Compilation results for gerrit1003.wikimedia.org: System changes detected

Catalog differences

Summary

Resources only in the new catalog

• File[/var/log/rsync-gerrit-home]
• Rsync::Quickdatacopy[gerrit-home]
• File[/var/log/rsync-gerrit-data]
• File[/etc/rsyslog.d/40-rsync-gerrit-data.conf]
• File[/lib/systemd/system/rsync-gerrit-home.service]
• File[/etc/rsyslog.d/40-rsync-gerrit-home.conf]
• Service[rsync-gerrit-data.timer]
• Systemd::Service[rsync-gerrit-data]
• Systemd::Timer[rsync-gerrit-home]
• Rsyslog::Conf[rsync-gerrit-data]
• Exec[systemd daemon-reload for rsync-gerrit-data.timer (rsync-gerrit-data.timer)]
• Systemd::Timer[rsync-gerrit-data]
• File[/lib/systemd/system/rsync-gerrit-data.service]
• Systemd::Syslog[rsync-gerrit-home]
• Systemd::Unit[rsync-gerrit-home.service]
• Exec[systemd daemon-reload for rsync-gerrit-data.service (rsync-gerrit-data.service)]
• File[/etc/logrotate.d/rsync-gerrit-data]
• Systemd::Service[rsync-gerrit-home]
• File[/lib/systemd/system/rsync-gerrit-home.timer]
• Systemd::Unit[rsync-gerrit-home.timer]
• Logrotate::Conf[rsync-gerrit-home]
• Rsync::Quickdatacopy[gerrit-data]
• Systemd::Unit[rsync-gerrit-data.timer]
• Systemd::Unit[rsync-gerrit-data.service]
• File[/usr/local/sbin/sync-gerrit-data-ssl-wrapper]
• Logrotate::Conf[rsync-gerrit-data]
• Systemd::Timer::Job[rsync-gerrit-home]
• Rsyslog::Conf[rsync-gerrit-home]
• File[/usr/local/sbin/sync-gerrit-home-ssl-wrapper]
• Systemd::Timer::Job[rsync-gerrit-data]
• File[/usr/local/sbin/sync-gerrit-home]
• File[/lib/systemd/system/rsync-gerrit-data.timer]
• File[/usr/local/sbin/sync-gerrit-data]
• Service[rsync-gerrit-home.timer]
• Exec[systemd daemon-reload for rsync-gerrit-home.timer (rsync-gerrit-home.timer)]
• File[/etc/logrotate.d/rsync-gerrit-home]
• Systemd::Syslog[rsync-gerrit-data]
• Exec[systemd daemon-reload for rsync-gerrit-home.service (rsync-gerrit-home.service)]

Resources only in the old catalog

• Service[rsync]
• Concat[/etc/rsyncd.conf]
• Concat_fragment[/etc/rsyncd.conf-header]
• Nftables::Service[rsyncd_access_gerrit-data]
• File[/etc/nftables/input/10_rsyncd_access_gerrit-data.nft]
• Firewall::Service[rsyncd_access_gerrit-home]
• Concat::Fragment[/etc/rsyncd.conf-header]
• Concat_file[/etc/rsyncd.conf]
• Concat::Fragment[/etc/rsyncd.conf-gerrit-data]
• Ferm::Service[rsyncd_access_gerrit_data]
• File[/etc/rsync.d]
• Concat_fragment[/etc/rsyncd.conf-gerrit-data]
• Rsync::Server::Module[gerrit-home]
• File[/etc/default/rsync]
• Ferm::Service[rsyncd_access_gerrit_home]
• Concat_fragment[/etc/rsyncd.conf-gerrit-home]
• Class[Rsync::Server]
• Firewall::Service[rsyncd_access_gerrit-data]
• File[/etc/nftables/input/10_rsyncd_access_gerrit-home.nft]
• Rsync::Server::Module[gerrit-data]
• Concat::Fragment[/etc/rsyncd.conf-gerrit-home]
• Nftables::Service[rsyncd_access_gerrit-home]

Resources modified

• File[/etc/rsync.d]

  Parameters differences:

  --- File[/etc/rsync.d].orig
  +++ File[/etc/rsync.d]
  
  -    ensure  => absent
  -    group   => root
  -    owner   => root
  -    purge   => True
  -    recurse => True
  -    force   => True
  

• Systemd::Syslog[rsync-gerrit-data]

  Parameters differences:

  --- Systemd::Syslog[rsync-gerrit-data].orig
  +++ Systemd::Syslog[rsync-gerrit-data]
  
  +    owner                  => root
  +    readable_by            => all
  +    programname_comparison => startswith
  +    ensure                 => absent
  +    log_filename           => syslog.log
  +    group                  => root
  +    force_stop             => True
  +    base_dir               => /var/log
  

• File[/etc/rsyslog.d/40-rsync-gerrit-data.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-rsync-gerrit-data.conf].orig
  +++ File[/etc/rsyslog.d/40-rsync-gerrit-data.conf]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    notify => Service[rsyslog]
  

  Content differences:

  --- /etc/rsyslog.d/40-rsync-gerrit-data.conf.orig
  +++ /etc/rsyslog.d/40-rsync-gerrit-data.conf
  @@ -0,0 +1,10 @@
  +# rsyslog.conf(5) configuration file for services.
  +# This file is managed by Puppet.
  +if $programname startswith "rsync-gerrit-data" then {
  +    action(
  +        type="omfile" file="/var/log/rsync-gerrit-data/syslog.log"
  +        fileOwner="root" fileGroup="root"
  +        fileCreateMode="0644"
  +    )
  +    & stop
  +}

