agent/files/upstream/restart/zzz-restart_example.template
@ -1,120 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh"  || exit 1
-source "${AUTOSYSADMIN_LIB}/restart.sh" || exit 1
-
-# shellcheck disable=SC2034
-RUNNING="nwh-fr"
-
-## Possible values for RUNNING :
-##   never    => disabled
-##   always   => enabled
-##   nwh-fr   => enabled during non-working-hours in France
-##   nwh-ca   => enabled during non-working-hours in Canada (not supported yet)
-##   custom   => enabled if `running_custom()` function returns 0, otherwise disabled.
-
-## Uncomment and customize this method if you want to have a special logic :
-##
-##   return 1 if we should not run
-##   return 0 if we should run
-##
-## Some available functions :
-##   is_weekend()  : Saturday or Sunday
-##   is_holiday()  : holiday in France (based on `gcal(1)`)
-##   is_workday()  : not weekend and not holiday
-##   is_worktime() : work day between 9-12h and 14-18h
-#
-# running_custom() {
-#     # implement your own custom method to decide if we should run or not
-# }
-
-## The name of the service, mainly for logging
-service_name="example"
-## The SysVinit script name
-sysvinit_script="${service_name}"
-## The systemd service name
-systemd_service="${service_name}.service"
-
-is_service_alive() {
-    ## this must return 0 if the service is alive, otherwise return 1
-    ## Example:
-    pgrep -u USER PROCESS_NAME > /dev/null
-}
-
-## Action for SysVinit system
-sysvinit_action() {
-    # Save service status before restart
-    timeout 2 "/etc/init.d/${sysvinit_script}" status | save_in_log_dir "${service_name}.before.status"
-
-    # Try to restart
-    timeout 20 "/etc/init.d/${sysvinit_script}" restart > /dev/null
-    rc=$?
-    if [ "${rc}" -eq "0" ]; then
-        log_action "Restart ${service_name}: OK"
-    else
-        log_action "Restart ${service_name}: failed"
-    fi
-
-    # Save service status after restart
-    timeout 2 "/etc/init.d/${sysvinit_script}" status | save_in_log_dir "${service_name}.after.status"
-}
-
-## Action for systemd system
-systemd_action() {
-    # Save service status before restart
-    systemctl status "${systemd_service}" | save_in_log_dir "${service_name}.before.status"
-
-    # Try to restart
-    # systemctl (only for NRPE ?) sometimes returns 0 even if the service has failed to start
-    # so we check the status explicitly
-    timeout 20 systemctl restart "${systemd_service}" > /dev/null \
-        && sleep 1 \
-        && systemctl status "${systemd_service}" > /dev/null
-    rc=$?
-    if [ "${rc}" -eq "0" ]; then
-        log_action "Restart ${service_name}: OK"
-    else
-        log_action "Restart ${service_name}: failed"
-    fi
-
-    # Save service status after restart
-    systemctl status "${systemd_service}" | save_in_log_dir "${service_name}.after.status"
-}
-
-# Should we run?
-if ! is_supposed_to_run; then
-    # log_global "${PROGNAME} is not supposed to run (RUNNING=${RUNNING})."
-    exit 0
-fi
-if is_service_alive; then
-    # log_global "${service_name} process alive. Aborting"
-    exit 0
-fi
-
-# Yes we do, so check for sysvinit or systemd
-if is_debian_version "8" "<="; then
-    if ! is_sysvinit_enabled "*${sysvinit_script}*"; then
-        # log_global "${service_name} not enabled. Aborting"
-        exit 0
-    fi
-
-    # Let's finally do the action
-    pre_restart
-    sysvinit_action
-    post_restart
-else
-    if ! is_systemd_enabled "${systemd_service}"; then
-        # log_global "${service_name} is disabled (or missing), nothing left to do."
-        exit 0
-    fi
-    if is_systemd_active "${systemd_service}"; then
-        # log_global "${service_name} is active, nothing left to do."
-        exit 0
-    fi
-
-    # Let's finally do the action
-    pre_restart
-    systemd_action
-    post_restart
-fi
--- a/autosysadmin-agent/handlers/main.yml
+++ b/autosysadmin-agent/handlers/main.yml
@ -1,16 +0,0 @@
---
-
- name: restart nagios-nrpe-server
-  service:
-    name: nagios-nrpe-server
-    state: restarted
-
- name: restart nrpe
-  service:
-    name: nrpe
-    state: restarted
-
- name: restart rsyslog
-  service:
-    name: rsyslog
-    state: restarted
--- a/autosysadmin-agent/tasks/crontab.yml
+++ b/autosysadmin-agent/tasks/crontab.yml
@ -1,25 +0,0 @@
---
-
- name: "Add begin marker if missing"
-  ansible.builtin.lineinfile:
-    path: "/etc/cron.d/autosysadmin"
-    line: "# BEGIN ANSIBLE MANAGED SECTION FOR AUTOSYSADMIN"
-    insertbefore: BOF
-    create: yes
-
- name: "Add end marker if missing"
-  ansible.builtin.lineinfile:
-    path: "/etc/cron.d/autosysadmin"
-    line: "# END ANSIBLE MANAGED SECTION FOR AUTOSYSADMIN"
-    insertbefore: "EOF"
-    create: yes
-
- name: "Create config if missing"
-  ansible.builtin.blockinfile:
-    path: "/etc/cron.d/autosysadmin"
-    marker: "# {mark} ANSIBLE MANAGED SECTION FOR AUTOSYSADMIN"
-    block: "{{ lookup('ansible.builtin.template', '../templates/autosysadmin.cron.j2') }}"
-    owner: root
-    group: root
-    mode: "0750"
-    create: yes
--- a/autosysadmin-agent/tasks/dependencies.yml
+++ b/autosysadmin-agent/tasks/dependencies.yml
@ -1,4 +0,0 @@
---
- name: Install gcal
-  ansible.builtin.apt:
-    name: gcal
--- a/autosysadmin-agent/tasks/install.yml
+++ b/autosysadmin-agent/tasks/install.yml
@ -1,114 +0,0 @@
---
- name: "Remount /usr if needed"
-  ansible.builtin.include_role:
-    name: remount-usr
-
- name: Previous autosysadmin restart directory is renamed
-  command:
-    cmd: mv "/usr/share/scripts/autosysadmin/auto" "{{ autosysadmin_agent_auto_dir }}"
-    removes: "/usr/share/scripts/autosysadmin/auto"
-    creates: "{{ autosysadmin_agent_auto_dir }}" 
-
- name: Create autosysadmin directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "root"
-    group: "root"
-    mode: "0750"
-  loop:
-    - "{{ autosysadmin_agent_bin_dir }}"
