Third mirror, at home, and the machines find it on their own

deb.skillfishos.com is live over HTTPS through the home Nginx Proxy Manager,
serving a copy pushed from the release container. All three mirrors serve the
identical Release, checked by hash rather than assumed.

It goes last in the list on purpose: the upstream bandwidth of a home line does
not carry normal traffic, but as a fallback it is worth as much as the others.

The interesting part is that nobody has to be told about it. A machine that knew
only the first two ran the weekly refresher, fetched the signed list from OVH,
verified it against the archive key it already had, and rewrote its own list with
three entries. Watched it happen on the Fujitsu rather than assuming it would.

Addresses moved to the reserved range: 192.168.5.210 for releases and .211 for
the mirror, with .210 to .220 kept for SkillFishOS. The DHCP pool ends at .40 so
there is nothing to collide with.

A change of address drags more behind it than it looks. All of these pointed at
the old one and had to move with it: the two port-forward rules for the torrent
port on the router, the from= restriction on the mirror's authorised key, the
same restriction on the board's key for --dalla-scheda, the addresses written
inside three scripts, and APT_HOST in the credentials file outside the
repository, which is the one that bit — the publish failed on it twice.

Two guards earned their keep along the way. The sync warned that the mirror had
not received the copy and let the publish finish, because the other two already
had everything; that was a missing host key, not a real outage. And the gh-pages
sync refused to connect to an address whose host key it did not know, which is
exactly what it should do — the key was registered only after comparing its
fingerprint with the one already known for that machine.

Author: Mattia Tadini

scripts/build-debs-ci.sh

@@ -377,11 +377,28 @@ put $P 0644 system/etc/apt/mirrors/skillfishos.list                    etc/apt/m
 put $P 0755 system/usr/local/bin/skillfish-aggiorna-mirror             usr/local/bin/skillfish-aggiorna-mirror
 put $P 0644 system/usr/lib/systemd/system/skillfish-aggiorna-mirror.service usr/lib/systemd/system/skillfish-aggiorna-mirror.service
 put $P 0644 system/usr/lib/systemd/system/skillfish-aggiorna-mirror.timer   usr/lib/systemd/system/skillfish-aggiorna-mirror.timer
-printf '#!/bin/sh\nset -e\n# Il timer che tiene aggiornato l elenco dei mirror. Con deb-systemd-invoke\n# perche% s rispetta la scelta di chi ha disabilitato i servizi.\nif [ "$1" = configure ] && command -v deb-systemd-invoke >/dev/null 2>&1; then\n  systemctl daemon-reload >/dev/null 2>&1 || true\n  deb-systemd-invoke enable --now skillfish-aggiorna-mirror.timer >/dev/null 2>&1 || true\nfi\nexit 0\n' '%s' > "$OUT/$P/DEBIAN/postinst"
-chmod 0755 "$OUT/$P/DEBIAN/postinst"
 ctrl $P "gnupg | gpgv" "SkillFishOS archive keyring and APT source" \
   "The signing key of our archive and the apt source that uses it. Without it apt
 cannot check where a SkillFishOS package came from."
+# ⚠️ DOPO ctrl, non prima: la cartella DEBIAN/ la crea ctrl, e scrivendoci
+# dentro una riga sopra la costruzione moriva con «No such file or directory».
+# Con un heredoc invece che con printf, cosi' non ci sono percentuali da
+# contare ne' barre da proteggere.
+cat > "$OUT/$P/DEBIAN/postinst" <<'POSTINST_KEYRING'
+#!/bin/sh
+set -e
+# Accende il timer che tiene aggiornato l'elenco dei mirror. Con
+# deb-systemd-invoke, che rispetta la scelta di chi i servizi li ha spenti
+# apposta: un pacchetto non riaccende quello che l'amministratore ha disattivato.
+if [ "$1" = configure ]; then
+  systemctl daemon-reload >/dev/null 2>&1 || true
+  if command -v deb-systemd-invoke >/dev/null 2>&1; then
+    deb-systemd-invoke enable --now skillfish-aggiorna-mirror.timer >/dev/null 2>&1 || true
+  fi
+fi
+exit 0
+POSTINST_KEYRING
+chmod 0755 "$OUT/$P/DEBIAN/postinst"
 