• Rsyslog::Conf[rsync-gerrit-data]

  Parameters differences:

  --- Rsyslog::Conf[rsync-gerrit-data].orig
  +++ Rsyslog::Conf[rsync-gerrit-data]
  
  +    mode     => 0444
  +    require  => File[/var/log/rsync-gerrit-data]
  +    ensure   => absent
  +    priority => 40
  

• Systemd::Timer[rsync-gerrit-data]

  Parameters differences:

  --- Systemd::Timer[rsync-gerrit-data].orig
  +++ Systemd::Timer[rsync-gerrit-data]
  
  +    splay              => 0
  +    ensure             => absent
  +    accuracy           => 15sec
  +    fixed_random_delay => False
  +    unit_name          => rsync-gerrit-data.service
  +    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}]
  

• Exec[systemd daemon-reload for rsync-gerrit-data.service (rsync-gerrit-data.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for rsync-gerrit-data.service (rsync-gerrit-data.service)].orig
  +++ Exec[systemd daemon-reload for rsync-gerrit-data.service (rsync-gerrit-data.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Service[rsync-gerrit-data.timer]

  Parameters differences:

  --- Service[rsync-gerrit-data.timer].orig
  +++ Service[rsync-gerrit-data.timer]
  
  +    enable   => False
  +    ensure   => stopped
  +    provider => systemd
  +    before   => ['Exec[systemd daemon-reload for rsync-gerrit-data.timer (rsync-gerrit-data.timer)]']
  

• Concat_file[/etc/rsyncd.conf]

  Parameters differences:

  --- Concat_file[/etc/rsyncd.conf].orig
  +++ Concat_file[/etc/rsyncd.conf]
  
  -    mode           => 0444
  -    tag            => _etc_rsyncd.conf
  -    order          => alpha
  -    owner          => root
  -    ensure_newline => False
  -    backup         => puppet
  -    force          => False
  -    replace        => True
  -    group          => root
  -    show_diff      => True
  -    format         => plain
  

• Rsync::Server::Module[gerrit-home]

  Parameters differences:

  --- Rsync::Server::Module[gerrit-home].orig
  +++ Rsync::Server::Module[gerrit-home]
  
  -    write_only      => no
  -    hosts_allow     => ['gerrit2003.wikimedia.org']
  -    lock_file       => /var/run/rsyncd.lock
  -    read_only       => no
  -    uid             => 0
  -    path            => /srv/home-gerrit2003.wikimedia.org
  -    qos_low         => False
  -    auto_firewall   => True
  -    ensure          => present
  -    chroot          => True
  -    gid             => 0
  -    list            => yes
  -    max_connections => 0
  

• Nftables::Service[rsyncd_access_gerrit-data]

  Parameters differences:

  --- Nftables::Service[rsyncd_access_gerrit-data].orig
  +++ Nftables::Service[rsyncd_access_gerrit-data]
  
  -    desc                => 
  -    unrestricted_access => False
  -    src_ips             => ['208.80.153.116', '2620:0:860:4:208:80:153:116']
  -    prio                => 10
  -    proto               => tcp
  -    notrack             => False
  -    ensure              => present
  -    port                => [873, 1873]
  

• Systemd::Unit[rsync-gerrit-data.timer]

  Parameters differences:

  --- Systemd::Unit[rsync-gerrit-data.timer].orig
  +++ Systemd::Unit[rsync-gerrit-data.timer]
  
  +    restart           => False
  +    ensure            => absent
  +    require           => ['Class[Systemd]']
  +    override          => False
  +    unit              => rsync-gerrit-data.timer
  +    override_filename => puppet-override.conf
  

• File[/etc/default/rsync]

  Parameters differences:

  --- File[/etc/default/rsync].orig
  +++ File[/etc/default/rsync]
  
  -    mode   => 0444
  -    ensure => present
  -    group  => root
  -    owner  => root
  

  Content differences:

  --- /etc/default/rsync.orig
  +++ /etc/default/rsync
  @@ -1,46 +0,0 @@
  -#####################################################################
  -### THIS FILE IS MANAGED BY PUPPET
  -### puppet:///rsync/rsync.default.erb
  -#####################################################################
  -
  -# defaults file for rsync daemon mode
  -
  -# start rsync in daemon mode from init.d script?
  -#  only allowed values are "true", "false", and "inetd"
  -#  Use "inetd" if you want to start the rsyncd from inetd,
  -#  all this does is prevent the init.d script from printing a message
  -#  about not starting rsyncd (you still need to modify inetd's config yourself).
  -RSYNC_ENABLE=true
  -
  -# which file should be used as the configuration file for rsync.
  -# This file is used instead of the default /etc/rsyncd.conf
  -# Warning: This option has no effect if the daemon is accessed
  -#          using a remote shell. When using a different file for
  -#          rsync you might want to symlink /etc/rsyncd.conf to
  -#          that file.
  -RSYNC_CONFIG_FILE=/etc/rsyncd.conf
  -
  -# what extra options to give rsync --daemon?
  -#  that excludes the --daemon; that's always done in the init.d script
  -#  Possibilities are:
  -#   --address=123.45.67.89		(bind to a specific IP address)
  -#   --port=8730				(bind to specified port; default 873)
  -RSYNC_OPTS=''
  -
  -# run rsyncd at a nice level?
  -#  the rsync daemon can impact performance due to much I/O and CPU usage,
  -#  so you may want to run it at a nicer priority than the default priority.
  -#  Allowed values are 0 - 19 inclusive; 10 is a reasonable value.
  -RSYNC_NICE=''
  -
  -# run rsyncd with ionice?
  -#  "ionice" does for IO load what "nice" does for CPU load.
  -#  As rsync is often used for backups which aren't all that time-critical,
  -#  reducing the rsync IO priority will benefit the rest of the system.
  -#  See the manpage for ionice for allowed options.
  -#  -c3 is recommended, this will run rsync IO at "idle" priority. Uncomment
  -#  the next line to activate this.
  -# RSYNC_IONICE='-c3'
  -
  -# Don't forget to create an appropriate config file,
  -# else the daemon will not start.

