From 7a2a889585767ed0e8f0d626ca35ca44ba4ae2e7 Mon Sep 17 00:00:00 2001 From: missytake Date: Tue, 19 Dec 2023 17:28:11 +0100 Subject: [PATCH] pyinfra: only install unbound-anchor on Debian systems --- cmdeploy/src/cmdeploy/__init__.py | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/cmdeploy/src/cmdeploy/__init__.py b/cmdeploy/src/cmdeploy/__init__.py index 71db3ce..4547203 100644 --- a/cmdeploy/src/cmdeploy/__init__.py +++ b/cmdeploy/src/cmdeploy/__init__.py @@ -12,6 +12,7 @@ from pyinfra import host from pyinfra.operations import apt, files, server, systemd, pip from pyinfra.facts.files import File from pyinfra.facts.systemd import SystemdEnabled +from pyinfra.facts.server import LinuxDistribution from .acmetool import deploy_acmetool from chatmaild.config import read_config, Config @@ -399,12 +400,18 @@ def deploy_chatmail(config_path: Path) -> None: # to use 127.0.0.1 as the resolver. apt.packages( name="Install unbound", - packages=["unbound", "unbound-anchor"], - ) - server.shell( - name="Generate root keys for validating DNSSEC", - commands=["unbound-anchor -a /var/lib/unbound/root.key || true"], + packages=["unbound"], ) + if host.get_fact(LinuxDistribution).get("name") == "Debian": + # on Debian, the root key doesn't seem to be auto-generated during apt install unbound. + apt.packages( + name="Install unbound-anchor for generating DNSSEC validation root key", + packages=["unbound-anchor"], + ) + server.shell( + name="Generate root keys for validating DNSSEC", + commands=["unbound-anchor -a /var/lib/unbound/root.key || true"], + ) systemd.service( name="Start and enable unbound", service="unbound.service",