-    - "{{ autosysadmin_agent_lib_dir }}"
-    - "{{ autosysadmin_agent_auto_dir }}"
-
- name: Copy libraries
-  ansible.builtin.copy:
-    src: "upstream/lib/"
-    dest: "{{ autosysadmin_agent_lib_dir }}/"
-    owner: root
-    group: root
-    mode: "0750"
-
- name: Copy repair scripts
-  ansible.builtin.copy:
-    src: "upstream/repair/"
-    dest: "{{ autosysadmin_agent_bin_dir }}/"
-    owner: root
-    group: root
-    mode: "0750"
-
- name: Copy other utilities
-  ansible.builtin.copy:
-    src: "upstream/bin/"
-    dest: "{{ autosysadmin_agent_bin_dir }}/"
-    owner: root
-    group: root
-    mode: "0750"
-
-### WARNING: thos files are explicitly marked as non-executable
-### to prevent them from being run automatically by run-parts
-
- name: Copy restart scripts
-  ansible.builtin.copy:
-    src: "upstream/restart/"
-    dest: "{{ autosysadmin_agent_auto_dir }}/"
-    owner: root
-    group: root
-    mode: "0640"
-
- name: Ensure /etc/evolinux folder exists
-  ansible.builtin.file:
-    path: "/etc/evolinux"
-    state: directory
-    owner: "root"
-    group: "root"
-    mode: "0700"
-
- name: Copy the configuration file if missing
-  ansible.builtin.template:
-    src: "autosysadmin.cf.j2"
-    dest: "/etc/evolinux/autosysadmin"
-    owner: root
-    group: root
-    mode: "0640"
-    force: no
-
-# Repair scripts are supposed to be 'on' by default
-# A line "repair_XXX=off" is added to the file only if the script is to be disabled.
-# That's why all the ternary logic for the state is reversed.
- name: Update value per variable
-  ansible.builtin.lineinfile:
-    dest: "/etc/evolinux/autosysadmin"
-    line: "{{ item }}={{ autosysadmin_config[item] | default(true) | bool | ternary('on', 'off') }}"
-    regexp: '^(#\s*)?{{ item }}=.*'
-    state: "{{ autosysadmin_config[item] | default(true) | bool | ternary('absent', 'present') }}"
-  register: _line
-  loop: "{{ autosysadmin_repair_scripts | union(['repair_all']) }}"
-
- name: Ensure restart folder exists
-  ansible.builtin.file:
-    path: "auto"
-    state: directory
-    owner: "root"
-    group: "root"
-    mode: "0700"
-
- name: Legacy scripts are removed
-  ansible.builtin.file:
-    path: "{{ general_scripts_dir }}/autosysadmin/{{ item }}"
-    state: absent
-  loop:
-    - repair_amavis.sh
-    - repair_disk.sh
-    - repair_elasticsearch.sh
-    - repair_http.sh
-    - repair_mysql.sh
-    - repair_opendkim.sh
-    - repair_php_fpm56.sh
-    - repair_php_fpm70.sh
-    - repair_php_fpm73.sh
-    - repair_php_fpm74.sh
-    - repair_php_fpm80.sh
-    - repair_php_fpm81.sh
-    - repair_redis.sh
-    - repair_tomcat_instance.sh
--- a/autosysadmin-agent/tasks/logrotate.yml
+++ b/autosysadmin-agent/tasks/logrotate.yml
@ -1,8 +0,0 @@
---
- name: Copy logrotate configuration for autosysadmin
-  ansible.builtin.copy:
-    src: "files/autosysadmin.logrotate.conf"
-    dest: "/etc/logrotate.d/autosysadmin"
-    owner: root
-    group: root
-    mode: "0644"
--- a/autosysadmin-agent/tasks/main.yml
+++ b/autosysadmin-agent/tasks/main.yml
@ -1,31 +0,0 @@
---
-
- name: The list of all repair scripts is composed.
-  set_fact:
-    autosysadmin_repair_scripts: "{{ lookup('ansible.builtin.fileglob', '../../../autosysadmin/agent/repair/repair_*', wantlist=True) | map('basename') | sort }}"
-
- name: Install dependencies
-  ansible.builtin.include_tasks: dependencies.yml
-
- name: Install autosysadmin
-  ansible.builtin.include_tasks: install.yml
-
- name: Crontab configuration
-  ansible.builtin.include_tasks: crontab.yml
-
- name: NRPE configuration
-  ansible.builtin.include_tasks: nrpe.yml
-
- name: sudo configuration
-  ansible.builtin.include_tasks: sudo.yml
-
- name: rsyslog configuration
-  ansible.builtin.include_tasks: rsyslog.yml
-
- name: logrotate configuration
-  ansible.builtin.include_tasks: logrotate.yml
-
- name: Install latest version of dump-server-state
-  ansible.builtin.include_role:
-    name: evolinux-base
-    tasks_from: dump-server-state.yml
--- a/autosysadmin-agent/tasks/nrpe.yml
+++ b/autosysadmin-agent/tasks/nrpe.yml
@ -1,9 +0,0 @@
---
- name: custom configuration is present
-  ansible.builtin.template:
-    src: autosysadmin.nrpe.cfg.j2
-    dest: /etc/nagios/nrpe.d/autosysadmin.cfg
-    group: nagios
-    mode: "0640"
-    force: yes
-  notify: restart nagios-nrpe-server
--- a/autosysadmin-agent/tasks/rsyslog.yml
+++ b/autosysadmin-agent/tasks/rsyslog.yml
@ -1,9 +0,0 @@
---
- name: Copy rsyslog configuration for autosysadmin
-  ansible.builtin.copy:
-    src: "files/autosysadmin.rsyslog.conf"
-    dest: "/etc/rsyslog.d/autosysadmin.conf"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart rsyslog
--- a/autosysadmin-agent/tasks/sudo.yml
+++ b/autosysadmin-agent/tasks/sudo.yml
@ -1,7 +0,0 @@
---
- name: Add autosysadmin sudoers file
-  ansible.builtin.template:
-    src: autosysadmin.sudoers.j2
-    dest: /etc/sudoers.d/autosysadmin
-    mode: "0600"
-    validate: "visudo -cf %s"
--- a/autosysadmin-agent/templates/autosysadmin.cf.j2
+++ b/autosysadmin-agent/templates/autosysadmin.cf.j2
@ -1,12 +0,0 @@
-# This configuration is partially managed by Ansible
-# You can change specific values manually, but they may be overridden by Ansible
-# 
-# To be safe, update the hosts_vars/group_vars in the autosysadmin project
-# https://gitea.evolix.org/evolix/autosysadmin/src/branch/master
-# then use the "agent" playbook to deploy.
-#
-# Configuration for autosysadmin
-# Use this file to change configuration values defined in repair scripts
-# To disable all repair scripts : repair_all=off
-# To disable "repair_http" : repair_http=off
-#
--- a/autosysadmin-agent/templates/autosysadmin.cron.j2
+++ b/autosysadmin-agent/templates/autosysadmin.cron.j2
@ -1,7 +0,0 @@
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-
-# Run each enabled script