• Class[Rsync::Server]

  Parameters differences:

  --- Class[Rsync::Server].orig
  +++ Class[Rsync::Server]
  
  -    ensure_service => running
  -    timeout        => 300
  -    rsync_opts     => []
  -    address        => 0.0.0.0
  -    rsyncd_conf    => {}
  -    use_chroot     => yes
  

• File[/usr/local/sbin/sync-gerrit-data-ssl-wrapper]

  Parameters differences:

  --- File[/usr/local/sbin/sync-gerrit-data-ssl-wrapper].orig
  +++ File[/usr/local/sbin/sync-gerrit-data-ssl-wrapper]
  
  +    mode   => 0755
  +    ensure => present
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /usr/local/sbin/sync-gerrit-data-ssl-wrapper.orig
  +++ /usr/local/sbin/sync-gerrit-data-ssl-wrapper
  @@ -0,0 +1,29 @@
  +#!/bin/sh
  +# This file is managed by Puppet
  +#
  +# This script is expected to be used as the --rsh argument to rsync.
  +# It will wrap rsync's communication in stunnel, and validate the
  +# server's cert vs the Puppet CA.
  +
  +set -eu
  +
  +cleanup() {
  +    [ -f "$CONFIG" ] && rm -f "$CONFIG"
  +}
  +trap cleanup EXIT
  +
  +CONFIG=$(mktemp -t sync-ssl-wrapper.stunnel.conf.XXXXXXXX)
  +
  +RSYNC_SSL_PORT=${RSYNC_SSL_PORT:-1873}
  +
  +cat > "$CONFIG" <<EOF
  +foreground  = yes
  +client      = yes
  +connect     = $1:$RSYNC_SSL_PORT
  +CAfile      = /var/lib/puppet/ssl/certs/ca.pem
  +cert        = /var/lib/puppet/ssl/certs/gerrit1003.wikimedia.org.pem
  +key         = /var/lib/puppet/ssl/private_keys/gerrit1003.wikimedia.org.pem
  +verifyChain = yes
  +EOF
  +
  +/usr/bin/stunnel4 "$CONFIG"

• File[/etc/nftables/input/10_rsyncd_access_gerrit-home.nft]

  Parameters differences:

  --- File[/etc/nftables/input/10_rsyncd_access_gerrit-home.nft].orig
  +++ File[/etc/nftables/input/10_rsyncd_access_gerrit-home.nft]
  
  -    tag    => nft
  -    mode   => 0444
  -    ensure => present
  -    group  => root
  -    owner  => root
  -    notify => ['Service[nftables]']
  

  Content differences:

  --- /etc/nftables/input/10_rsyncd_access_gerrit-home.nft.orig
  +++ /etc/nftables/input/10_rsyncd_access_gerrit-home.nft
  @@ -1,4 +0,0 @@
  -# Managed by puppet
  -# 
  -ip saddr { 208.80.153.116 } tcp dport { 873, 1873 } accept
  -ip6 saddr { 2620:0:860:4:208:80:153:116 } tcp dport { 873, 1873 } accept

• Systemd::Unit[rsync-gerrit-data.service]

  Parameters differences:

  --- Systemd::Unit[rsync-gerrit-data.service].orig
  +++ Systemd::Unit[rsync-gerrit-data.service]
  
  +    restart           => False
  +    ensure            => absent
  +    require           => ['Class[Systemd]']
  +    override          => False
  +    unit              => rsync-gerrit-data.service
  +    override_filename => puppet-override.conf
  

• File[/etc/logrotate.d/rsync-gerrit-data]

  Parameters differences:

  --- File[/etc/logrotate.d/rsync-gerrit-data].orig
  +++ File[/etc/logrotate.d/rsync-gerrit-data]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/rsync-gerrit-data.orig
  +++ /etc/logrotate.d/rsync-gerrit-data
  @@ -0,0 +1,12 @@
  +# logrotate(8) config for rsync-gerrit-data
  +
  +/var/log/rsync-gerrit-data/*.log {
  +    daily
  +    copytruncate
  +    missingok
  +    compress
  +    delaycompress
  +    notifempty
  +    rotate 15
  +    size 256M
  +}

• File[/usr/local/sbin/sync-gerrit-data]

  Parameters differences:

  --- File[/usr/local/sbin/sync-gerrit-data].orig
  +++ File[/usr/local/sbin/sync-gerrit-data]
  
  +    mode   => 0755
  +    ensure => present
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /usr/local/sbin/sync-gerrit-data.orig
  +++ /usr/local/sbin/sync-gerrit-data
  @@ -0,0 +1,2 @@
  +#!/bin/sh
  +/usr/bin/rsync --rsh /usr/local/sbin/sync-gerrit-data-ssl-wrapper -a  --chown=gerrit:gerrit  rsync://gerrit2003.wikimedia.org/gerrit-data /srv/gerrit/

