Name:           rgoon-sync
Version:        0.2.0
Release:        1%{?dist}
Summary:        Synchronization layer for RepoGoon instances
License:        MPL-2.0
URL:            https://repogoon.org/repo/repogoon-org/rgoon-sync
Source0:        %{url}/archive/%{version}/%{name}-%{version}.tar.gz
BuildArch:      noarch

BuildRequires:  git-core
BuildRequires:  nodejs >= 22
BuildRequires:  npm
BuildRequires:  systemd
BuildRequires:  systemd-rpm-macros
BuildRequires:  sudo

Requires:       git-core
Requires:       dnf
Requires:       nodejs >= 22
Requires:       rpm
Requires:       systemd
Requires(pre):  shadow-utils
Provides:       user(repogoon)
Provides:       group(repogoon)
Provides:       bundled(nodejs-jose) = 6.2.8
Provides:       bundled(nodejs-yaml) = 2.9.0

%description
rgoon-sync keeps RepoGoon instances converged. It synchronizes Git
repositories, wikis, snippets, avatars, branding, release assets, Git LFS
objects, and operator-defined durable file stores. Complete SQLite database
replication, including groups and all other relational state, is optional.

%package sqlite
Summary:        Privilege policy for rgoon-sync SQLite replication
Requires:       %{name} = %{version}-%{release}
Requires:       sudo

%description sqlite
Installs the narrow sudo policy that permits the rgoon-sync service account to
stop and start repogoon.service while atomically applying an explicitly enabled
SQLite replica snapshot. Install this subpackage only on SQLite replicas.

%package repogoon-config
Summary:        Privilege helper for synchronizing RepoGoon configuration
Requires:       %{name} = %{version}-%{release}
Requires:       sudo

%description repogoon-config
Installs a fixed-path helper and narrow sudo policy that allow an explicitly
configured replica to atomically apply the primary instance's RepoGoon
config.yml and restart repogoon.service when it is active.

%package repogoon-secrets
Summary:        Privileged helpers for RepoGoon secret synchronization
Requires:       %{name} = %{version}-%{release}
Requires:       repogoon >= 0.13.0
Requires:       sudo

%description repogoon-secrets
Installs fixed, no-argument export and apply helpers plus a narrow sudo policy.
The unprivileged daemon handles only recipient-specific JOSE ciphertext; the
helpers access each node's selected RepoGoon secret store as root.

%prep
%autosetup

%build
npm ci --ignore-scripts

%install
install -d %{buildroot}%{_datadir}/%{name}
install -d %{buildroot}%{_datadir}/%{name}/src
install -d %{buildroot}%{_datadir}/%{name}/docs
install -d %{buildroot}%{_sysconfdir}/%{name}
install -d %{buildroot}%{_sharedstatedir}/%{name}
install -d %{buildroot}%{_bindir}
install -d %{buildroot}%{_mandir}/man1
install -d %{buildroot}%{_unitdir}
install -d %{buildroot}%{_libexecdir}
install -d %{buildroot}%{_sysconfdir}/sudoers.d

install -m 0755 src/cli.js %{buildroot}%{_datadir}/%{name}/src/cli.js
install -m 0644 \
    src/config.js \
    src/database-sync.js \
    src/git-sync.js \
    src/inventory.js \
    src/process.js \
    src/repogoon-config-sync.js \
    src/repogoon-paths.js \
    src/repogoon-secret-helper.js \
    src/runtime-security.js \
    src/secret-envelope.js \
    src/secret-sync.js \
    src/security.js \
    src/server.js \
    src/setup.js \
    src/state.js \
    src/sync.js \
    %{buildroot}%{_datadir}/%{name}/src/
install -m 0644 package.json %{buildroot}%{_datadir}/%{name}/package.json
install -d %{buildroot}%{_datadir}/%{name}/node_modules
cp -a node_modules/jose node_modules/yaml %{buildroot}%{_datadir}/%{name}/node_modules/
install -m 0644 docs/data-coverage.md %{buildroot}%{_datadir}/%{name}/docs/
install -m 0755 packaging/%{name}-launcher %{buildroot}%{_bindir}/%{name}

install -m 0640 config.example.json %{buildroot}%{_sysconfdir}/%{name}/config.json
install -m 0644 man/%{name}.1 %{buildroot}%{_mandir}/man1/%{name}.1
install -m 0644 systemd/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
install -m 0440 systemd/%{name}.sudoers \
    %{buildroot}%{_sysconfdir}/sudoers.d/%{name}
install -m 0755 packaging/%{name}-apply-repogoon-config \
    %{buildroot}%{_libexecdir}/%{name}-apply-repogoon-config
install -m 0440 systemd/%{name}-repogoon-config.sudoers \
    %{buildroot}%{_sysconfdir}/sudoers.d/%{name}-repogoon-config
install -m 0755 packaging/%{name}-export-secrets packaging/%{name}-apply-secrets \
    %{buildroot}%{_libexecdir}/
install -m 0440 systemd/%{name}-repogoon-secrets.sudoers \
    %{buildroot}%{_sysconfdir}/sudoers.d/%{name}-repogoon-secrets