-*/5 * * * * root run-parts /usr/share/scripts/autosysadmin/restart
-
-# Clean run log files
-@weekly root {{ autosysadmin_agent_bin_dir | mandatory }}/delete_old_logs.sh {{ autosysadmin_agent_log_retention_days | default('365') }}
--- a/autosysadmin-agent/templates/autosysadmin.nrpe.cfg.j2
+++ b/autosysadmin-agent/templates/autosysadmin.nrpe.cfg.j2
@ -1,8 +0,0 @@
-#
-# Ansible managed - DO NOT MODIFY, your changes will be overwritten !
-#
-
-# Autosysadmin repair commands
-{% for script in lookup('ansible.builtin.fileglob', '../../../autosysadmin/agent/repair/repair_*', wantlist=True) | map("basename") | sort %}
-command[{{ script }}]=sudo {{ autosysadmin_agent_bin_dir }}/{{ script }}
-{% endfor %}
--- a/autosysadmin-agent/templates/autosysadmin.sudoers.j2
+++ b/autosysadmin-agent/templates/autosysadmin.sudoers.j2
@ -1,7 +0,0 @@
-#
-# Ansible managed - DO NOT MODIFY, your changes will be overwritten !
-#
-
-{% for script in lookup('ansible.builtin.fileglob', '../../../autosysadmin/agent/repair/repair_*', wantlist=True) | map("basename") | sort %}
-nagios          ALL = NOPASSWD: {{ autosysadmin_agent_bin_dir }}/{{ script }}
-{% endfor %}
--- a/autosysadmin-restart_nrpe/defaults/main.yml
+++ b/autosysadmin-restart_nrpe/defaults/main.yml
@ -1,8 +0,0 @@
---
-
-general_scripts_dir: "/usr/share/scripts"
-
-restart_nrpe_path: "{{ general_scripts_dir }}/autosysadmin/restart/restart_nrpe"
-
-# Change this to customize the RUNNING value in the script
-restart_nrpe_running: Null
--- a/autosysadmin-restart_nrpe/files/upstream/restart_nrpe
+++ b/autosysadmin-restart_nrpe/files/upstream/restart_nrpe
@ -1,105 +0,0 @@
-#!/bin/bash
-
-: "${AUTOSYSADMIN_LIB:=/usr/local/lib/autosysadmin}"
-source "${AUTOSYSADMIN_LIB}/common.sh"  || exit 1
-source "${AUTOSYSADMIN_LIB}/restart.sh" || exit 1
-
-## Possible values for RUNNING :
-##   never    => disabled
-##   always   => enabled
-##   nwh-fr   => enabled during non-working-hours in France
-##   nwh-ca   => enabled during non-working-hours in Canada (not supported yet)
-##   custom   => enabled if `running_custom()` function return 0, otherwise disabled.
-
-# shellcheck disable=SC2034
-RUNNING="nwh-fr"
-
-## The name of the service, mainly for logging
-service_name="nagios-nrpe-server"
-## The SysVinit script name
-sysvinit_script="${service_name}"
-## The systemd service name
-systemd_service="${service_name}.service"
-
-is_service_alive() {
-    ## this must return 0 if the service is alive, otherwise return 1
-    ## Example:
-    pgrep -u nagios nrpe > /dev/null
-}
-
-## Action for SysVinit system
-sysvinit_action() {
-    # Save service status before restart
-    timeout 2 "/etc/init.d/${sysvinit_script}" status | save_in_log_dir "${service_name}.before.status"
-
-    # Try to restart
-    timeout 20 "/etc/init.d/${sysvinit_script}" restart > /dev/null
-    rc=$?
-    if [ "${rc}" -eq "0" ]; then
-        log_action "Restart ${service_name}: OK"
-    else
-        log_action "Restart ${service_name}: failed"
-    fi
-
-    # Save service status after restart
-    timeout 2 "/etc/init.d/${sysvinit_script}" status | save_in_log_dir "${service_name}.after.status"
-}
-
-## Action for systemd system
-systemd_action() {
-    # Save service status before restart
-    systemctl status "${systemd_service}" | save_in_log_dir "${service_name}.before.status"
-
-    # Try to restart
-    # systemctl (only for NRPE ?) sometimes returns 0 even if the service has failed to start
-    # so we check the status explicitly
-    timeout 20 systemctl restart "${systemd_service}" > /dev/null \
-        && sleep 1 \
-        && systemctl status "${systemd_service}" > /dev/null
-    rc=$?
-    if [ "${rc}" -eq "0" ]; then
-        log_action "Restart ${service_name}: OK"
-    else
-        log_action "Restart ${service_name}: failed"
-    fi
-
-    # Save service status after restart
-    systemctl status "${systemd_service}" | save_in_log_dir "${service_name}.after.status"
-}
-
-# Should we run?
-if ! is_supposed_to_run; then
-    # log_global "${PROGNAME} is not supposed to run (RUNNING=${RUNNING})."
-    exit 0
-fi
-if is_service_alive; then
-    # log_global "${service_name} process alive. Aborting"
-    exit 0
-fi
-
-# Yes we do, so check for sysvinit or systemd
-if is_debian_version "8" "<="; then
-    if ! is_sysvinit_enabled "*${sysvinit_script}*"; then
-        # log_global "${service_name} not enabled. Aborting"
-        exit 0
-    fi
-
-    # Let's finally do the action
-    pre_restart
-    sysvinit_action
-    post_restart
-else
-    if ! is_systemd_enabled "${systemd_service}"; then
-        # log_global "${service_name} is disabled (or missing), nothing left to do."
-        exit 0
-    fi
-    if is_systemd_active "${systemd_service}"; then
-        # log_global "${service_name} is active, nothing left to do."
-        exit 0
-    fi
-
-    # Let's finally do the action
-    pre_restart
-    systemd_action
-    post_restart
-fi
--- a/autosysadmin-restart_nrpe/tasks/main.yml
+++ b/autosysadmin-restart_nrpe/tasks/main.yml
@ -1,24 +0,0 @@
---
-
-    - name: "Remount /usr if needed"
-      ansible.builtin.include_role:
-        name: remount-usr
-
-    - name: "Copy restart_nrpe"
-      ansible.builtin.copy:
-        src: upstream/restart_nrpe
-        dest: "{{ restart_nrpe_path }}"
-        owner: "root"
-        group: "root"
-        mode: "0750"
-
-    - name: "Customize RUNNING value"
-      ansible.builtin.lineinfile:
-        path: "{{ restart_nrpe_path }}"
-        line: "RUNNING=\"{{ restart_nrpe_running }}\""
-        regexp: "^ *RUNNING="
-        create: False
-      when:
-        - restart_nrpe_running is defined
-        - restart_nrpe_running != None
-        - restart_nrpe_running | length > 0
--- a/bind/README.md
+++ b/bind/README.md
@ -10,4 +10,4 @@ Minimal configuration is in `tasks/main.yml`