• File[/usr/local/sbin/sync-gerrit-home]

  Parameters differences:

  --- File[/usr/local/sbin/sync-gerrit-home].orig
  +++ File[/usr/local/sbin/sync-gerrit-home]
  
  +    mode   => 0755
  +    ensure => present
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /usr/local/sbin/sync-gerrit-home.orig
  +++ /usr/local/sbin/sync-gerrit-home
  @@ -0,0 +1,2 @@
  +#!/bin/sh
  +/usr/bin/rsync --rsh /usr/local/sbin/sync-gerrit-home-ssl-wrapper -a  --chown=gerrit:gerrit  rsync://gerrit2003.wikimedia.org/gerrit-home /srv/home-gerrit2003.wikimedia.org/

• File[/etc/nftables/input/10_rsyncd_access_gerrit-data.nft]

  Parameters differences:

  --- File[/etc/nftables/input/10_rsyncd_access_gerrit-data.nft].orig
  +++ File[/etc/nftables/input/10_rsyncd_access_gerrit-data.nft]
  
  -    tag    => nft
  -    mode   => 0444
  -    ensure => present
  -    group  => root
  -    owner  => root
  -    notify => ['Service[nftables]']
  

  Content differences:

  --- /etc/nftables/input/10_rsyncd_access_gerrit-data.nft.orig
  +++ /etc/nftables/input/10_rsyncd_access_gerrit-data.nft
  @@ -1,4 +0,0 @@
  -# Managed by puppet
  -# 
  -ip saddr { 208.80.153.116 } tcp dport { 873, 1873 } accept
  -ip6 saddr { 2620:0:860:4:208:80:153:116 } tcp dport { 873, 1873 } accept

• Class[Profile::Apt]

  Parameters differences:

  --- Class[Profile::Apt].orig
  +++ Class[Profile::Apt]
  
  @@
  -    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[megacli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[bacula-fd]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[openjdk-17-dbg]', 'Package[python3-virtualenv]', 'Package[virtualenv]', 'Package[python3-pip]', 'Package[apache2]', 'Package[links]', 'Package[rsync]', 'Package[envoyproxy]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[git-lfs]', 'Package[python3-venv]', 'Package[stunnel4]', 'Package[mtail]', 'Package[prometheus-apache-exporter]']
  +    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[megacli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[bacula-fd]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[openjdk-17-dbg]', 'Package[python3-virtualenv]', 'Package[virtualenv]', 'Package[python3-pip]', 'Package[apache2]', 'Package[links]', 'Package[envoyproxy]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[git-lfs]', 'Package[rsync]', 'Package[python3-venv]', 'Package[stunnel4]', 'Package[mtail]', 'Package[prometheus-apache-exporter]']
  

• File[/lib/systemd/system/rsync-gerrit-home.timer]

  Parameters differences:

  --- File[/lib/systemd/system/rsync-gerrit-home.timer].orig
  +++ File[/lib/systemd/system/rsync-gerrit-home.timer]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    notify => Exec[systemd daemon-reload for rsync-gerrit-home.timer (rsync-gerrit-home.timer)]
  

  Content differences:

  --- /lib/systemd/system/rsync-gerrit-home.timer.orig
  +++ /lib/systemd/system/rsync-gerrit-home.timer
  @@ -0,0 +1,12 @@
  +[Unit]
  +Description=Periodic execution of rsync-gerrit-home.service
  +
  +[Timer]
  +Unit=rsync-gerrit-home.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnCalendar=*-*-* *:00/10:00
  +RandomizedDelaySec=0
  +
  +[Install]
  +WantedBy=multi-user.target

• File[/var/log/rsync-gerrit-data]

  Parameters differences:

  --- File[/var/log/rsync-gerrit-data].orig
  +++ File[/var/log/rsync-gerrit-data]
  
  +    mode   => 0755
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    backup => False
  +    force  => True
  

• File[/lib/systemd/system/rsync-gerrit-home.service]

  Parameters differences:

  --- File[/lib/systemd/system/rsync-gerrit-home.service].orig
  +++ File[/lib/systemd/system/rsync-gerrit-home.service]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    notify => Exec[systemd daemon-reload for rsync-gerrit-home.service (rsync-gerrit-home.service)]
  

  Content differences:

  --- /lib/systemd/system/rsync-gerrit-home.service.orig
  +++ /lib/systemd/system/rsync-gerrit-home.service
  @@ -0,0 +1,9 @@
  +[Unit]
  +Description=Transfer data periodically between hosts
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=root
  +ExecStart=/usr/local/sbin/sync-gerrit-home
  +SuccessExitStatus=24

• Concat[/etc/rsyncd.conf]

  Parameters differences:

  --- Concat[/etc/rsyncd.conf].orig
  +++ Concat[/etc/rsyncd.conf]
  
  -    mode           => 0444
  -    order          => alpha
  -    owner          => root
  -    warn           => False
  -    backup         => puppet
  -    ensure_newline => False
  -    path           => /etc/rsyncd.conf
  -    replace        => True
  -    force          => False
  -    ensure         => present
  -    group          => root
  -    show_diff      => True
  -    format         => plain
  

• Concat_fragment[/etc/rsyncd.conf-gerrit-data]

  Parameters differences:

  --- Concat_fragment[/etc/rsyncd.conf-gerrit-data].orig
  +++ Concat_fragment[/etc/rsyncd.conf-gerrit-data]
  
