18 files changed, 144 insertions, 31 deletions
diff --git a/files/etc/apt/trusted.gpg.d/signal.org.gpg b/files/etc/apt/keyrings/signal.org.gpg
index b5e68a0..b5e68a0 100644
--- a/files/etc/apt/trusted.gpg.d/signal.org.gpg
+++ b/files/etc/apt/keyrings/signal.org.gpg
diff --git a/files/etc/apt/trusted.gpg.d/torproject.org.gpg b/files/usr/share/keyrings/deb.torproject.org-keyring.gpg
index 7614b20..738ef5d 100644
--- a/files/etc/apt/trusted.gpg.d/torproject.org.gpg
+++ b/files/usr/share/keyrings/deb.torproject.org-keyring.gpg
diff --git a/manifests/resources.pp b/manifests/resources.pp
index 7a48367..4e61fb9 100644
--- a/manifests/resources.pp
+++ b/manifests/resources.pp
@@ -59,4 +59,8 @@ class nodo::resources {
   # Repositories
   $vcsrepos = lookup('vcsrepos', { merge => hash, default_value => {} })
   create_resources('vcsrepo', $vcsrepos)
+
+  # Sysctl
+  $sysctl = lookup('nodo::subsystem::sysctl', { merge => hash, default_value => {} })
+  create_resources('nodo::subsystem::sysctl::entry', $sysctl)
 }
diff --git a/manifests/subsystem/apt.pp b/manifests/subsystem/apt.pp
index 28db591..2dcbc26 100644
--- a/manifests/subsystem/apt.pp
+++ b/manifests/subsystem/apt.pp
@@ -14,8 +14,9 @@ class nodo::subsystem::apt(
     default    => 'enabled',
     }
 ) {
+  # This one is no longer necessary
   package { 'apt-transport-https':
-    ensure => installed,
+    ensure => absent,
   }
 
   # See https://www.cyberciti.biz/faq/howto-use-apt-get-with-ipv6-or-ipv4-transport-on-ubuntu-debian/
@@ -56,6 +57,18 @@ class nodo::subsystem::apt(
     },
   }
 
+  file { '/etc/apt/preferences':
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => '0644',
+    require => [ File['/etc/apt/apt.conf.d/1000-force-ipv4-transport'], Package['apt-transport-https'] ],
+    content => $ensure ? {
+      'present' => template("nodo/apt/${::operatingsystem}.preferences.erb"),
+       default  => undef,
+    },
+  }
+
   # We have /var/log/dpkg.log, so we do not need to rotate /var/log/upgrade.log
   $log = ">> /var/log/upgrade.log 2>&1"
   $apt = '/usr/bin/apt-get'
diff --git a/manifests/subsystem/apt/repo.pp b/manifests/subsystem/apt/repo.pp
index ca8f5e1..0495a0f 100644
--- a/manifests/subsystem/apt/repo.pp
+++ b/manifests/subsystem/apt/repo.pp
@@ -1,15 +1,32 @@
 define nodo::subsystem::apt::repo(
   $definition,
   $key_source,
-  $ensure = present,
+  $keyrings_folder = '/etc/apt/keyrings',
+  $keyring_name    = $name,
+  $ensure          = present,
 ) {
-  file { "/etc/apt/trusted.gpg.d/${name}.gpg":
+  # The recommended locations for keyrings are /usr/share/keyrings for keyrings
+  # managed by packages, and /etc/apt/keyrings for keyrings managed by the
+  # system operator. If no keyring files are specified the default is the
+  # trusted.gpg keyring and all keyrings in the trusted.gpg.d/ directory (see
+  # apt-key fingerprint).
+  #
+  # -- sources.list(5)
+  file { "${keyrings_folder}/${name}.gpg":
     ensure  => $ensure,
     owner   => "root",
     group   => "root",
     mode    => "0644",
     source  => $key_source,
-    notify  => Exec["apt-repo-auto-update-${name}"],
+  }
+
+  # Old location
+  file { "/etc/apt/trusted.gpg.d/${name}.gpg":
+    ensure  => absent,
+    owner   => "root",
+    group   => "root",
+    mode    => "0644",
+    source  => $key_source,
   }
 