 The full list of variables (with default values) can be found in `defaults/main.yml`.

-warning : sync chroot-bind.sh
+waening : sync chroot-bind.sh
--- a/bind/files/apparmor.usr.sbin.named
+++ b/bind/files/apparmor.usr.sbin.named
@ -1,5 +0,0 @@
-/var/chroot-bind/etc/bind/** r,
-/var/chroot-bind/var/** rw,
-/var/chroot-bind/dev/** rw,
-/var/chroot-bind/run/** rw,
-/var/chroot-bind/usr/** r,
--- a/bind/files/bind-reload-zone.sh
+++ b/bind/files/bind-reload-zone.sh
@ -1,37 +0,0 @@
-#!/bin/bash
-#
-# Script utilitaire pour tester et recharger facilement une zone dans Bind
-#
-
-usage() {
-    echo "Usage: bind-reload-zone <DOMAIN>"
-    echo "       bind-reload-zone -h|--help"
-}
-
-if [ $# -ne 1 ] ; then
-    usage
-    exit 1
-fi
-
-while :; do
-    case $1 in
-        -h|--help)
-            usage
-            exit 0
-            ;;
-        *)
-            zone=$1
-            break
-            ;;
-    esac
-    shift
-done
-
-if ! [ -f "/etc/bind/db.${zone}" ]; then
-    >&2 echo "Error: zone for ${zone} not found."
-    usage
-    exit 1
-fi
-
-named-checkzone "${zone}" /etc/bind/db."${zone}" && rndc reload "${zone}"
-
--- a/bind/files/bind-reload-zone_completion.sh
+++ b/bind/files/bind-reload-zone_completion.sh
@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-_bind_reload_zone_dynamic_completion() {
-    local cur;
-    cur=${COMP_WORDS[COMP_CWORD]};
-    COMPREPLY=();
-    COMPREPLY=( $( compgen -W '$(grep -v -h '"'"'//'"'"' /etc/bind/named.conf* | grep -B1 "type master" | grep zone | grep -v arpa | awk '"'"'{gsub(/"/, "", $2); print $2}'"'"' | sort | uniq)' -- $cur ) );
-
-    # reverse ipv4 :
-    #grep -v -h '//' /etc/bind/named.conf*     | grep -B1 "type master" | grep zone | grep arpa | grep -v ip6 | awk '{gsub(/"/, "", $2); gsub(/.in-addr.arpa/, "", $2); print $2}' | sort | uniq | awk -F'.' '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1 }'
-
-    # reveres ipv6 : je bloque sur l'inversion 4 par 4
-    #grep -v -h '//' /etc/bind/named.conf* | grep -B1 "type master" | grep zone | grep arpa | grep ip6 | awk '{gsub(/"/, "", $2); gsub(/.ip6.arpa/, "", $2); print $2}' | sort | uniq | awk -F'.' '{ for (i=NF; i>1; i--) { if ($i % 4 == 0) printf("%s.",$i); else printf("%s",$i); } print $1 }'
-
-}
-
-complete -F _bind_reload_zone_dynamic_completion bind-reload-zone
-
--- a/bind/files/chroot-bind.sh
+++ b/bind/files/chroot-bind.sh
@ -3,17 +3,12 @@
 # Gregory Colpart <reg@debian.org>
 # chroot (or re-chroot) script for bind9