  -    tag    => _etc_rsyncd.conf
  -    order  => 10
  -    target => /etc/rsyncd.conf
  

  Content differences:

  --- /etc/rsyncd.conf-gerrit-data.orig
  +++ /etc/rsyncd.conf-gerrit-data
  @@ -1,20 +0,0 @@
  -# This file is being maintained by Puppet.
  -# DO NOT EDIT
  -
  -[ gerrit-data ]
  -path            = /srv/gerrit
  -read only       = no
  -write only      = no
  -list            = yes
  -uid             = 0
  -gid             = 0
  -use chroot      = yes
  -
  -
  -max connections = 0
  -
  -
  -
  -
  -hosts allow = gerrit2003.wikimedia.org localhost
  -

• Ferm::Service[rsyncd_access_gerrit_data]

  Parameters differences:

  --- Ferm::Service[rsyncd_access_gerrit_data].orig
  +++ Ferm::Service[rsyncd_access_gerrit_data]
  
  -    desc                => 
  -    unrestricted_access => False
  -    prio                => 10
  -    proto               => tcp
  -    notrack             => False
  -    ensure              => present
  -    port                => [873, 1873]
  -    srange              => ['gerrit2003.wikimedia.org']
  

• File[/etc/rsyslog.d/40-rsync-gerrit-home.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-rsync-gerrit-home.conf].orig
  +++ File[/etc/rsyslog.d/40-rsync-gerrit-home.conf]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    notify => Service[rsyslog]
  

  Content differences:

  --- /etc/rsyslog.d/40-rsync-gerrit-home.conf.orig
  +++ /etc/rsyslog.d/40-rsync-gerrit-home.conf
  @@ -0,0 +1,10 @@
  +# rsyslog.conf(5) configuration file for services.
  +# This file is managed by Puppet.
  +if $programname startswith "rsync-gerrit-home" then {
  +    action(
  +        type="omfile" file="/var/log/rsync-gerrit-home/syslog.log"
  +        fileOwner="root" fileGroup="root"
  +        fileCreateMode="0644"
  +    )
  +    & stop
  +}

• File[/lib/systemd/system/rsync-gerrit-data.timer]

  Parameters differences:

  --- File[/lib/systemd/system/rsync-gerrit-data.timer].orig
  +++ File[/lib/systemd/system/rsync-gerrit-data.timer]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    notify => Exec[systemd daemon-reload for rsync-gerrit-data.timer (rsync-gerrit-data.timer)]
  

  Content differences:

  --- /lib/systemd/system/rsync-gerrit-data.timer.orig
  +++ /lib/systemd/system/rsync-gerrit-data.timer
  @@ -0,0 +1,12 @@
  +[Unit]
  +Description=Periodic execution of rsync-gerrit-data.service
  +
  +[Timer]
  +Unit=rsync-gerrit-data.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnCalendar=*-*-* *:00/10:00
  +RandomizedDelaySec=0
  +
  +[Install]
  +WantedBy=multi-user.target

• Rsync::Quickdatacopy[gerrit-home]

  Parameters differences:

  --- Rsync::Quickdatacopy[gerrit-home].orig
  +++ Rsync::Quickdatacopy[gerrit-home]
  
  +    ignore_missing_file_errors => True
  +    dest_host                  => gerrit1003.wikimedia.org
  +    module_path                => /srv/home-gerrit2003.wikimedia.org
  +    progress                   => False
  +    auto_sync                  => False
  +    chown                      => gerrit:gerrit
  +    delete                     => False
  +    ensure                     => present
  +    source_host                => gerrit2003.wikimedia.org
  +    server_uses_stunnel        => True
  +    auto_interval              => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}
  

• Systemd::Syslog[rsync-gerrit-home]

  Parameters differences:

  --- Systemd::Syslog[rsync-gerrit-home].orig
  +++ Systemd::Syslog[rsync-gerrit-home]
  
  +    owner                  => root
  +    readable_by            => all
  +    programname_comparison => startswith
  +    ensure                 => absent
  +    log_filename           => syslog.log
  +    group                  => root
  +    force_stop             => True
  +    base_dir               => /var/log
  

• Systemd::Service[rsync-gerrit-home]

  Parameters differences:

  --- Systemd::Service[rsync-gerrit-home].orig
  +++ Systemd::Service[rsync-gerrit-home]
  
  +    restart                  => False
  +    monitoring_enabled       => False
  +    monitoring_critical      => False
  +    service_params           => {}
  +    require                  => Systemd::Unit[rsync-gerrit-home.service]
  +    ensure                   => absent
  +    migration_task           => T407130
  +    override                 => False
  +    monitoring_contact_group => admins
  +    unit_type                => timer
  

• Systemd::Timer::Job[rsync-gerrit-data]

  Parameters differences:

  --- Systemd::Timer::Job[rsync-gerrit-data].orig
  +++ Systemd::Timer::Job[rsync-gerrit-data]
  
  +    success_exit_status       => [24]
  +    environment               => {}
  +    command                   => /usr/local/sbin/sync-gerrit-data
  +    syslog_match_startswith   => True
  +    monitoring_enabled        => False
  +    logfile_perms             => all
  +    syslog_force_stop         => True
  +    ignore_errors             => False
  +    send_mail_to              => root@gerrit1003.wikimedia.org
  +    ensure                    => absent
  +    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}
  +    logfile_name              => syslog.log
  +    fixed_random_delay        => False
  +    description               => Transfer data periodically between hosts
  +    user                      => root
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    send_mail_only_on_error   => True
  +    private_tmp               => False
  +    logfile_group             => root
  +    monitoring_contact_groups => admins
  +    send_mail                 => False
  +    logging_enabled           => True
  +    logfile_basedir           => /var/log
  

