Name:           rgoon-sync
Version:        0.1.0
Release:        2%{?dist}
Summary:        Synchronization layer for RepoGoon instances
License:        MPL-2.0
URL:            https://repogoon.org/repo/repogoon-org/rgoon-sync
Source0:        %{url}/archive/%{version}/%{name}-%{version}.tar.gz
BuildArch:      noarch

BuildRequires:  git-core
BuildRequires:  nodejs >= 22
BuildRequires:  systemd
BuildRequires:  systemd-rpm-macros
BuildRequires:  sudo

Requires:       git-core
Requires:       dnf
Requires:       nodejs >= 22
Requires:       rpm
Requires:       systemd
Requires(pre):  shadow-utils
Provides:       user(repogoon)
Provides:       group(repogoon)

%description
rgoon-sync keeps RepoGoon instances converged. It synchronizes Git
repositories, wikis, snippets, avatars, branding, release assets, Git LFS
objects, and operator-defined durable file stores. Complete SQLite database
replication, including groups and all other relational state, is optional.

%package sqlite
Summary:        Privilege policy for rgoon-sync SQLite replication
Requires:       %{name} = %{version}-%{release}
Requires:       sudo

%description sqlite
Installs the narrow sudo policy that permits the rgoon-sync service account to
stop and start repogoon.service while atomically applying an explicitly enabled
SQLite replica snapshot. Install this subpackage only on SQLite replicas.

%package repogoon-config
Summary:        Privilege helper for synchronizing RepoGoon configuration
Requires:       %{name} = %{version}-%{release}
Requires:       sudo

%description repogoon-config
Installs a fixed-path helper and narrow sudo policy that allow an explicitly
configured replica to atomically apply the primary instance's RepoGoon
config.yml and restart repogoon.service when it is active.

%prep
%autosetup

%build
# The daemon uses Node.js built-ins and has no generated runtime artifacts.

%install
install -d %{buildroot}%{_datadir}/%{name}
install -d %{buildroot}%{_datadir}/%{name}/src
install -d %{buildroot}%{_datadir}/%{name}/docs
install -d %{buildroot}%{_sysconfdir}/%{name}
install -d %{buildroot}%{_sharedstatedir}/%{name}
install -d %{buildroot}%{_bindir}
install -d %{buildroot}%{_mandir}/man1
install -d %{buildroot}%{_unitdir}
install -d %{buildroot}%{_libexecdir}
install -d %{buildroot}%{_sysconfdir}/sudoers.d

install -m 0755 src/cli.js %{buildroot}%{_datadir}/%{name}/src/cli.js
install -m 0644 \
    src/config.js \
    src/database-sync.js \
    src/git-sync.js \
    src/inventory.js \
    src/process.js \
    src/repogoon-config-sync.js \
    src/repogoon-paths.js \
    src/security.js \
    src/server.js \
    src/setup.js \
    src/state.js \
    src/sync.js \
    %{buildroot}%{_datadir}/%{name}/src/
install -m 0644 package.json %{buildroot}%{_datadir}/%{name}/package.json
install -m 0644 docs/data-coverage.md %{buildroot}%{_datadir}/%{name}/docs/
ln -s ../share/%{name}/src/cli.js %{buildroot}%{_bindir}/%{name}

install -m 0640 config.example.json %{buildroot}%{_sysconfdir}/%{name}/config.json
install -m 0644 man/%{name}.1 %{buildroot}%{_mandir}/man1/%{name}.1
install -m 0644 systemd/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
install -m 0440 systemd/%{name}.sudoers \
    %{buildroot}%{_sysconfdir}/sudoers.d/%{name}
install -m 0755 packaging/%{name}-apply-repogoon-config \
    %{buildroot}%{_libexecdir}/%{name}-apply-repogoon-config
install -m 0440 systemd/%{name}-repogoon-config.sudoers \
    %{buildroot}%{_sysconfdir}/sudoers.d/%{name}-repogoon-config

%check
node --test
node --check src/*.js test/*.js
systemd-analyze verify systemd/%{name}.service
visudo -cf systemd/%{name}.sudoers
visudo -cf systemd/%{name}-repogoon-config.sudoers
sh -n packaging/%{name}-apply-repogoon-config

%pre
getent group repogoon >/dev/null || groupadd -r repogoon
getent passwd repogoon >/dev/null || \
    useradd -r -g repogoon -d %{_sharedstatedir}/repogoon \
    -s /sbin/nologin -c "RepoGoon service account" repogoon
exit 0

%post
%systemd_post %{name}.service

%preun
%systemd_preun %{name}.service

%postun
%systemd_postun_with_restart %{name}.service

%files
%license LICENSE
%doc README.md config.replica.example.json
%{_bindir}/%{name}
%{_mandir}/man1/%{name}.1*
%{_datadir}/%{name}
%{_unitdir}/%{name}.service
%attr(0750,root,repogoon) %dir %{_sysconfdir}/%{name}
%attr(0640,root,repogoon) %config(noreplace) %{_sysconfdir}/%{name}/config.json
%attr(0750,repogoon,repogoon) %dir %{_sharedstatedir}/%{name}

%files sqlite
%doc README.md
%config(noreplace) %{_sysconfdir}/sudoers.d/%{name}

%files repogoon-config
%doc README.md
%{_libexecdir}/%{name}-apply-repogoon-config
%config(noreplace) %{_sysconfdir}/sudoers.d/%{name}-repogoon-config

%changelog
* Sun Aug 02 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-2
- Add systemd build dependency for systemd-analyze verification

* Sun Jul 26 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-1
- Initial package for complete RepoGoon repository and durable-file synchronization
- Add opt-in full SQLite database replication with recoverable replica convergence
- Add interactive setup with automatic optional helper-package installation
- Add opt-in synchronization for the main RepoGoon configuration
- Discover live RepoGoon storage paths from its YAML configuration
- Provide the shared RepoGoon service identity required by secured package paths