miharp · miharp · Jul 26, 2026 · Jul 26, 2026
@@ -15,13 +15,8 @@ mod 'puppetlabs/stdlib',     '9.7.0'
 mod 'puppetlabs/vcsrepo',    '7.0.0'
 # yumrepo left Puppet core, so it has to be declared to exist in a compile-only
 # environment. Real nodes get it bundled with openvox-agent, which is why
-# profile::base worked on them while onceover failed on every RedHat role.
+# profile::base worked on them while onceover failed on every RedHat role with
+# "Unknown resource type: 'yumrepo'". site-modules/profile/.fixtures.yml already
+# declared it for the module's own specs; the control repo never shipped it.
 mod 'puppetlabs/yumrepo_core', '3.0.1'
 mod 'saz/sudo',              '9.0.2'
-
-# Not on the Forge yet, so pinned by tag rather than floating on a branch:
-# codavox exists to make code versions deterministic, and resolving its own
-# module non-deterministically would undercut that.
-mod 'codavox',
-  git: 'https://github.com/miharp/puppet-codavox.git',
-  tag: 'v0.2.0'
@@ -38,27 +38,13 @@ Vagrant.configure("2") do |config|
       echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts
       echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts
       echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts
-      echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts
 
       # Update all packages
       dnf update -y
 
       # Tools used by readiness checks
       dnf install -y curl
 
-
-      # pp_role has to be in the CSR before the certificate is issued: it is an
-      # X.509 extension, so it cannot be added to a signed cert afterwards
-      # without re-issuing. Anything that authorizes on role -- codavox's
-      # publisher, and puppetserver's own auth.conf -- depends on it being here
-      # from the first boot.
-      install -d -m 0755 /etc/puppetlabs/puppet
-      tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML'
----
-extension_requests:
-  pp_role: openvox_server
-CSRYAML
-
       # Install OpenVox repository
       rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm
 
@@ -187,113 +173,6 @@ EYAML
     SHELL
   end
 
-
-  # Compiler Node: runs OpenVox Server, but defers the CA to the primary.
-  #
-  # A compiler compiles catalogs and serves file content; it does not issue
-  # certificates. That is what makes it the node codavox exists for -- the
-  # publisher on the primary distributes resolved code to compilers, and each
-  # compiler answers which exact version it is serving.
-  config.vm.define "compiler" do |compiler|
-    compiler.vm.box = "bento/centos-stream-10"
-    compiler.vm.hostname = "compiler.example.com"
-    compiler.vm.network "private_network", ip: "192.168.56.13"
-
-    compiler.vm.provider "parallels" do |prl|
-      prl.memory = 3072
-      prl.cpus = 2
-    end
-
-    compiler.vm.provision "shell", inline: <<-SHELL
-      # Set up /etc/hosts
-      echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts
-      echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts
-      echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts
-      echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts
-
-      dnf update -y
-      dnf install -y curl git
-
-      # pp_role has to be in the CSR before the certificate is issued: it is an
-      # X.509 extension, so it cannot be added to a signed cert afterwards
-      # without re-issuing. codavox's publisher authorizes on exactly this --
-      # a certificate signed by the CA only proves the peer is some enrolled
-      # node, and every agent in the estate clears that bar.
-      install -d -m 0755 /etc/puppetlabs/puppet
-      tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML'
----
-extension_requests:
-  pp_role: openvox_compiler
-CSRYAML
-
-      rpm -Uvh #{yum_release_base}/openvox8-release-el-10.noarch.rpm
-      dnf install -y openvox-server
-
-      # Point at the primary for both catalogs and the CA before enrolling, so
-      # the certificate is issued by the primary's CA rather than a second one
-      # this node would otherwise stand up for itself.
-      /opt/puppetlabs/bin/puppet config set --section main server puppet.example.com
-      /opt/puppetlabs/bin/puppet config set --section main ca_server puppet.example.com
-      /opt/puppetlabs/bin/puppet config set --section main certname compiler.example.com
-
-      systemctl enable --now firewalld
-      firewall-cmd --add-port=8140/tcp --permanent
-      firewall-cmd --reload
-
-      # Clock sync before enrolling. A skewed clock at certificate issuance
-      # produces "CRL not yet valid" errors that persist until regenerated.
-      systemctl stop chronyd 2>/dev/null || true
-      chronyd -q 'pool pool.ntp.org iburst' || true
-      systemctl start chronyd
-
-      # Wait for the primary's CA to be serving before requesting a certificate.
-      echo "Waiting for the primary..."
-      ok=0
-      while [ "$ok" -lt 3 ]; do
-        if curl -k https://puppet:8140/status/v1/simple > /dev/null 2>&1; then
-          ok=$((ok+1))
-        else
-          ok=0
-        fi
-        sleep 5
-      done
-
-      # Enrol. The primary autosigns in this environment, so the signed
-      # certificate comes back carrying pp_role from csr_attributes.yaml.
-      /opt/puppetlabs/bin/puppet ssl bootstrap --waitforcert 10 || true
-
-      # Serve catalogs with the primary's CA material, and disable this node's
-      # own CA service so it never issues a certificate.
-      SSLDIR=/etc/puppetlabs/puppet/ssl
-      tee /etc/puppetlabs/puppetserver/conf.d/webserver.conf > /dev/null <<HOCON
-webserver: {
-    access-log-config: /etc/puppetlabs/puppetserver/request-logging.xml
-    client-auth: want
-    ssl-host: 0.0.0.0
-    ssl-port: 8140
-    ssl-cert: ${SSLDIR}/certs/compiler.example.com.pem
-    ssl-key: ${SSLDIR}/private_keys/compiler.example.com.pem
-    ssl-ca-cert: ${SSLDIR}/certs/ca.pem
-    ssl-crl-path: ${SSLDIR}/crl.pem
-}
-HOCON
-
-      ca_cfg=/etc/puppetlabs/puppetserver/services.d/ca.cfg
-      sed -i \
-        -e 's|^puppetlabs.services.ca.certificate-authority-service/|#puppetlabs.services.ca.certificate-authority-service/|' \
-        -e 's|^#puppetlabs.services.ca.certificate-authority-disabled-service/|puppetlabs.services.ca.certificate-authority-disabled-service/|' \
-        "$ca_cfg"
-
-      systemctl enable --now puppetserver
-
-      # Development environment: converge once, then leave the agent off and run
-      # it by hand, matching the other nodes.
-      systemctl stop puppet || true
-      /opt/puppetlabs/bin/puppet agent -t --waitforlock 60 || true
-      systemctl disable --now puppet || true
-    SHELL
-  end
-
   # Agent Node: agent01
   config.vm.define "agent01" do |agent|
     agent.vm.hostname = "agent01.example.com"
@@ -308,24 +187,10 @@ HOCON
       echo "192.168.56.10 puppet.example.com puppet" >> /etc/hosts
       echo "192.168.56.11 agent01.example.com agent01" >> /etc/hosts
       echo "192.168.56.12 agent02.example.com agent02" >> /etc/hosts
-      echo "192.168.56.13 compiler.example.com compiler" >> /etc/hosts
 
