Instead of publishing A/AAAA records for $(hostname).loocal with a CNAME
infix.local, we flip it around to take advantage of the mDNS conflict
resolution rules. This gives us infix.local for one device ont the LAN
and infix-2.local for the next.
Update all service records to *not* advertise hostname, but instead to
let Avahi imply that from the advertised A/AAAA and CNAME records.
Fixes#1387
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Introduce libfleet.sh and a new 'fleet' subcommand to ixll for managing
and operating enrolled Infix devices via RESTCONF.
Device configuration is stored in ~/.config/infix/config.json
(chmod 600): and organised by profile, allowing bulk operations across
groups of devices (e.g. all aarch64 targets).
New commands:
ixll fleet enroll [-d] [-p profile] [-u user] [-w password] <name> <address>
ixll fleet list
ixll fleet upgrade <name|profile> <url>
ixll fleet backup [-o dir] <name|profile>
ixll fleet reboot <name|profile>
Upgrade runs in parallel across a fleet and shows a live per-device
progress bar by polling the infix-system:install-bundle RPC and the
installer state from the YANG operational data store.
The global -A flag (admin/admin) is honoured as a credential fallback
for devices enrolled without an explicit password.
Also fix a pre-existing typo: ">2" → ">&2" in the error path.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for chronyd's stratumpweight both in the NTP
client (ietf-system) and client+server (ietf-ntp) should fix the flaky
NTP stratum test.
Also, make sure to *not* 'rm -rf /etc/chrony/conf.d/*' in system.c to
prevent clobbering settings potentially made in ntp.c
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a follow-up to c559b8f2 (new-frr) where netd now is responsible
for funneling static routes, as well as routes from DHCP clients, into
the kernel via Frr.
For this to work, in particular at boot, any DHCP client must wait for
netd to have started or any default routes learned will be lost.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org),
so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A
www subdomain can carry a CNAME pointing directly to kernelkit.github.io,
giving GitHub full control over the mapping and making the redirect work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The weird `if env | grep -q 'reset-volumes'` construct is due to Klish
not sanitizing names before constructing variables, which leads to env
variables with '-' in them, not allowed in POSIX sh.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
curl's SCP/SFTP backend (libssh2) does not support interactive password
prompting — it fails with an authentication error unless credentials are
supplied non-interactively.
Replace the curl path for SSH URIs with native scp(1), which inherits
the TTY and prompts the user for a password as expected. Both scp://
and sftp:// URIs are handled by parsing the URI into a [user@]host:path
argument. Port is extracted if present and passed via -P. If no user
is embedded in the URI, the -u flag value (remote_user) is used instead.
Host-key verification is skipped with -o StrictHostKeyChecking=no, the
same trade-off already made by the test framework.
When the destination URI ends with '/', a meaningful remote filename is
derived from the source: the datastore's on-disk filename (e.g.,
startup-config.cfg), the datastore short-name for in-memory stores, or
the source file's own basename for plain file copies.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg