puppet: replace dsa_systemd with camptocamp systemd module

we currently have two systemd module in Puppet, dsa_systemd (from the Debian sysadmins) and camptocamp-systemd, from the Puppet forge.

the latter was imported as a dependency of the Prometheus module and it would be very hard to remove it from our codebase.

we should look at whether we can replace the dsa_systemd module with the forge systemd module instead. this would allow us to collaborate with a broader community and remove duplicate code from our monorepo.

ideally, we'd also provide the good DSA folks a procedure on how to perform the migration, since we'll have to do it anyways.

so far, I've found this transition:

dsa_systemd::linger { 'bridgescan': }

... becomes:

loginctl_user { 'tordnsel':
    linger => enabled,
}

we also use:

• dsa_systemd::override (to replace with systemd::dropin_file with a possible notify)
• dsa_systemd::mask
• dsa_systemd class which deploys two mask resources, and a cleanup cronjob, to be reviewed

we already use the camptocamp:

• systemd::tmpfile
• systemd::unit_file

... and we have various systemd files manually deployed in /lib and /etc

added component::internal services/tor sysadmin team in Legacy / Trac owner::tpa in Legacy / Trac priority::very low in Legacy / Trac severity::major in Legacy / Trac status::new in Legacy / Trac type::task in Legacy / Trac labels

Trac:
Summary: replace dsa_systemd with camptocamp systemd module to puppet: replace dsa_systemd with camptocamp systemd module

moved from legacy/trac#33449 (moved)

added Task label and removed 1 deleted label

added Sysadmin label and removed 1 deleted label

added Backlog label

removed Backlog label

added Icebox label

mentioned in issue #40081 (closed)

i replaced all dsa_systemd::linger by loginctl entries because i got hit by the "systemd --user" not running problem one too many times already (see #40081 (closed)).

added Puppet label

changed the description

marked the checklist item dsa_systemd::mask as completed

marked the checklist item dsa_systemd::mask as incomplete

marked the checklist item dsa_systemd::override (to replace with systemd::dropin_file with a possible notify) as completed

marked this issue as related to #41355 (closed)

actually purged all dsa_systemd::override calls because I got overzealous with the dropin_file replacement as part of the research in #41355 (closed).

i looked at cleaning up dsa_systemd::mask but we don't have a good straightforward way to do this. i'll also note there are manual incantations of this e.g.

    if versioncmp($facts['os']['release']['major'], '11') <= 0 {
      file { '/etc/systemd/system/proc-sys-fs-binfmt_misc.automount':
        ensure => 'link',
        target => '/dev/null',
        notify => Exec['systemctl daemon-reload'],
      }
    } else {
      file { '/etc/systemd/system/proc-sys-fs-binfmt_misc.automount':
        ensure => 'absent',
        notify => Exec['systemctl daemon-reload'],
      }
    }

that and all dsa_systemd::mask calls should be replaced with a systemd::unit_file, but that would require first upgrading the systemd module to 3.5.2+ as that feature was only implemented then (see https://github.com/voxpupuli/puppet-systemd/blob/006bdf0493d83a5365ae4ef7eccef90bec115d1e/CHANGELOG.md?plain=1#L263).

added Backlog label and removed Icebox label

assigned to @anarcat

changed the description

removed Sysadmin label

removed Task label

added Icebox label and removed Backlog label

unassigned @anarcat

assigned to @lavamind

removed Icebox label

added Doing label

marked the checklist item dsa_systemd::mask as completed

marked the checklist item dsa_systemd class which deploys two mask resources, and a cleanup cronjob, to be reviewed as completed

This has been completed, dsa_systemd is no longer a module in tor-puppet.git.

closed