• Exec[systemd daemon-reload for rsync-gerrit-data.timer (rsync-gerrit-data.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for rsync-gerrit-data.timer (rsync-gerrit-data.timer)].orig
  +++ Exec[systemd daemon-reload for rsync-gerrit-data.timer (rsync-gerrit-data.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• File[/lib/systemd/system/rsync-gerrit-data.service]

  Parameters differences:

  --- File[/lib/systemd/system/rsync-gerrit-data.service].orig
  +++ File[/lib/systemd/system/rsync-gerrit-data.service]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    notify => Exec[systemd daemon-reload for rsync-gerrit-data.service (rsync-gerrit-data.service)]
  

  Content differences:

  --- /lib/systemd/system/rsync-gerrit-data.service.orig
  +++ /lib/systemd/system/rsync-gerrit-data.service
  @@ -0,0 +1,9 @@
  +[Unit]
  +Description=Transfer data periodically between hosts
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=root
  +ExecStart=/usr/local/sbin/sync-gerrit-data
  +SuccessExitStatus=24

• Firewall::Service[rsyncd_access_gerrit-data]

  Parameters differences:

  --- Firewall::Service[rsyncd_access_gerrit-data].orig
  +++ Firewall::Service[rsyncd_access_gerrit-data]
  
  -    desc                => 
  -    unrestricted_access => False
  -    prio                => 10
  -    proto               => tcp
  -    notrack             => False
  -    ensure              => present
  -    port                => [873, 1873]
  -    srange              => ['gerrit2003.wikimedia.org']
  

• File[/etc/logrotate.d/rsync-gerrit-home]

  Parameters differences:

  --- File[/etc/logrotate.d/rsync-gerrit-home].orig
  +++ File[/etc/logrotate.d/rsync-gerrit-home]
  
  +    mode   => 0444
  +    ensure => absent
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /etc/logrotate.d/rsync-gerrit-home.orig
  +++ /etc/logrotate.d/rsync-gerrit-home
  @@ -0,0 +1,12 @@
  +# logrotate(8) config for rsync-gerrit-home
  +
  +/var/log/rsync-gerrit-home/*.log {
  +    daily
  +    copytruncate
  +    missingok
  +    compress
  +    delaycompress
  +    notifempty
  +    rotate 15
  +    size 256M
  +}

• Class[Adduser]

  Parameters differences:

  --- Class[Adduser].orig
  +++ Class[Adduser]
  
  @@
  -    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[megacli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[bacula-fd]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[openjdk-17-dbg]', 'Package[python3-virtualenv]', 'Package[virtualenv]', 'Package[python3-pip]', 'Package[apache2]', 'Package[links]', 'Package[rsync]', 'Package[envoyproxy]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[git-lfs]', 'Package[python3-venv]', 'Package[gerrit/gerrit]', 'Package[gervert/deploy]', 'Package[stunnel4]', 'Package[mtail]', 'Package[prometheus-apache-exporter]']
  +    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[megacli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[bacula-fd]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[openjdk-17-dbg]', 'Package[python3-virtualenv]', 'Package[virtualenv]', 'Package[python3-pip]', 'Package[apache2]', 'Package[links]', 'Package[envoyproxy]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[git-lfs]', 'Package[rsync]', 'Package[python3-venv]', 'Package[gerrit/gerrit]', 'Package[gervert/deploy]', 'Package[stunnel4]', 'Package[mtail]', 'Package[prometheus-apache-exporter]']
  

• Concat::Fragment[/etc/rsyncd.conf-gerrit-data]

  Parameters differences:

  --- Concat::Fragment[/etc/rsyncd.conf-gerrit-data].orig
  +++ Concat::Fragment[/etc/rsyncd.conf-gerrit-data]
  
  -    order  => 10
  -    target => /etc/rsyncd.conf
  

• Concat::Fragment[/etc/rsyncd.conf-header]

  Parameters differences:

  --- Concat::Fragment[/etc/rsyncd.conf-header].orig
  +++ Concat::Fragment[/etc/rsyncd.conf-header]
  
  -    order  => 01
  -    target => /etc/rsyncd.conf
  

• Rsyslog::Conf[rsync-gerrit-home]

  Parameters differences:

  --- Rsyslog::Conf[rsync-gerrit-home].orig
  +++ Rsyslog::Conf[rsync-gerrit-home]
  
  +    mode     => 0444
  +    require  => File[/var/log/rsync-gerrit-home]
  +    ensure   => absent
  +    priority => 40
  

• Ferm::Service[rsyncd_access_gerrit_home]

  Parameters differences:

  --- Ferm::Service[rsyncd_access_gerrit_home].orig
  +++ Ferm::Service[rsyncd_access_gerrit_home]
  
  -    desc                => 
  -    unrestricted_access => False
  -    prio                => 10
  -    proto               => tcp
  -    notrack             => False
  -    ensure              => present
  -    port                => [873, 1873]
  -    srange              => ['gerrit2003.wikimedia.org']
  

• Concat::Fragment[/etc/rsyncd.conf-gerrit-home]

  Parameters differences:

  --- Concat::Fragment[/etc/rsyncd.conf-gerrit-home].orig
  +++ Concat::Fragment[/etc/rsyncd.conf-gerrit-home]
  