   file { "/etc/apt/sources.list.d/${name}.list":
@@ -18,7 +35,7 @@ define nodo::subsystem::apt::repo(
     group   => "root",
     mode    => "0644",
     content => "${definition}\n",
-    require => [ File["/etc/apt/trusted.gpg.d/${name}.gpg"], Package['apt-transport-https'] ],
+    require => [ File["${keyrings_folder}/${name}.gpg"], Package['apt-transport-https'] ],
     notify  => Exec["apt-repo-auto-update-${name}"],
   }
 
diff --git a/manifests/subsystem/inception.pp b/manifests/subsystem/inception.pp
index 7cd9d0a..913f5d5 100644
--- a/manifests/subsystem/inception.pp
+++ b/manifests/subsystem/inception.pp
@@ -9,7 +9,7 @@ define nodo::subsystem::inception(
     user       => $name,
     provider   => git,
     source     => "https://git.fluxo.info/${git_dev}/apps",
-    revision   => 'e59e4465dd90943853aba944056e0790c8c746e1',
+    revision   => '63e093c355258142053d37a46579d9b19074324d',
     submodules => true,
     require    => [ File["/home/${name}"], User[$name] ],
   }
diff --git a/manifests/subsystem/sensors.pp b/manifests/subsystem/sensors.pp
index 104a0f5..8a19831 100644
--- a/manifests/subsystem/sensors.pp
+++ b/manifests/subsystem/sensors.pp
@@ -3,9 +3,9 @@ class nodo::subsystem::sensors {
   # SMART monitoring
   #
 
-  $smartmontools = lookup('nodo::sensors::smartmontools', undef, undef, true)
+  $smartmontools = lookup('nodo::sensors::smartmontools', undef, undef, 'present')
 
-  if $smartmontools == true {
+  if $smartmontools == 'present' {
     class { 'smartmontools': }
   }
 
@@ -13,7 +13,7 @@ class nodo::subsystem::sensors {
   # LM Sensors
   #
 
-  $lm_sensors = lookup('nodo::sensors::lm_sensors', undef, undef, true)
+  $lm_sensors = lookup('nodo::sensors::lm_sensors', undef, undef, 'present')
 
   package { [
     'lm-sensors',
@@ -22,6 +22,22 @@ class nodo::subsystem::sensors {
   }
 
   #
+  # drivetemp
+  #
+  # Just load this driver and lm-sensors will detect sensors automatically.
+  #
+  # https://www.baeldung.com/linux/hdd-ssd-temperature
+  # https://askubuntu.com/questions/1426482/tool-to-monitor-hdd-temperature-in-ubuntu-server-22-04
+  # https://wiki.archlinux.org/title/Lm_sensors#S.M.A.R.T._drive_temperature
+  # https://github.com/philipl/drivetemp
+
+  $drivetemp = lookup('nodo::sensors::drivetemp', undef, undef, 'present')
+
+  nodo::subsystem::modprobe::module { 'drivetemp':
+    ensure => $drivetemp,
+  }
+
+  #
   # hddtemp
   #
 
@@ -37,18 +53,4 @@ class nodo::subsystem::sensors {
       default  => absent,
     }
   }
-
-  #
-  # drivetemp
-  #
-  # https://www.baeldung.com/linux/hdd-ssd-temperature
-  # https://askubuntu.com/questions/1426482/tool-to-monitor-hdd-temperature-in-ubuntu-server-22-04
-  # https://wiki.archlinux.org/title/Lm_sensors#S.M.A.R.T._drive_temperature
-  # https://github.com/philipl/drivetemp
-
-  $drivetemp = lookup('nodo::sensors::drivetemp', undef, undef, true)
-
-  nodo::subsystem::modprobe::module { 'drivetemp':
-    ensure => $drivetemp,
-  }
 }
diff --git a/manifests/utils.pp b/manifests/utils.pp
index bd8f692..5847438 100644
--- a/manifests/utils.pp
+++ b/manifests/utils.pp
@@ -1,5 +1,12 @@
 # Common utilities
 class nodo::utils inherits nodo::utils::base {
+  # Ensure every node are ready for offline operation
+  package { [
+    'apt-offline',
+  ]:
+    ensure  => present,
+  }
+
   package { [
     'pv',
     'gcp',
diff --git a/manifests/utils/development/ide.pp b/manifests/utils/development/ide.pp
index 47d3d98..8361562 100644
--- a/manifests/utils/development/ide.pp
+++ b/manifests/utils/development/ide.pp
@@ -8,7 +8,7 @@ class nodo::utils::development::ide (
     'myrepos',
 