%check
npm test
node --check src/*.js test/*.js
systemd_verify_log="$(mktemp)"
if ! systemd-analyze verify systemd/%{name}.service 2>"${systemd_verify_log}"; then
    systemd_runtime_error="Failed to create directory '/run/systemd/': Permission denied"
    if grep -Fxq "${systemd_runtime_error}" "${systemd_verify_log}" &&
        ! grep -Fvx "${systemd_runtime_error}" "${systemd_verify_log}" | grep -q '[^[:space:]]'; then
        cat "${systemd_verify_log}" >&2
        echo "Skipping systemd unit verification: the unprivileged build root cannot initialize /run/systemd" >&2
    else
        cat "${systemd_verify_log}" >&2
        rm -f "${systemd_verify_log}"
        exit 1
    fi
fi
rm -f "${systemd_verify_log}"
visudo -cf systemd/%{name}.sudoers
visudo -cf systemd/%{name}-repogoon-config.sudoers
visudo -cf systemd/%{name}-repogoon-secrets.sudoers
sh -n packaging/%{name}-apply-repogoon-config
sh -n packaging/%{name}-export-secrets packaging/%{name}-apply-secrets
sh -n packaging/%{name}-launcher

%pre
getent group repogoon >/dev/null || groupadd -r repogoon
getent passwd repogoon >/dev/null || \
    useradd -r -g repogoon -d %{_sharedstatedir}/repogoon \
    -s /sbin/nologin -c "RepoGoon service account" repogoon
exit 0

%post
%systemd_post %{name}.service

%preun
%systemd_preun %{name}.service

%postun
%systemd_postun_with_restart %{name}.service

%files
%license LICENSE
%doc README.md config.replica.example.json
%{_bindir}/%{name}
%{_mandir}/man1/%{name}.1*
%{_datadir}/%{name}
%{_unitdir}/%{name}.service
%attr(0750,root,repogoon) %dir %{_sysconfdir}/%{name}
%attr(0640,root,repogoon) %config(noreplace) %{_sysconfdir}/%{name}/config.json
%attr(0750,repogoon,repogoon) %dir %{_sharedstatedir}/%{name}

%files sqlite
%doc README.md
%config(noreplace) %{_sysconfdir}/sudoers.d/%{name}

%files repogoon-config
%doc README.md
%{_libexecdir}/%{name}-apply-repogoon-config
%config(noreplace) %{_sysconfdir}/sudoers.d/%{name}-repogoon-config

%files repogoon-secrets
%doc README.md
%{_libexecdir}/%{name}-export-secrets
%{_libexecdir}/%{name}-apply-secrets
%config(noreplace) %{_sysconfdir}/sudoers.d/%{name}-repogoon-secrets

%changelog
* Fri Aug 14 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.2.0-1
- Add recipient-specific JOSE secret snapshots, signed acknowledgments, and replay controls
- Add opt-in fixed privileged helpers, setup/status commands, and key-before-data barriers
- Preserve replica-local RepoGoon secret-store and rgoon-sync identity settings during config sync
- Enforce exact 100 percent statements, branches, functions, and lines coverage in npm test
- Set zero core limits and memory-map filters, reject unsafe Node diagnostic flags, and report residual handler risk
- Add exact packaging coverage for the fixed launcher and secure service profile

* Sun Aug 02 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-3
- Keep unit verification strict while tolerating Fedora mock runtime restrictions

* Sun Aug 02 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-2
- Add systemd build dependency for systemd-analyze verification

* Sun Jul 26 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-1
- Initial package for complete RepoGoon repository and durable-file synchronization
- Add opt-in full SQLite database replication with recoverable replica convergence
- Add interactive setup with automatic optional helper-package installation
- Add opt-in synchronization for the main RepoGoon configuration
- Discover live RepoGoon storage paths from its YAML configuration
- Provide the shared RepoGoon service identity required by secured package paths