  -    order  => 10
  -    target => /etc/rsyncd.conf
  

• Exec[systemd daemon-reload for rsync-gerrit-home.service (rsync-gerrit-home.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for rsync-gerrit-home.service (rsync-gerrit-home.service)].orig
  +++ Exec[systemd daemon-reload for rsync-gerrit-home.service (rsync-gerrit-home.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• File[/usr/local/sbin/sync-gerrit-home-ssl-wrapper]

  Parameters differences:

  --- File[/usr/local/sbin/sync-gerrit-home-ssl-wrapper].orig
  +++ File[/usr/local/sbin/sync-gerrit-home-ssl-wrapper]
  
  +    mode   => 0755
  +    ensure => present
  +    group  => root
  +    owner  => root
  

  Content differences:

  --- /usr/local/sbin/sync-gerrit-home-ssl-wrapper.orig
  +++ /usr/local/sbin/sync-gerrit-home-ssl-wrapper
  @@ -0,0 +1,29 @@
  +#!/bin/sh
  +# This file is managed by Puppet
  +#
  +# This script is expected to be used as the --rsh argument to rsync.
  +# It will wrap rsync's communication in stunnel, and validate the
  +# server's cert vs the Puppet CA.
  +
  +set -eu
  +
  +cleanup() {
  +    [ -f "$CONFIG" ] && rm -f "$CONFIG"
  +}
  +trap cleanup EXIT
  +
  +CONFIG=$(mktemp -t sync-ssl-wrapper.stunnel.conf.XXXXXXXX)
  +
  +RSYNC_SSL_PORT=${RSYNC_SSL_PORT:-1873}
  +
  +cat > "$CONFIG" <<EOF
  +foreground  = yes
  +client      = yes
  +connect     = $1:$RSYNC_SSL_PORT
  +CAfile      = /var/lib/puppet/ssl/certs/ca.pem
  +cert        = /var/lib/puppet/ssl/certs/gerrit1003.wikimedia.org.pem
  +key         = /var/lib/puppet/ssl/private_keys/gerrit1003.wikimedia.org.pem
  +verifyChain = yes
  +EOF
  +
  +/usr/bin/stunnel4 "$CONFIG"

• Firewall::Service[rsyncd_access_gerrit-home]

  Parameters differences:

  --- Firewall::Service[rsyncd_access_gerrit-home].orig
  +++ Firewall::Service[rsyncd_access_gerrit-home]
  
  -    desc                => 
  -    unrestricted_access => False
  -    prio                => 10
  -    proto               => tcp
  -    notrack             => False
  -    ensure              => present
  -    port                => [873, 1873]
  -    srange              => ['gerrit2003.wikimedia.org']
  

• Logrotate::Conf[rsync-gerrit-data]

  Parameters differences:

  --- Logrotate::Conf[rsync-gerrit-data].orig
  +++ Logrotate::Conf[rsync-gerrit-data]
  
  +    ensure => absent
  

• Service[rsync-gerrit-home.timer]

  Parameters differences:

  --- Service[rsync-gerrit-home.timer].orig
  +++ Service[rsync-gerrit-home.timer]
  
  +    enable   => False
  +    ensure   => stopped
  +    provider => systemd
  +    before   => ['Exec[systemd daemon-reload for rsync-gerrit-home.timer (rsync-gerrit-home.timer)]']
  

• Exec[systemd daemon-reload for rsync-gerrit-home.timer (rsync-gerrit-home.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for rsync-gerrit-home.timer (rsync-gerrit-home.timer)].orig
  +++ Exec[systemd daemon-reload for rsync-gerrit-home.timer (rsync-gerrit-home.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• File[/var/log/rsync-gerrit-home]

  Parameters differences:

  --- File[/var/log/rsync-gerrit-home].orig
  +++ File[/var/log/rsync-gerrit-home]
  
  +    mode   => 0755
  +    ensure => absent
  +    group  => root
  +    owner  => root
  +    backup => False
  +    force  => True
  

• Concat_fragment[/etc/rsyncd.conf-header]

  Parameters differences:

  --- Concat_fragment[/etc/rsyncd.conf-header].orig
  +++ Concat_fragment[/etc/rsyncd.conf-header]
  
  -    tag    => _etc_rsyncd.conf
  -    order  => 01
  -    target => /etc/rsyncd.conf
  

  Content differences:

  --- /etc/rsyncd.conf-header.orig
  +++ /etc/rsyncd.conf-header
  @@ -1,11 +0,0 @@
  -# This file is being maintained by Puppet.
  -# DO NOT EDIT
  -
  -uid = nobody
  -gid = nogroup
  -use chroot = yes
  -
  -log format = %t %a %m %f %b
  -syslog facility = local3
  -timeout = 300
  -address = 0.0.0.0

• Service[rsync]

  Parameters differences:

  --- Service[rsync].orig
  +++ Service[rsync]
  
  -    enable    => True
  -    require   => Package[rsync]
  -    ensure    => running
  -    subscribe => ['Concat[/etc/rsyncd.conf]', 'File[/etc/default/rsync]']
  

• Rsync::Server::Module[gerrit-data]

  Parameters differences:

  --- Rsync::Server::Module[gerrit-data].orig
  +++ Rsync::Server::Module[gerrit-data]
  
  -    write_only      => no
  -    hosts_allow     => ['gerrit2003.wikimedia.org']
  -    lock_file       => /var/run/rsyncd.lock
  -    read_only       => no
  -    uid             => 0
  -    path            => /srv/gerrit
  -    qos_low         => False
  -    auto_firewall   => True
  -    ensure          => present
  -    chroot          => True
  -    gid             => 0
  -    list            => yes
  -    max_connections => 0
  