     'python3-sphinx',
-    'python3-recommonmark',
+    'python3-myst-parser',
 
     'yamllint',
 
@@ -66,6 +66,10 @@ class nodo::utils::development::ide (
     'exuberant-ctags',
     'doxygen',
     'agave',
+
+    # Deprecated in favor of python3-myst-parser
+    # https://github.com/readthedocs/recommonmark
+    'python3-recommonmark',
   ]:
     ensure => absent,
   }
diff --git a/manifests/utils/multimedia.pp b/manifests/utils/multimedia.pp
index 0b40660..30f5999 100644
--- a/manifests/utils/multimedia.pp
+++ b/manifests/utils/multimedia.pp
@@ -33,7 +33,6 @@ class nodo::utils::multimedia inherits nodo::utils::multimedia::minimal {
     'audacious',
     'qjackctl',
     'easytag',
-    'audacity',
     'opencubicplayer',
     'picard',
     'gxine',
diff --git a/manifests/utils/multimedia/cdplayer.pp b/manifests/utils/multimedia/cdplayer.pp
index e2c7a71..6ec3d0e 100644
--- a/manifests/utils/multimedia/cdplayer.pp
+++ b/manifests/utils/multimedia/cdplayer.pp
@@ -3,10 +3,16 @@ class nodo::utils::multimedia::cdplayer (
 ) {
   # CD writers and extractors
   package { [
-    'mcdp',
     'cdtool',
     'cd-discid',
   ]:
     ensure => $ensure,
   }
+
+  # No longer available
+  package { [
+    'mcdp',
+  ]:
+    ensure => absent,
+  }
 }
diff --git a/manifests/utils/multimedia/studio.pp b/manifests/utils/multimedia/studio.pp
index 72b42b1..0675a08 100644
--- a/manifests/utils/multimedia/studio.pp
+++ b/manifests/utils/multimedia/studio.pp
@@ -5,6 +5,7 @@ class nodo::utils::multimedia::studio (
     'ardour',
     'hydrogen',
     'mixxx',
+    'audacity',
   ]:
     ensure => $ensure,
   }
diff --git a/manifests/utils/network/signal.pp b/manifests/utils/network/signal.pp
index 037140a..6cd200b 100644
--- a/manifests/utils/network/signal.pp
+++ b/manifests/utils/network/signal.pp
@@ -1,7 +1,7 @@
 class nodo::utils::network::signal {
   nodo::subsystem::apt::repo { 'signal.org':
-    definition => 'deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main',
-    key_source => 'puppet:///modules/nodo/etc/apt/trusted.gpg.d/signal.org.gpg',
+    definition => 'deb [signed-by=/etc/apt/keyrings/signal.org.gpg arch=amd64] https://updates.signal.org/desktop/apt xenial main',
+    key_source => 'puppet:///modules/nodo/etc/apt/keyrings/signal.org.gpg',
   }
 