       # Update all packages
       dnf update -y
 
-
-      # pp_role has to be in the CSR before the certificate is issued: it is an
-      # X.509 extension, so it cannot be added to a signed cert afterwards
-      # without re-issuing. Anything that authorizes on role -- codavox's
-      # publisher, and puppetserver's own auth.conf -- depends on it being here
-      # from the first boot.
-      install -d -m 0755 /etc/puppetlabs/puppet
-      tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML'
----
-extension_requests:
-  pp_role: openvox_agent
-CSRYAML
-
       # Install OpenVox repository
       rpm -Uvh #{yum_release_base}/openvox8-release-el-9.noarch.rpm
 
@@ -385,27 +250,13 @@ CSRYAML
       echo "192.168.56.10 puppet.example.com puppet" | sudo tee -a /etc/hosts > /dev/null
       echo "192.168.56.11 agent01.example.com agent01" | sudo tee -a /etc/hosts > /dev/null
       echo "192.168.56.12 agent02.example.com agent02" | sudo tee -a /etc/hosts > /dev/null
-      echo "192.168.56.13 compiler.example.com compiler" | sudo tee -a /etc/hosts > /dev/null
 
       # Update all packages
       sudo apt-get update -y
       sudo apt-get upgrade -y
 
       # Install OpenVox repository + agent (Debian/Ubuntu)
       sudo apt-get install -y curl ca-certificates
-
-      # pp_role has to be in the CSR before the certificate is issued: it is an
-      # X.509 extension, so it cannot be added to a signed cert afterwards
-      # without re-issuing. Anything that authorizes on role -- codavox's
-      # publisher, and puppetserver's own auth.conf -- depends on it being here
-      # from the first boot.
-      sudo install -d -m 0755 /etc/puppetlabs/puppet
-      sudo tee /etc/puppetlabs/puppet/csr_attributes.yaml > /dev/null <<'CSRYAML'
----
-extension_requests:
-  pp_role: openvox_agent
-CSRYAML
-
       curl -fsSL -o /tmp/openvox8-release-ubuntu24.04.deb #{apt_release_base}/openvox8-release-ubuntu24.04.deb
       sudo dpkg -i /tmp/openvox8-release-ubuntu24.04.deb
       sudo apt-get update -y