• Systemd::Timer::Job[rsync-gerrit-home]

  Parameters differences:

  --- Systemd::Timer::Job[rsync-gerrit-home].orig
  +++ Systemd::Timer::Job[rsync-gerrit-home]
  
  +    success_exit_status       => [24]
  +    environment               => {}
  +    command                   => /usr/local/sbin/sync-gerrit-home
  +    syslog_match_startswith   => True
  +    monitoring_enabled        => False
  +    logfile_perms             => all
  +    syslog_force_stop         => True
  +    ignore_errors             => False
  +    send_mail_to              => root@gerrit1003.wikimedia.org
  +    ensure                    => absent
  +    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}
  +    logfile_name              => syslog.log
  +    fixed_random_delay        => False
  +    description               => Transfer data periodically between hosts
  +    user                      => root
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    send_mail_only_on_error   => True
  +    private_tmp               => False
  +    logfile_group             => root
  +    monitoring_contact_groups => admins
  +    send_mail                 => False
  +    logging_enabled           => True
  +    logfile_basedir           => /var/log
  

• Systemd::Timer[rsync-gerrit-home]

  Parameters differences:

  --- Systemd::Timer[rsync-gerrit-home].orig
  +++ Systemd::Timer[rsync-gerrit-home]
  
  +    splay              => 0
  +    ensure             => absent
  +    accuracy           => 15sec
  +    fixed_random_delay => False
  +    unit_name          => rsync-gerrit-home.service
  +    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}]
  

• Systemd::Service[rsync-gerrit-data]

  Parameters differences:

  --- Systemd::Service[rsync-gerrit-data].orig
  +++ Systemd::Service[rsync-gerrit-data]
  
  +    restart                  => False
  +    monitoring_enabled       => False
  +    monitoring_critical      => False
  +    service_params           => {}
  +    require                  => Systemd::Unit[rsync-gerrit-data.service]
  +    ensure                   => absent
  +    migration_task           => T407130
  +    override                 => False
  +    monitoring_contact_group => admins
  +    unit_type                => timer
  

• Systemd::Unit[rsync-gerrit-home.service]

  Parameters differences:

  --- Systemd::Unit[rsync-gerrit-home.service].orig
  +++ Systemd::Unit[rsync-gerrit-home.service]
  
  +    restart           => False
  +    ensure            => absent
  +    require           => ['Class[Systemd]']
  +    override          => False
  +    unit              => rsync-gerrit-home.service
  +    override_filename => puppet-override.conf
  

• Logrotate::Conf[rsync-gerrit-home]

  Parameters differences:

  --- Logrotate::Conf[rsync-gerrit-home].orig
  +++ Logrotate::Conf[rsync-gerrit-home]
  
  +    ensure => absent
  

• Concat_fragment[/etc/rsyncd.conf-gerrit-home]

  Parameters differences:

  --- Concat_fragment[/etc/rsyncd.conf-gerrit-home].orig
  +++ Concat_fragment[/etc/rsyncd.conf-gerrit-home]
  
  -    tag    => _etc_rsyncd.conf
  -    order  => 10
  -    target => /etc/rsyncd.conf
  

  Content differences:

  --- /etc/rsyncd.conf-gerrit-home.orig
  +++ /etc/rsyncd.conf-gerrit-home
  @@ -1,20 +0,0 @@
  -# This file is being maintained by Puppet.
  -# DO NOT EDIT
  -
  -[ gerrit-home ]
  -path            = /srv/home-gerrit2003.wikimedia.org
  -read only       = no
  -write only      = no
  -list            = yes
  -uid             = 0
  -gid             = 0
  -use chroot      = yes
  -
  -
  -max connections = 0
  -
  -
  -
  -
  -hosts allow = gerrit2003.wikimedia.org localhost
  -

• Rsync::Quickdatacopy[gerrit-data]

  Parameters differences:

  --- Rsync::Quickdatacopy[gerrit-data].orig
  +++ Rsync::Quickdatacopy[gerrit-data]
  
  +    ignore_missing_file_errors => True
  +    dest_host                  => gerrit1003.wikimedia.org
  +    module_path                => /srv/gerrit
  +    progress                   => False
  +    auto_sync                  => False
  +    chown                      => gerrit:gerrit
  +    delete                     => False
  +    ensure                     => present
  +    source_host                => gerrit2003.wikimedia.org
  +    server_uses_stunnel        => True
  +    auto_interval              => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}
  

• Nftables::Service[rsyncd_access_gerrit-home]

  Parameters differences:

  --- Nftables::Service[rsyncd_access_gerrit-home].orig
  +++ Nftables::Service[rsyncd_access_gerrit-home]
  
  -    desc                => 
  -    unrestricted_access => False
  -    src_ips             => ['208.80.153.116', '2620:0:860:4:208:80:153:116']
  -    prio                => 10
  -    proto               => tcp
  -    notrack             => False
  -    ensure              => present
  -    port                => [873, 1873]
  

• Systemd::Unit[rsync-gerrit-home.timer]

  Parameters differences:

  --- Systemd::Unit[rsync-gerrit-home.timer].orig
  +++ Systemd::Unit[rsync-gerrit-home.timer]
  
  +    restart           => False
  +    ensure            => absent
  +    require           => ['Class[Systemd]']
  +    override          => False
  +    unit              => rsync-gerrit-home.timer
  +    override_filename => puppet-override.conf
  

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Standard Diff