-# tested on Debian Wheezy/Jessie/Stretch/Buster/Bullseye/Bookworm
+# tested on Debian Wheezy/Jessie/Stretch
 # Exec this script after `(apt-get|aptitude|apt) install bind9`
 # and after *each* bind9 upgrade

 # When the script is finished, ensure you have
-# 'OPTIONS="-u bind -t /var/chroot-bind"' in /etc/default/named
-# (since Bullseye) or, until Buster, in /etc/default/bind9
-#
-# Since Bookmworm, one also needs to handle bind mount points
-# https://wiki.evolix.org/HowtoBind#bind-mount-%C3%A0-partir-de-bookworm-debian-12
-#
+# 'OPTIONS="-u bind -t /var/chroot-bind"' in /etc/default/bind9
 # and /etc/init.d/bind9 (re)start
 #
 # for Jessie/systemd only:
@ -27,10 +22,8 @@ mkdir -p /var/chroot-bind
 mkdir -p /var/chroot-bind/bin /var/chroot-bind/dev /var/chroot-bind/etc \
        /var/chroot-bind/lib /var/chroot-bind/usr/lib                   \
        /var/chroot-bind/usr/sbin /var/chroot-bind/var/cache/bind       \
-        /var/chroot-bind/var/log /var/chroot-bind/var/run/named         \
-        /var/chroot-bind/run/named /var/chroot-bind/usr/share/dns
-
-chmod 750 /var/chroot-bind
+        /var/chroot-bind/var/log /var/chroot-bind/var/run/named/        \
+        /var/chroot-bind/run/named/

 # for conf
 if [ ! -h "/etc/bind" ]; then
@ -38,11 +31,6 @@ if [ ! -h "/etc/bind" ]; then
    ln -s /var/chroot-bind/etc/bind/ /etc/bind
 fi