@@ -6,14 +6,11 @@
     "basemodulepath",
     "bento",
     "certname",
-    "certnames",
     "chrony",
-    "codavox",
-    "codedir",
     "confdir",
     "cpus",
-    "dpkg",
     "dport",
+    "dpkg",
     "encryptor",
     "environmentpath",
     "eyaml",
@@ -28,28 +25,27 @@
     "HOCON",
     "inifile",
     "inventoryfile",
-    "keygen",
     "keypair",
+    "keygen",
     "mharp",
     "miharp",
     "modulepath",
     "NOPASSWD",
     "ntpserver",
-    "ntpservers",
     "Onceover",
     "onceover",
+    "ntpservers",
     "openbolt",
     "openvox",
     "openvoxdb",
-    "openvoxview",
     "operatingsystem",
     "operatingsystemrelease",
     "PGDG",
+    "Pupuli",
     "puppetdb",
     "Puppetfile",
     "puppetlabs",
     "puppetserver",
-    "Pupuli",
     "rspec",
     "stdlib",
     "vcsrepo",

@@ -4,37 +4,3 @@ profile::base::release: 8
 profile::openvox_agent::version: '8.28.1'
 
 
-
-# --- codavox: versioned code distribution to compilers ---------------------
-#
-# Estate-wide settings live here so a node running both the publisher and an
-# agent still resolves one consistent `codavox` class. Node-specific values are
-# in data/nodes/.
-
-# Where the agent deploys code and code-id reads from. Deliberately not the stock
-# /etc/puppetlabs/code/environments: a fresh OpenVox Server ships a populated
-# production skeleton there, and rename(2) cannot replace a real directory with a
-# symlink. PE moves its codedir for the same reason when versioned deploys are on.
-codavox::environmentpath: '/opt/puppetlabs/codavox/environments'
-
-# The publisher every compiler polls. One URL for the whole estate.
-codavox::agent_publisher: 'https://puppet.example.com:8150'
-
-# codavox has no package repository yet (miharp/codavox#42), so the package is
-# installed straight from a release asset. Written out as a literal rather than
-# assembled from a version and an architecture fact: a URL a profile builds is a
-# URL nobody can grep for, and this is data, not logic.
-#
-# Both codavox nodes here are aarch64 (Apple silicon Parallels), so arm64 is
-# right for this estate. A node on another architecture overrides this key in
-# data/nodes/<certname>.yaml. The module already picks the rpm/dpkg provider by
-# OS family, which is what installing from a file requires.
-codavox::package_source: 'https://github.com/miharp/codavox/releases/download/v0.5.0/codavox_0.5.0_linux_arm64.rpm'
-
-# Compilers are authorized by the pp_role in their certificate, which
-# csr_attributes.yaml writes before enrolment — see role::compiler. An estate
-# whose compiler certificates predate codavox would list them under
-# codavox::publish_allow_certnames instead, since pp_role cannot be added to an
-# already-issued certificate.
-codavox::publish_allow_roles:
-  - 'openvox_compiler'
@@ -30,18 +30,3 @@ postgresql::globals::datadir: '/var/lib/pgsql/data'
 postgresql::globals::confdir: '/var/lib/pgsql/data'
 postgresql::globals::bindir: '/usr/bin'
 postgresql::globals::service_name: 'postgresql'
-
-# codavox publisher. `basedir` holds one subdirectory per environment, and codavox
-# only reads it — it writes nothing there and keeps no copy.
-#
-# Deliberately NOT /etc/puppetlabs/code/environments. That holds `production`,
-# the Vagrant synced checkout of this repo and the dev environment: edits there
-# must appear on the next agent run with no deploy step, so it cannot be made to
-# depend on r10k or on a codavox reseal. Sealing it also fails outright — a
-# working tree carries build artifacts, and .onceover/ holds rspec-puppet fixture
-# symlinks whose targets are absolute macOS host paths, which codavox refuses to
-# unpack.
-#
-# So codavox gets its own environment. See codavox-basedir/README.md.
-codavox::basedir: '/etc/puppetlabs/code/environments/production/codavox-basedir'
-codavox::publish_listen: ':8150'
@@ -34,11 +34,3 @@
 node 'puppet.example.com' {
   include role::puppet_master
 }
-
-# Without this the compiler falls into `node default` and gets profile::base
-# only, so role::compiler never runs on it — which is how it stayed for the whole
-# life of the compiler VM. Onceover compiles role::compiler happily, because
-# compiling a role proves nothing about whether a node is classified into it.
-node 'compiler.example.com' {
-  include role::compiler
-}