From 58df6e58ba0f9b1393b7103e1d9a8fba56907067 Mon Sep 17 00:00:00 2001
From: Paul Lecuq <paul@paulbsd.com>
Date: Sat, 1 Oct 2022 20:12:26 +0200
Subject: [PATCH] updated repos state

---
 states/repos/defaults.yaml |  2 ++
 states/repos/init.sls      | 40 +++-----------------------------
 states/repos/map.jinja     |  5 ++++
 states/repos/prereqs.sls   |  8 +++++++
 states/repos/repos.sls     | 47 ++++++++++++++++++++++++++++++++++++++
 5 files changed, 65 insertions(+), 37 deletions(-)
 create mode 100644 states/repos/defaults.yaml
 create mode 100644 states/repos/map.jinja
 create mode 100644 states/repos/prereqs.sls
 create mode 100644 states/repos/repos.sls

diff --git a/states/repos/defaults.yaml b/states/repos/defaults.yaml
new file mode 100644
index 0000000..04c279c
--- /dev/null
+++ b/states/repos/defaults.yaml
@@ -0,0 +1,2 @@
+---
+repos:
diff --git a/states/repos/init.sls b/states/repos/init.sls
index 4f5ead2..4c05485 100644
--- a/states/repos/init.sls
+++ b/states/repos/init.sls
@@ -1,38 +1,4 @@
 ---
-repo-require:
-  cmd.run:
-    - name: apt install -y python3-apt
-
-{%- for repo in pillar.get('repos') %}
-
-{%- if repo['enabled'] %}
-repo-{{ repo['name'] }}:
-  pkgrepo.managed:
-    - humanname: {{ repo['humanname'] }}
-    {%- if repo['ppa'] %}
-    - ppa: {{ repo['ppasrc'] }}
-    - dist: {{ repo['dist'] }}
-    {%- elif not repo['ppa'] %}
-    - name: {{ repo['src'] }}
-    - gpgcheck: {{ repo['gpgcheck']|default(1) }}
-    - file: {{ repo['file'] }}
-    - clean_file: true
-    {%- if repo['key_method'] is defined %}
-    {%- if repo['key_method'] == 'file' %}
-    - key_url: {{ repo['key_url'] }}
-    {%- elif repo['key_method'] == 'server' %}
-    - keyid: {{ repo['keyid'] }}
-    - keyserver: {{ repo['keyserver'] }}
-    {%- endif %}
-    {%- endif %}
-    {%- endif %}
-{%- else %}
-
-repo-{{ repo['name'] }}:
-  file.absent:
-{%- if not repo['ppa'] %}
-    - name: {{ repo['file'] }}
-{%- endif %}
-{%- endif %}
-
-{%- endfor %}
+include:
+  - .prereqs
+  - .repos
diff --git a/states/repos/map.jinja b/states/repos/map.jinja
new file mode 100644
index 0000000..7ca4aef
--- /dev/null
+++ b/states/repos/map.jinja
@@ -0,0 +1,5 @@
+{%- import_yaml "repos/defaults.yaml" as default_settings -%}
+
+{%- set defaults = salt['grains.filter_by'](default_settings, default='repos') -%}
+
+{%- set repos = salt['pillar.get']('repos', default=defaults, merge=True) -%}
diff --git a/states/repos/prereqs.sls b/states/repos/prereqs.sls
new file mode 100644
index 0000000..ddca50b
--- /dev/null
+++ b/states/repos/prereqs.sls
@@ -0,0 +1,8 @@
+---
+repo-pkg-require:
+  cmd.run:
+    - name: apt install -y python3-apt
+
+repo-pkg-keyrings-dir:
+  file.directory:
+    - name: /etc/apt/keyrings
diff --git a/states/repos/repos.sls b/states/repos/repos.sls
new file mode 100644
index 0000000..480d920
--- /dev/null
+++ b/states/repos/repos.sls
@@ -0,0 +1,47 @@
+---
+{%- from "repos/map.jinja" import repos with context %}
+{%- for repo in repos %}
+
+{%- if repo.enabled %}
+{%- if repo.key_method is defined %}
+{%- if repo.key_method == 'file' %}
+repo-key-{{ repo.name }}:
+  file.managed:
+    - name: /etc/apt/keyrings/{{ repo.name }}
+    - source: {{ repo.key_url }}
+    - skip_verify: true
+{% endif %}
+{% endif %}
+
+repo-{{ repo.name }}:
+  pkgrepo.managed:
+    - humanname: {{ repo.humanname }}
+    {%- if repo.ppa %}
+    - ppa: {{ repo.ppasrc }}
+    - dist: {{ repo.dist }}
+    {%- else %}
+    - name: deb [signed-by=/etc/apt/keyrings/{{ repo.name }}] {{ repo.src }} {{ repo.suites }} {{ repo.components }}
+    - gpgcheck: {{ repo.gpgcheck|default(1) }}
+    - aptkey: false
+    - file: {{ repo.file }}
+    - clean_file: true
+    {%- if repo.key_method is defined %}
+    {%- if repo.key_method == 'file' %}
+    - key_url: {{ repo.key_url }}
+    {%- elif repo.key_method == 'server' %}
+    - keyid: {{ repo.keyid }}
+    - keyserver: {{ repo.keyserver }}
+    {%- endif %}
+    {%- endif %}
+    {%- endif %}
+{%- else %}
+
+repo-{{ repo.name }}:
+  file.absent:
+{%- if not repo.ppa %}
+    - name: {{ repo.file }}
+{%- endif %}
+{%- endif %}
+
+{%- endfor %}
+