-# for dns
-if [ -d "/usr/share/dns" ]; then
-    cp -a /usr/share/dns/* /var/chroot-bind/usr/share/dns/
-fi
-
 # for logs
 touch /var/chroot-bind/var/log/bind.log
 if [ ! -h "/var/log/bind.log" ]; then
@ -70,16 +58,11 @@ fi
 #chmod 666 /var/chroot-bind/dev/{null,random}

 # essential libs
-for i in `ldd $(which named) | grep -v linux-vdso.so.1 | cut -d">" -f2 | cut -d"(" -f1`
-    do install -D $i /var/chroot-bind/${i##/}
+for i in `ldd $(which named) | grep -v linux-vdso.so.1 | cut -d">" -f2 | cut -d"(" -f1` \
+         /usr/lib/x86_64-linux-gnu/openssl-1.0.*/engines/libgost.so ; do
+    install -D $i /var/chroot-bind/${i##/}
 done

-if [ ls /usr/lib/x86_64-linux-gnu/openssl-1.0.*/engines/libgost.so 1>/dev/null 2>&1 ]; then
-    for i in /usr/lib/x86_64-linux-gnu/openssl-1.0.*/engines/libgost.so
-        do install -D $i /var/chroot-bind/${i##/}
-    done
-fi
-
 # essential (hum, bash is required ??)
 #cp /bin/bash /var/chroot-bind/bin/
 cp /usr/sbin/named /var/chroot-bind/usr/sbin/
--- a/bind/handlers/main.yml
+++ b/bind/handlers/main.yml
@ -3,6 +3,7 @@
  ansible.builtin.systemd:
    daemon-reload: yes

+
 - name: restart apparmor
  ansible.builtin.systemd:
    name: apparmor
--- a/bind/meta/main.yml
+++ b/bind/meta/main.yml
@ -14,8 +14,6 @@ galaxy_info:
        - jessie
        - stretch
        - buster
-        - bullseye
-        - bookworm

  galaxy_tags: []
    # Be sure to remove the '[]' above if you add dependencies
--- a/bind/tasks/authoritative.yml
+++ b/bind/tasks/authoritative.yml
@ -7,5 +7,5 @@
    owner: bind
    group: bind
    mode: "0644"
-    force: true
+    force: yes
  notify: restart bind
--- a/bind/tasks/main.yml
+++ b/bind/tasks/main.yml
@ -17,13 +17,13 @@
  register: check_apparmor

 - name: configure apparmor
-  ansible.builtin.copy:
-    src: apparmor.usr.sbin.named
-    dest: /etc/apparmor.d/local/usr.sbin.named
-    mode: "0644"
+  ansible.builtin.template:
+    src: apparmor.usr.sbin.named.j2
+    dest: /etc/apparmor.d/usr.sbin.named
    owner: root
-    force: true
-    backup: yes
+    group: root
+    mode: "0644"
+    force: yes
  notify: restart apparmor
  when: check_apparmor.rc == 0

@ -47,7 +47,7 @@
    owner: root
    group: root
    mode: "0644"
-    force: true
+    force: yes
  notify:
    - reload systemd
    - restart bind
@ -77,7 +77,7 @@
    dest: /root/chroot-bind.sh
    mode: "0700"
    owner: root
-    force: true
+    force: yes
    backup: yes
  when: bind_chroot_set | bool

@ -94,67 +94,13 @@
    - bind_chroot_set | bool
    - chrootbind_run.stdout | length > 0

- name: Modify OPTIONS in /etc/default/bind9 for chroot (until Buster)
+- name: Modify OPTIONS in /etc/default/bind9 for chroot
  ansible.builtin.replace:
    dest: /etc/default/bind9
    regexp: '^OPTIONS=.*'
    replace: 'OPTIONS="-u bind -t {{ bind_chroot_path }}"'
  notify: restart bind
-  when:
-    - bind_chroot_set | bool
-    - ansible_distribution_major_version is version('11', '<')
-
- name: Modify OPTIONS in /etc/default/named for chroot (since Bullseye)
-  ansible.builtin.replace:
-    dest: /etc/default/named
-    regexp: '^OPTIONS=.*'
-    replace: 'OPTIONS="-u bind -t {{ bind_chroot_path }}"'
-  notify: restart bind
-  when:
-    - bind_chroot_set | bool
-    - ansible_distribution_major_version is version('11', '>=')
-
- name: Create mount target directory for chroot (since Bookworm)
-  ansible.builtin.file:
-    path: /var/chroot-bind/run/systemd/journal
-    state: directory
-    owner: bind
-    group: bind
-  notify: restart bind
-  when:
-    - bind_chroot_set | bool
-    - ansible_distribution_major_version is version('12', '>=')
-
- name: Create mount targets for chroot (since Bookworm)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    state: touch
-    owner: bind
-    group: bind
-  loop:
-    - /var/chroot-bind/run/systemd/journal/socket
-    - /var/chroot-bind/run/systemd/journal/stdout
-    - /var/chroot-bind/run/systemd/notify
-  notify: restart bind
-  when:
-    - bind_chroot_set | bool
-    - ansible_distribution_major_version is version('12', '>=')
-
- name: Set up bind mount for chroot (since Bookworm)
-  ansible.posix.mount:
-    src: "{{ item }}"
-    path: "/var/chroot-bind{{ item }}"
-    opts: bind
-    state: mounted
-    fstype: none
-  loop:
-    - /run/systemd/journal/socket
-    - /run/systemd/journal/stdout
-    - /run/systemd/notify
-  notify: restart bind
-  when:
-    - bind_chroot_set | bool
-    - ansible_distribution_major_version is version('12', '>=')
+  when: bind_chroot_set | bool

