[Bug 297372] [NEW PORT] sysutils/sysmanage: Centralized system management server with web-based interface

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297372

--- Comment #3 from Bryan Everly <[email protected]> ---
Created attachment 273643
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273643&action=edit
Correction to my previous comment: I don't have permission to set the obsolete
flag on    ▎ the earlier attachments. Could a committer mark them obsolete so
the newest patch is the   ▎ only live one?

Updated port for 3.5.1.10, attached as a git diff.

Thanks for the triage — the git-diff conversion and the sysutils/Makefile
SUBDIR entry are carried forward here, and $FreeBSD$ is gone from files/*.in.

This revision is build- AND runtime-tested.  I want to be straightforward
about why it changed so much: the version you triaged could not start.  It
built, packaged, passed check-plist and stage-qa, installed cleanly — and the
service never came up.  Everything below came out of actually running it.

Changes since the previous attachment
-------------------------------------
rc.d script:
  * Removed "daemon -u ${sysmanage_user}".  ${name}_user is an rc.subr knob:
    run_rc_command already wraps the command in "su -m", so daemon(8) was
    running unprivileged and died in initgroups() with EPERM.  Two privilege
    drops stacked; rc.subr's wins.
  * pidfile moved to /var/run/sysmanage/ (created in start_precmd).  An
    unprivileged service cannot write a pidfile directly into /var/run.
  * procname set to the interpreter — daemon -p records the child's pid, so
    onestatus/onestop reported "not running" for a running service.
  * Exports SYSMANAGE_CONFIG_PATH / SYSMANAGE_CERT_PATH / SYSMANAGE_LOG_DIR.
    The program parses no command-line arguments; the previous script passed
    --config, which was silently ignored, so the daemon never found its
    configuration under ${PREFIX}/etc.
  * Listen address is now an rcvar defaulting to 127.0.0.1.  uvicorn takes it
    on the command line, so api.host in the config file had no effect and the
    service bound every interface regardless of what the admin configured.

Packaging:
  * USERS/GROUPS=sysmanage with the matching ports/UIDs and ports/GIDs entries
    (253 was free; reassign as you see fit).
  * Writable state via @dir(): /var/db/sysmanage{,/certs} and
    /var/log/sysmanage.  The server generates its mTLS CA on first start and
    aborted with nowhere to write it.
  * ${PREFIX}/etc/sysmanage.yaml installs 0640 root:sysmanage — it holds the
    database password, the JWT secret and the password salt.
  * USES=python:3.10+ (was 3.9+; the application does not parse under 3.9).
  * SHEBANG_FILES added — USES=shebangfix was present but rewrote nothing.
  * USES=nodejs:build passed explicitly, or node lands in RUN_DEPENDS and every
    user installs a Node runtime that is never executed.
  * The nginx sample now ships from files/ and is TLS-first (HTTP redirects to
    HTTPS, HSTS, nosniff, DENY framing).  It previously came from the release
    tarball, which meant the port could not correct its own configuration
    without a new upstream release.

Web UI:
  * The port now BUILDS the web interface from source with USES=npm:npm,build,
    rather than shipping a pre-built bundle.  npm.mk runs "npm ci" against the
    lockfile in files/packagejsons/ during the fetch phase and archives the
    result into a single distfile, so the build itself is fully offline.

Two things you may want to weigh in on
--------------------------------------
1. This appears to be the first port in the tree using USES=npm.  That brings
   a 12.6k-line package-lock.json into files/ and a ~100 MB node-modules
   distfile.  I chose it over vendoring a pre-built UI because it keeps the
   port building from source and uses the framework's own mechanism, but I am
   happy to take direction if you would rather it were done differently.
2. While using it I hit what looks like a typo in Mk/Uses/npm.mk: the
   no-stage-argument branch reads "!defied(_NPM_EXTRACT_DEP)" rather than
   "!defined".  That is the documented default path, which may explain the
   absence of other consumers.  I will send that as a separate PR.

Testing
-------
  * portlint -AC: 0 fatal errors
  * make check-plist: clean
  * make stage-qa under DEVELOPER=yes: clean
  * poudriere testport: exit 0 in a clean 14.4-RELEASE amd64 jail
    (STRICT_DEPENDS=yes), including install and deinstall
  * Installed the resulting package on a 14.4-RELEASE host, followed the
    pkg-message steps, and confirmed: the service starts as the unprivileged
    sysmanage user, binds 127.0.0.1:8080 only, nginx serves the UI over TLS,
    a browser login succeeds, and a sysutils/sysmanage-agent host registers
    and is manageable.

This attachment supersedes the earlier ones.  I do not appear to have
permission to set the obsolete flag on them myself — could a committer mark
them obsolete so the newest patch is the only live one?

-- 
You are receiving this mail because:
You are the assignee for the bug.