Distribute code to the compiler with codavox

[miharp]

The compiler has had no way to get resolved Puppet code. OpenVox Server ships without PE's Code Manager and file sync, so nothing puts a versioned tree on a compiler or lets it answer which version it is serving. This wires codavox in — publisher on the primary where the code already lives, agent on the compiler.

Staged on purpose

profile::codavox::agent::wire_server defaults to false.

codavox has no fallback by design: once OpenVox Server is pointed at it, catalog compilation depends on the agent having deployed code there. A compiler wired before its agent converges fails every catalog compile — loudly, which is correct, but it fails.

So stage 1 is what this PR does: the agent converges the compiler and keeps it current, without touching how catalogs are compiled. Confirm with codavox code-id production on the compiler and codavox compilers on the primary, then flip wire_server to true — a restart, not a wait.

Shape

node	role	what it runs
puppet.example.com	role::puppet_master	profile::codavox::publisher — seals the codedir, serves on 8150
compiler.example.com	role::compiler	profile::codavox::agent — polls, verifies, swaps

Settings live in Hiera under codavox::* rather than as profile parameters, so a node that ends up running both the publisher and an agent still resolves one consistent codavox class instead of declaring it twice with conflicting data.

staging is r10k's basedir — here the codedir the control repo is already synced into. codavox needs no staging area of its own, and pointing it one level higher gives a publisher that starts cleanly and advertises nothing.

The compiler is authorized by the pp_role in its certificate, written into csr_attributes.yaml before enrolment (#63). An estate whose compiler certificates predate codavox would use codavox::publish_allow_certnames instead, since pp_role cannot be added to an already-issued certificate.

puppet-codavox is pinned to v0.1.0 rather than floating on a branch: codavox exists to make code versions deterministic, and resolving its own module non-deterministically would undercut the point.

Drive-by fix: onceover was broken for every RedHat role

Adding puppetlabs/yumrepo_core to the Puppetfile. yumrepo left Puppet core, and while site-modules/profile/.fixtures.yml already declared it for the module's own specs, the control repo never shipped it — so onceover failed to compile role::puppet_master, role::compiler, role::database_server, and role::webserver with Unknown resource type: 'yumrepo'.

Real nodes were unaffected because openvox-agent bundles it, which is why this went unnoticed. I confirmed it was pre-existing by stashing this branch and reproducing the identical four failures on a clean tree. Fixing it is what makes onceover able to verify any of the above.

Two things I did not change, worth a look

1. The primary still compiles static catalogs with profile::static_catalogs, whose hand-rolled code_id.sh ends in:

   # Last resort: use timestamp (not ideal for static catalogs)
   echo "warning: no git or r10k signature available, using timestamp" >&2
   date +%s

   On this primary it doesn't reach the timestamp — production is the synced control repo, so .git exists and it returns git rev-parse HEAD. But HEAD describes the control repo, not resolved module content, and does not change when the host working tree does. It also writes to stderr while exiting 0, which OpenVox Server logs at ERROR on every compile.

   The practical consequence: a catalog compiled by the primary and one compiled by the compiler now carry code_ids from two different schemes, which are not comparable. Moving the primary onto codavox too (an agent polling its own publisher) is the natural stage 3.

2. The eyaml private key travels in the artifact. keys/private_key.pkcs7.pem lives in the synced production directory, so the publisher seals it and ships it to compilers. A compiler needs it to decrypt hiera-eyaml data during compilation, so this is functionally required — but it is worth knowing that the key is in the distributed tree rather than provisioned separately.

Verification

• onceover: all five roles compile against real factsets with the actual Hiera data, including role::puppet_master and role::compiler with codavox wired. Confirmed codavox is fetched at the pinned tag (miharp-codavox 0.1.0).
• rspec: 118 examples, 0 failures (96 existing + 22 new across both OSes), covering wire_server off and on, the firewall rule at default and custom ports, and that codavox::server is absent by default.
• rake validate lint check clean; puppet parser validate and cspell clean on all new files.

Not yet run on the Vagrant VMs — happy to vagrant destroy && up to prove a clean install if you want that before merging.