 - name: logrotate for bind
  ansible.builtin.template:
@ -163,7 +109,7 @@
    owner: root
    group: root
    mode: "0644"
-    force: true
+    force: yes
  notify: restart bind

 - ansible.builtin.include: munin.yml
--- a/bind/tasks/munin.yml
+++ b/bind/tasks/munin.yml
@ -48,7 +48,7 @@
    owner: root
    group: root
    mode: "0644"
-    force: true
+    force: yes
  notify: restart munin-node
  tags:
    - bind
--- a/bind/tasks/recursive.yml
+++ b/bind/tasks/recursive.yml
@ -8,7 +8,7 @@
    owner: bind
    group: bind
    mode: "0644"
-    force: true
+    force: yes
  notify: restart bind

 - name: enable zones.rfc1918 for recursive server
--- a/bind/templates/apparmor.usr.sbin.named.j2
+++ b/bind/templates/apparmor.usr.sbin.named.j2
@ -0,0 +1,97 @@
+# vim:syntax=apparmor
+# Last Modified: Tue Mar  9 14:17:50 EST 2021
+#include <tunables/global>
+
+/usr/sbin/named flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+
+  # /etc/bind should be read-only for bind
+  # /var/lib/bind is for dynamically updated zone (and journal) files.
+  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
+  # See /usr/share/doc/bind9/README.Debian.gz
+  /etc/bind/** r,
+  /var/lib/bind/** rw,
+  /var/lib/bind/ rw,
+  /var/cache/bind/** lrw,
+  /var/cache/bind/ rw,
+
+  # Database file used by allow-new-zones
+  /var/cache/bind/_default.nzd-lock rwk,
+
+  # gssapi
+  /etc/krb5.keytab kr,
+  /etc/bind/krb5.keytab kr,
+
+  # ssl
+  /etc/ssl/openssl.cnf r,
+
+  # root hints from dns-data-root
+  /usr/share/dns/root.* r,
+
+  # GeoIP data files for GeoIP ACLs
+  /usr/share/GeoIP/** r,
+
+  # dnscvsutil package
+  /var/lib/dnscvsutil/compiled/** rw,
+
+  # Allow changing worker thread names
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+
+  @{PROC}/net/if_inet6 r,
+  @{PROC}/*/net/if_inet6 r,
+  @{PROC}/sys/net/ipv4/ip_local_port_range r,
+  /usr/sbin/named mr,
+  /{,var/}run/named/named.pid w,
+  /{,var/}run/named/session.key w,
+  # support for resolvconf
+  /{,var/}run/named/named.options r,
+
+  # some people like to put logs in /var/log/named/ instead of having
+  # syslog do the heavy lifting.
+  {{ bind_log_file }} rw,
+{% if bind_query_file_enabled | bool %}
+  {{ bind_query_file }} rw,
+{% endif %}
+
+  # gssapi
+  /var/lib/sss/pubconf/krb5.include.d/** r,
+  /var/lib/sss/pubconf/krb5.include.d/ r,
+  /var/lib/sss/mc/initgroups r,
+  /etc/gss/mech.d/ r,
+
+  # ldap
+  /etc/ldap/ldap.conf r,
+  /{,var/}run/slapd-*.socket rw,
+
+  # dynamic updates
+  /var/tmp/DNS_* rw,
+
+  # dyndb backends
+  /usr/lib/bind/*.so rm,
+
+  # Samba DLZ
+  /{usr/,}lib/@{multiarch}/samba/bind9/*.so rm,
+  /{usr/,}lib/@{multiarch}/samba/gensec/*.so rm,
+  /{usr/,}lib/@{multiarch}/samba/ldb/*.so rm,
+  /{usr/,}lib/@{multiarch}/ldb/modules/ldb/*.so rm,
+  /var/lib/samba/bind-dns/dns.keytab rk,
+  /var/lib/samba/bind-dns/named.conf r,
+  /var/lib/samba/bind-dns/dns/** rwk,
+  /var/lib/samba/private/dns.keytab rk,
+  /var/lib/samba/private/named.conf r,
+  /var/lib/samba/private/dns/** rwk,
+  /etc/samba/smb.conf r,
+  /dev/urandom rwmk,
+  owner /var/tmp/krb5_* rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.named>
+}
+
--- a/certbot/files/hooks/deploy/dovecot.sh
+++ b/certbot/files/hooks/deploy/dovecot.sh
@ -16,7 +16,7 @@ config_check() {
    ${doveconf_bin} > /dev/null 2>&1
 }
 letsencrypt_used() {
-    ${doveconf_bin} | grep -E "^[[:blank:]]*ssl_cert[^_]" | grep -q "letsencrypt"
+    ${doveconf_bin} | grep -E "^ssl_cert[^_]" | grep -q "letsencrypt"
 }
 main() {
    if daemon_found_and_running; then
--- a/certbot/files/hooks/deploy/hapee.sh
+++ b/certbot/files/hooks/deploy/hapee.sh
@ -39,8 +39,8 @@ concat_files() {
    chown root: "${hapee_cert_file}"
 }
 cert_and_key_mismatch() {
-    hapee_cert_md5=$(openssl x509 -noout -pubkey -in "${hapee_cert_file}" | openssl md5)
-    hapee_key_md5=$(openssl pkey -noout -pubout -in "${hapee_cert_file}" | openssl md5)
+    hapee_cert_md5=$(openssl x509 -noout -modulus -in "${hapee_cert_file}" | openssl md5)
+    hapee_key_md5=$(openssl rsa -noout -modulus -in "${hapee_cert_file}" | openssl md5)