   package { 'signal-desktop':
diff --git a/manifests/utils/network/tor.pp b/manifests/utils/network/tor.pp
index 78b08a4..f93d37a 100644
--- a/manifests/utils/network/tor.pp
+++ b/manifests/utils/network/tor.pp
@@ -3,9 +3,28 @@
 class nodo::utils::network::tor (
   $ensure = 'installed',
 ) {
+  $keyrings_folder = "/usr/share/keyrings"
+  $keyring         = "${keyrings_folder}/deb.torproject.org-keyring.gpg"
+
   nodo::subsystem::apt::repo { 'torproject.org':
-    definition => "deb [signed-by=/etc/apt/trusted.gpg.d/torproject.org.gpg] https://deb.torproject.org/torproject.org ${::lsbdistcodename} main",
-    key_source => 'puppet:///modules/nodo/etc/apt/trusted.gpg.d/torproject.org.gpg',
+    definition      => "deb [signed-by=${keyring}] https://deb.torproject.org/torproject.org ${::lsbdistcodename} main",
+    key_source      => "puppet:///modules/nodo/${keyring}",
+    keyrings_folder => "${keyrings_folder}",
+  }
+
+  # Puppet should setup the Tor Project's APT keyring only in the first time
+  # Afterwards ${keyring} will be managed by the deb.torproject.org-keyring package
+  #
+  # References:
+  #
+  # * https://support.torproject.org/apt/tor-deb-repo/
+  # * https://gitlab.torproject.org/tpo/web/support/-/merge_requests/220
+  exec { 'torproject-keyring-copy':
+    command => "cp ${keyrings_folder}/torproject.org.gpg ${keyring}",
+    onlyif  => "/bin/test ! -e ${keyring}",
+    creates => "${keyring}",
+    require => File["${keyrings_folder}/torproject.org.gpg"],
+    notify  => Exec["apt-repo-auto-update-torproject.org"],
   }
 
   package { "deb.torproject.org-keyring":
@@ -14,8 +33,15 @@ class nodo::utils::network::tor (
   }
 
   package { [
-    'tor-arm',
+    'nyx',
   ]:
     ensure => $ensure,
   }
+
+  # Package 'tor-arm' was renamed to 'nyx'
+  package { [
+    'tor-arm',
+  ]:
+    ensure => absent,
+  }
 }
diff --git a/manifests/utils/office/console.pp b/manifests/utils/office/console.pp
index b35247e..201adbb 100644
--- a/manifests/utils/office/console.pp
+++ b/manifests/utils/office/console.pp
@@ -17,6 +17,11 @@ class nodo::utils::office::console (
     #'worklog',
     #'lolcat',
     #'aewan',
+
+    # Needed by finder
+    # https://git.fluxo.info/finder
+    'python3-prompt-toolkit',
+    'python3-platformdirs',
   ]:
     ensure => $ensure,
   }
diff --git a/manifests/utils/office/gui.pp b/manifests/utils/office/gui.pp
index 6cde1aa..5f80288 100644
--- a/manifests/utils/office/gui.pp
+++ b/manifests/utils/office/gui.pp
@@ -4,6 +4,7 @@ class nodo::utils::office::gui (
   package { [
     'libreoffice',
     'libreoffice-gtk3',
+    'pdfarranger',
     #'pdftk',
   ]:
     ensure => $ensure,
diff --git a/manifests/utils/storage/archive.pp b/manifests/utils/storage/archive.pp
index 336c74d..9eecc44 100644
--- a/manifests/utils/storage/archive.pp
+++ b/manifests/utils/storage/archive.pp
@@ -6,6 +6,7 @@ class nodo::utils::storage::archive (
     'convmv',
     'rdfind',
     'rclone',
+    'onionshare',
   ]:
     #ensure => latest,
     ensure => $ensure,
diff --git a/templates/apt/Debian.preferences.erb b/templates/apt/Debian.preferences.erb
new file mode 100644
index 0000000..63729ff
--- /dev/null
+++ b/templates/apt/Debian.preferences.erb
@@ -0,0 +1,27 @@
+# This file is managed by puppet
+# all local modifications will be overwritten
+
+Explanation: Debian <%= scope.lookupvar('::lsbdistcodename') %>
+Package: *
+Pin: release o=Debian,n=<%= scope.lookupvar('::lsbdistcodename') %>
+Pin-Priority: 990
+
+Explanation: Debian <%= scope.lookupvar('::lsbdistcodename') %>-updates
+Package: *
+Pin: release o=Debian,n=<%= scope.lookupvar('::lsbdistcodename') %>-updates
+Pin-Priority: 990
+
+Explanation: Debian <%= scope.lookupvar('::lsbdistcodename') %>-security
+Package: *
+Pin: release o=Debian,n=<%= scope.lookupvar('::lsbdistcodename') %>-security
+Pin-Priority: 990
+
+Explanation: Debian sid
+Package: *
+Pin: release o=Debian,n=sid
+Pin-Priority: 1
+
+Explanation: Debian fallback
+Package: *
+Pin: release o=Debian
+Pin-Priority: -10