 P=skillfish-base
 # La scheda AppStream: senza, la descrizione esiste solo in inglese,
@@ -1062,7 +1079,7 @@ rm -f /tmp/kr.$$ /tmp/krg.$$ /tmp/krf.$$
 check skillfishos-archive-keyring_${VER}_all.deb ./etc/apt/sources.list.d/skillfishos.sources 'Signed-By: /usr/share/keyrings/skillfishos-archive-keyring.gpg'
 # ⚠️ Se questi due non ci sono, la sorgente punta a un elenco che non
 # viene spedito e la macchina resta senza archivio: si controlla.
-check skillfishos-archive-keyring_${VER}_all.deb ./etc/apt/sources.list.d/skillfishos.sources 'URIs: mirror\+file:/etc/apt/mirrors/skillfishos.list'
+check skillfishos-archive-keyring_${VER}_all.deb ./etc/apt/sources.list.d/skillfishos.sources 'URIs: mirror+file:/etc/apt/mirrors/skillfishos.list'
 check skillfishos-archive-keyring_${VER}_all.deb ./etc/apt/mirrors/skillfishos.list 'https://skillfishos.com/apt'
 deve_esserci "$OUT/skillfishos-archive-keyring/usr/local/bin/skillfish-aggiorna-mirror" "keyring: lo script che aggiorna i mirror"
 check skillfishos-archive-keyring_${VER}_all.deb ./etc/apt/sources.list.d/skillfishos.sources 'Suites: aetherium'

scripts/pubblica-tutto.py

@@ -28,7 +28,7 @@
 import time
 import urllib.request
 
-CONTAINER = "192.168.5.103"
+CONTAINER = "192.168.5.210"
 IMPRONTA = "SHA256:+jpokXzLD6d6Stn/FPyuStdtZWOrcS3gS3XkpEWvqA4"
 PW = "47yk2d8r6c"
 QUI = os.path.dirname(os.path.abspath(__file__))
@@ -37,6 +37,7 @@
 MIRROR = [
     ("OVH", "https://skillfishos.com/apt"),
     ("GitHub Pages", "https://mtsistemi.github.io/SkillFishOS"),
+    ("casa", "https://deb.skillfishos.com"),
 ]
 
 

system/etc/apt/mirrors/skillfishos.list

@@ -26,3 +26,7 @@
 
 https://skillfishos.com/apt
 https://mtsistemi.github.io/SkillFishOS
+# Il terzo, in casa: ci arriva una copia gia' firmata da Rilasci-SkillFishOS.
+# Ultimo di proposito: la banda in salita di una linea di casa non regge il
+# traffico normale, ma come riserva vale quanto gli altri.
+https://deb.skillfishos.com

system/usr/local/bin/skillfish-sincronizza-mirror

@@ -0,0 +1,35 @@
+#!/bin/bash
+# Copia l'archivio gia' firmato sul terzo mirror (Mirror-SkillFishOS).
+#
+# ⚠️ SI SPINGE DA QUI, NON SI TIRA DA LA'. Un mirror che tira avrebbe bisogno di
+# una chiave capace di LEGGERE questa macchina, che e' quella che tiene la
+# chiave privata di firma. Meglio il contrario: una chiave qui che sul mirror sa
+# scrivere solo /srv/apt. Se il mirror finisse in mani sbagliate, di qui non si
+# porta via niente.
+#
+# ⚠️ conf/ e db/ RESTANO FUORI. Sono la configurazione e il database di
+# reprepro, cioe' gli arnesi con cui si indicizza e si firma. Sul mirror non
+# servono e non ci devono essere: il posto dove si firma e' uno solo.
+#
+# ⚠️ Un mirror che non risponde NON deve far fallire la pubblicazione. Gli altri
+# hanno gia' ricevuto tutto, e questo si riallinea al giro dopo. Esce comunque
+# 0, ma lo dice forte.
+set -u
+MIRROR="${1:-192.168.5.211}"
+CHIAVE=/root/.ssh/id_mirror
+
+if [ ! -f "$CHIAVE" ]; then
+    echo "manca $CHIAVE: il mirror non e' configurato, salto" >&2
+    exit 0
+fi
+
+if rsync -a --delete --exclude=conf --exclude=db \
+     -e "ssh -i $CHIAVE -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new" \
+     /srv/apt/ "root@$MIRROR:/"; then
+    echo "mirror $MIRROR allineato"
+else
+    echo "ATTENZIONE: il mirror $MIRROR non ha ricevuto la copia." >&2
+    echo "            Gli altri mirror sono a posto; questo resta indietro" >&2
+    echo "            e si riallinea alla prossima pubblicazione." >&2
+fi
+exit 0