    test "${hapee_cert_md5}" != "${hapee_key_md5}"
 }
--- a/certbot/files/hooks/deploy/haproxy.sh
+++ b/certbot/files/hooks/deploy/haproxy.sh
@ -29,8 +29,8 @@ concat_files() {
    chown root: "${haproxy_cert_file}"
 }
 cert_and_key_mismatch() {
-    haproxy_cert_md5=$(openssl x509 -noout -pubkey -in "${haproxy_cert_file}" | openssl md5)
-    haproxy_key_md5=$(openssl pkey -noout -pubout -in "${haproxy_cert_file}" | openssl md5)
+    haproxy_cert_md5=$(openssl x509 -noout -modulus -in "${haproxy_cert_file}" | openssl md5)
+    haproxy_key_md5=$(openssl rsa -noout -modulus -in "${haproxy_cert_file}" | openssl md5)

    test "${haproxy_cert_md5}" != "${haproxy_key_md5}"
 }
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
Jérémy Lecour	d83ae339d8	patroni: disable full configuration All checks were successful Ansible Lint \|Total\|New\|Outstanding\|Fixed\|Trend \|:-:\|:-:\|:-:\|:-:\|:-: \|2805\|20\|2785\|13\|:-1: Output truncated. Details gitea/ansible-roles/pipeline/head This commit looks good Details	2023-06-06 10:30:08 +02:00
Jérémy Lecour	a3ec1d6712	etcd: reorganize configuration	2023-06-06 10:29:51 +02:00
Jérémy Lecour	05da8f6472	WIP: forgot a file All checks were successful Ansible Lint \|Total\|New\|Outstanding\|Fixed\|Trend \|:-:\|:-:\|:-:\|:-:\|:-: \|2798\|4\|2794\|4\|:-1: Output truncated. Details gitea/ansible-roles/pipeline/head This commit looks good Details	2023-05-12 18:12:43 +02:00
Jérémy Lecour	5cb3762080	WIP: use the systemd unit and config conventions of Patroni 3 All checks were successful Ansible Lint \|Total\|New\|Outstanding\|Fixed\|Trend \|:-:\|:-:\|:-:\|:-:\|:-: \|2798\|13\|2785\|8\|:-1: Output truncated. Details gitea/ansible-roles/pipeline/head This commit looks good Details	2023-05-12 18:12:06 +02:00
Jérémy Lecour	921e384358	apt: move stretch backports to archive.d.o	2023-05-09 09:31:03 +02:00
Eric Morino	e27f0aa406	Add template systemd for patroni All checks were successful Ansible Lint \|Total\|New\|Outstanding\|Fixed\|Trend \|:-:\|:-:\|:-:\|:-:\|:-: \|2793\|0\|2793\|0\|:zzz: Details gitea/ansible-roles/pipeline/head This commit looks good Details	2023-04-23 10:27:05 +02:00
Eric Morino	d8e31ef297	changement variable postgresql_hosts	2023-04-23 10:26:45 +02:00
Eric Morino	26c927d3fe	Fix variable bin_dir patroni configuration	2023-04-23 10:26:22 +02:00
Eric Morino	5028803dff	add create etcd datadir	2023-04-23 10:26:07 +02:00
Eric Morino	63cb7a2671	change variable in templabe by etcd_listen_ip	2023-04-23 10:25:46 +02:00
Eric Morino	b4d5107025	add patroni_install_dependencies by default	2023-04-23 10:25:32 +02:00
Eric Morino	a66226ea95	add template conf etcd	2023-04-23 10:25:24 +02:00
Eric Morino	bc3f5409ef	Add task main.yml	2023-04-23 10:25:08 +02:00
Eric Morino	e1c1966a6e	création role etcd	2023-04-23 10:24:45 +02:00
Eric Morino	c13618b2e4	Add new role Patroni in CHANGELOG	2023-04-23 10:24:27 +02:00
Eric Morino	6db3769f9f	Add key GPG evolix, and fix some bugs	2023-04-23 10:23:04 +02:00
Eric Morino	96e24527ac	début creation rôle patroni	2023-04-23 10:22:41 +02:00