Dotfiles

Commit Graph

Author	SHA1	Message	Date
Amir Alexander Abdelbaki	3ee375b1c1	fix(ansipa): FreeIPA enrollment for Arch/Fedora/RHEL + autofs AUR workaround Found while testing client enrollment across distros in VMs: - Restore the executable bit on freeipa-enroll.sh (lost on a prior edit), which made freeipa-client.sh fail with a misleading "not found" for every path. - Arch: freeipa-client is AUR-only, not the repo package "freeipa" — pacman -S freeipa died with "target not found". Install sssd/krb5 from repos and freeipa-client via an aur_install helper that drops to the sudo user. - Bundle autofs-pkgbuild/: freeipa-client (AUR) hard-depends on autofs (AUR), whose PKGBUILD pins autofs-5.1.9.tar.xz — pruned from kernel.org at the 5.2.0 release, so it 404s and blocks all Arch enrollment. Build autofs ourselves from upstream git pinned to a 5.1.9-series commit that already carries the cyrus-sasl function-pointer fix GCC 14+ needs, and install it before the freeipa-client AUR build so the broken AUR autofs is never touched. Verified the bundled PKGBUILD builds and installs cleanly on Arch. - Fedora vs RHEL/Rocky/Alma use different client package names: keep freeipa-client on Fedora, use ipa-client on the RHEL family (freeipa-client does not exist there). Split the case arms accordingly. - Guard both freeipa-client.sh entry points against unattended/no-TTY runs: the module TUI would hang on a dialog menu, and the wrapper would block on an interactive password read when the shipped answerfile has a blank password. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi	2026-07-02 11:27:46 +02:00
Amir Alexander Abdelbaki	7279a781b0	setup: add FreeIPA server module and generic client script freeipa-server.sh: interactive installer that collects domain, realm, IP, admin/DM passwords, DNS, KRA, NTP, and AWX/Ansible settings; runs conflict pre-flight (checks for existing named/dirsrv/krb5kdc, ports 389/636/88, and /etc/ipa/default.conf); configures firewalld/ufw; runs ipa-server-install; and outputs a ready-to-distribute client package to ~/freeipa-output/ containing: - freeipa-enroll.sh (server defaults baked in) - freeipa-client.sh (server defaults baked in) - freeipa-client-answerfile.json (pre-filled, password intentionally blank) - auto-enroll-ansible.sh (AWX defaults embedded, still overridable) - README.txt freeipa-client.sh: thin wrapper around freeipa-enroll.sh with three modes: --answerfile FILE read JSON with jq, build args, exec freeipa-enroll.sh --interactive prompt for every field, then exec freeipa-enroll.sh [flags] passthrough directly to freeipa-enroll.sh freeipa-client-answerfile.json: template with current server defaults (freeipa.abdelbaki.eu); freeipa-server.sh sed-replaces these when generating customized copies. Supported server OS: RHEL/Rocky/AlmaLinux/Fedora (primary), Arch (warned). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-18 11:12:31 +02:00

Author

SHA1

Message

Date

Amir Alexander Abdelbaki

3ee375b1c1

fix(ansipa): FreeIPA enrollment for Arch/Fedora/RHEL + autofs AUR workaround

Found while testing client enrollment across distros in VMs:

- Restore the executable bit on freeipa-enroll.sh (lost on a prior edit), which
  made freeipa-client.sh fail with a misleading "not found" for every path.
- Arch: freeipa-client is AUR-only, not the repo package "freeipa" — pacman -S
  freeipa died with "target not found". Install sssd/krb5 from repos and
  freeipa-client via an aur_install helper that drops to the sudo user.
- Bundle autofs-pkgbuild/: freeipa-client (AUR) hard-depends on autofs (AUR),
  whose PKGBUILD pins autofs-5.1.9.tar.xz — pruned from kernel.org at the 5.2.0
  release, so it 404s and blocks all Arch enrollment. Build autofs ourselves
  from upstream git pinned to a 5.1.9-series commit that already carries the
  cyrus-sasl function-pointer fix GCC 14+ needs, and install it before the
  freeipa-client AUR build so the broken AUR autofs is never touched. Verified
  the bundled PKGBUILD builds and installs cleanly on Arch.
- Fedora vs RHEL/Rocky/Alma use different client package names: keep
  freeipa-client on Fedora, use ipa-client on the RHEL family (freeipa-client
  does not exist there). Split the case arms accordingly.
- Guard both freeipa-client.sh entry points against unattended/no-TTY runs: the
  module TUI would hang on a dialog menu, and the wrapper would block on an
  interactive password read when the shipped answerfile has a blank password.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi

2026-07-02 11:27:46 +02:00

Amir Alexander Abdelbaki

7279a781b0

setup: add FreeIPA server module and generic client script

freeipa-server.sh: interactive installer that collects domain, realm,
IP, admin/DM passwords, DNS, KRA, NTP, and AWX/Ansible settings;
runs conflict pre-flight (checks for existing named/dirsrv/krb5kdc,
ports 389/636/88, and /etc/ipa/default.conf); configures firewalld/ufw;
runs ipa-server-install; and outputs a ready-to-distribute client
package to ~/freeipa-output/ containing:
  - freeipa-enroll.sh (server defaults baked in)
  - freeipa-client.sh (server defaults baked in)
  - freeipa-client-answerfile.json (pre-filled, password intentionally blank)
  - auto-enroll-ansible.sh (AWX defaults embedded, still overridable)
  - README.txt

freeipa-client.sh: thin wrapper around freeipa-enroll.sh with three modes:
  --answerfile FILE   read JSON with jq, build args, exec freeipa-enroll.sh
  --interactive       prompt for every field, then exec freeipa-enroll.sh
  [flags]             passthrough directly to freeipa-enroll.sh

freeipa-client-answerfile.json: template with current server defaults
(freeipa.abdelbaki.eu); freeipa-server.sh sed-replaces these when
generating customized copies.

Supported server OS: RHEL/Rocky/AlmaLinux/Fedora (primary), Arch (warned).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-18 11:12:31 +02:00

2 Commits (dc9cf6d830ff69e00bae179544a74979a43e04ac)